Unwanted POPupS at work unfortunately
| Author |
Message |
third_try
Joined: 21 Jun 2007
Posts: 4
|
 Post subject: Unwanted POPupS at work unfortunately |
 |
|
Here is a copy of my LOG FILE, any help is apprciated
:
Logfile of HijackThis v1.99.1
Scan saved at 8:19:31 AM, on 6/21/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\UPHClean\uphclean.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\sbhveyid.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\PROGRA~1\MICROS~2\LIVEME~1\Addins\LMCAPI.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\car48972\Local Settings\Temp\wz7775\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lightsource.jdsu.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lightsource.jdsu.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lightsource.jdsu.net/
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://lightsource.jdsu.net
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.3.1_02) - http://gskronosweb1.ds.jdsu.net/WFC/plugins/j2re-1_3_1_02-win.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://jdsu.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\Software\..\Telephony: DomainName = ds.jdsu.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC0B49D-0E39-43CA-961B-51AF9CA34AAC}: Domain = ds.jdsu.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: DomainService - - C:\WINDOWS\system32\sbhveyid.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing) |
|
Thu Jun 21, 2007 12:19 pm
 |
|
 |
HJT Analyzer
Joined: 15 Mar 2006
Posts: 638
|
| Post subject: My HijackThis log |
|
|
Hello, visitor!
The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.
Your log does not indicate any spyware or virus infection. However, there are some entries that you might want to fix. Please follow the steps below.
The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lightsource.jdsu.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lightsource.jdsu.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lightsource.jdsu.net/
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ''Tools'' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://lightsource.jdsu.net
O16 - DPF: {9b935470-ad4a-11d5-b63e-00c04faedb18} (Oracle JInitiator 1.1.8.16) -
O16 - DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} (Java Runtime Environment 1.3.1_02) - http://gskronosweb1.ds.jdsu.net/WFC/plugins/j2re-1_3_1_02-win.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://jdsu.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\Software\..\Telephony: DomainName = ds.jdsu.net
O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC0B49D-0E39-43CA-961B-51AF9CA34AAC}: Domain = ds.jdsu.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ds.jdsu.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ds.jdsu.net
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\Microsoft Office Communicator\Communicator.exe
C:\WINDOWS\system32\sbhveyid.exe
C:\PROGRA~1\MICROS~2\LIVEME~1\Addins\LMCAPI.exe
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKCU\..\Run: [COMMUNICATOR] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" /background
O23 - Service: DomainService - - C:\WINDOWS\system32\sbhveyid.exe
If you want to see more detailed analysis of your log, click here.
Thank you for using the 2-Spyware.com HijackThis log analyzer beta 2! |
|
Thu Jun 21, 2007 12:19 pm
|
|
|
third_try
Joined: 21 Jun 2007
Posts: 4
|
| Post subject: Still a Problem |
|
|
Even though the scanner says nothing is int the log file, I get constant virus scan messages detected as Vundo - one that appears in the list often is func.exe, other s listed and many more under the directory Local Settings\Temorary Files\Content.IE5\ |
|
Thu Jun 21, 2007 12:31 pm
|
|
|
junior08jr8
Joined: 25 Jun 2006
Posts: 194
|
| Post subject: |
|
|
Hi third_try. Welcome to 2-spyware.com Forums!
1. Use HijacThis on the following entries:
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
Your log doesn't reveal any signs of infection.
Download the free version of SUPERAntiSpyware. Install the program, update its definitions and run a complete system scan. |
|
Sat Jun 23, 2007 6:06 pm
|
|
|
third_try
Joined: 21 Jun 2007
Posts: 4
|
| Post subject: Unwanted POPupS at work unfortunately |
|
|
Was not able to install Superspyware - system adinstartion did not allow: Ran AVG Anti-Spyware, Windows Defender in safe mode. On starup next day got following messages:
ANG Anti-Spyware: Malware found
-Trojan.Agent.aoy
Virus Scan Alert:
effxpaw.dll detected as Vundo application rundll32,exe
ffa_mv20070611(1) detected as Vundo application explorer.exe
ffa_mv20070611[1} detected as Vundo application explorer.exe
koocwolla_20070601[1] detected as AllowCookie application explorer.exe
koocwolla_20070601[1] detected as Alloecookie application explorer.exe
vfoskpbc.dll Dtected as Vundo application explorer.exe |
|
Mon Jun 25, 2007 11:53 am
|
|
|
third_try
Joined: 21 Jun 2007
Posts: 4
|
| Post subject: Unwanted POPupS at work unfortunately |
|
|
I also get constant popups saying I need to install Win Antivirus PRO..with also downloading bars I did not start |
|
Mon Jun 25, 2007 11:57 am
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
Recommended software:
Spyware Doctor
 (91/100)
Spyware Doctor is a very powerful, but yet highly user-friendly spyware remover, made by PC Tools, reputable computer security experts. This product provides effective and easy-to-manage...
SUPERAntiSpyware
 (89/100)
SUPERAntiSpyware is a powerful, highly effective spyware remover introducing advanced parasite detection and removal features along with reliable real-time protection. The program is not...
CounterSpy
 (85/100)
CounterSpy is a powerful spyware remover based on revolutionary hybrid engine, which incorporates traditional anti-spyware and advanced antivirus engines. Such combination allows CounterSpy...
Malwarebytes Anti Malware
 (75/100)
There are loads of malware removers on the net today and most of them are lightweight applications, which usually means they’re fast and don’t have many features. One such...
Windows Defender
(75/100)
Windows Defender is a free anti-spyware program made by the leading software company to add native spyware protection to its most popular product - the Microsoft Windows operating...
Encyclopedia of parasites:
|
