Any of you noobs can help me get rid of this shit?

Locked
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

I knew I should have installed my fucking router here as well...I used to be ungayable :mad:
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

C:\WINDOWS\System32\printer.exe seems to be the problem...it's there even in safe mode!
Top
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by PhoeniX »

Ok, if you open HijackThis again and check all of these items, then click fix:

C:\WINDOWS\System32\printer.exe
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe
Unknown
O2 - BHO: IEHlprObj Class - {ABCDECF0-4B15-11D1-ABED-709549C10000} - C:\WINDOWS\System32\vtr340.dll
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
Unknown
O4 - HKCU\..\Run: [RemoveIT Pro XT] C:\Program Files\InCode Solutions\RemoveIT Pro v4-Trial\removeit.exe
O4 - Startup: system.exe
O4 - Global Startup: autorun.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
Unknown
O20 - AppInit_DLLs: C:\WINDOWS\system32\hrum455.txt
Unknown
O23 - Service: Windows Notification Service (Winnotify) - Unknown owner - C:\WINDOWS\System32\winntify.exe (file missing)

The reason you're getting popups in safemode is because printer.exe is being run whenever you open an exe file - this should fix it, and should also give you back your control panel.


Once you've done that reboot back into safe mode and do another scan with HiJackThis and post the log again to see if it's gone.
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

PhoeniX wrote:Ok, if you open HijackThis again and check all of these items, then click fix
...in safe mode only?
Top
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by PhoeniX »

I always use the network one so I can access the net - it shouldn't make any difference really.
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Okay, I did the SpyBot test in safe mode and now it looks like my control panel is back but I still seem to have the errors in the HijackThis log...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:16:42 PM, on 8/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winavxx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - Startup: system.exe
O4 - Global Startup: autorun.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://duhard.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://duhard.spaces.live.com/PhotoUpload/MsnPUpld.cab
O18 - Protocol: bw+0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw+0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw-0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw00s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw10s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw20s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw30s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw40s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw50s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw60s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw70s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw80s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bw90s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwa0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwb0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwc0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwd0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwe0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwf0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: bwg0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwg0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwh0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwi0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwj0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwk0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwl0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwm0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwn0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwo0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwp0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwq0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwr0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bws0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwt0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwu0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwv0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bww0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwx0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwy0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: bwz0s - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O18 - Protocol: offline-8876480 - {C1DB6429-44A3-4F42-BE87-65F640CA6620} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\hrum455.txt
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Windows Notification Service (Winnotify) - Unknown owner - C:\WINDOWS\System32\winntify.exe (file missing)

--
End of file - 15279 bytes
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

It looks like most of the stuff is gone but I'm still searching and destroying and it's only the beginning...the noobs in that ctf server can't imagine what I'm gonna unleash on their sorry asses tonight...
Top
Cooldown
Posts: 660
Joined: Mon Jun 05, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Cooldown »

Follow this guide, it's pretty comprehensive. Download and install the programs and as others have said run them in Safe Mode. Obviously it will take a bit of time to run to scan with everything, but that's really the best way to get rid of spyware since often times one scanner will pick up something that another will not. Also for scanning for viruses and trojans I would recommend getting Kaspersky Antivirus (there is a 30 day trial if you don't want to pay).

http://elitekiller.com/malware.htm

AFAIK Ad-Aware and Spybot have inferior detection rates compared to the programs listed in that guide. In fact I quit recommending them over a year ago because they give people a false sense of security.
Top
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by PhoeniX »

You need to delete (you may need to do it manually - after ending the task in the task manager):
C:\WINDOWS\system32\winavxx.exe

You also still need to remove these (as it'll keep causing problems if you don't):
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\printer.exe
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O20 - AppInit_DLLs: C:\WINDOWS\system32\hrum455.txt
O23 - Service: Windows Notification Service (Winnotify) - Unknown owner - C:\WINDOWS\System32\winntify.exe (file missing)

It's getting there though. Post up a log when you're done again and I'll re-check it.
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

I still don't have access to "Add or Remove Programs" :puke:
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Okay, I edited the HKEY_USERS\S-1-5-21-776561741-1647877149-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel!=W=0 key by myself and I can use Add or Remove Programs now...turning off Remote Control is ownage as well...
Top
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by PhoeniX »

Nice. Is it all working now or are you still having problems?
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

PhoeniX wrote:Nice. Is it all working now or are you still having problems?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:24 PM, on 8/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.quake3world.com/forum/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinAVX] C:\WINDOWS\System32\WinAvXX.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\hrum455.txt
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Windows Notification Service (Winnotify) - Unknown owner - C:\WINDOWS\System32\winntify.exe (file missing)

--
End of file - 15163 bytes
Last edited by Duhard on Fri Aug 31, 2007 2:39 pm, edited 2 times in total.
Top
Denz
Posts: 2587
Joined: Thu Aug 17, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Denz »

It's looking better. :)
You sure do have a lot of Logitech files in there when you're a known Microsoft fan boi. Could it be possible that you actually like Logitech now?
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Overall performance is a lot better and most of the garbage have been destroyed...my browser still seems bugged cause it's slower than usual...I'll try to figure this out :up:

I accidentally got rid of PnkBstrA.exe last night and got kicked by punkbuster over and over again...everybody knew it was just a matter of time before I would figure it out and unleash the ownage on their pseudo newbie wannabe egos...crushed.

All the Logitech stuff is for my webcam...I got a big fanclub, kids...I've been doing a lot of broadcasting for my Swimsuit 2K8 pictorial edition...girls can't get enough of me!!!

jellus?...
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:29:27 AM, on 8/21/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\bdaecsc.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.quake3world.com/forum/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\bdaecsc.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\hrum455.txt
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: Windows Notification Service (Winnotify) - Unknown owner - C:\WINDOWS\System32\winntify.exe (file missing)

--
End of file - 15557 bytes
Last edited by Duhard on Fri Aug 31, 2007 2:38 pm, edited 1 time in total.
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

The hrum455 file reappears each time I try to delete it...hmmm. The winntify.exe shit is listed as file missing probably cause I manually deleted it a few days ago...weird that it's still listed in every scan :ducky:
Top
User avatar
PhoeniX
Posts: 4067
Joined: Fri Aug 04, 2000 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by PhoeniX »

BTW, I used http://www.hijackthis.de/ to analyze your logs - you just have to look through the results and double check things.

Winnotify is still there because it's a service; you'll have to manually remove the service (although it can't run as the files not there, you may as well get rid of it). Try this. Go to start > run >
services delete Winnotify

if that doesn't work this may:
services delete Windows Notification Service


hrum455.txt seems to be from spyware too- if you open it what's in it? (it's only a text file).
Top
User avatar
raw
Posts: 2739
Joined: Tue Nov 16, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by raw »

This is the best adware remover I have ever used.

http://siri.geekstogo.com/SmitfraudFix.php
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

PhoeniX wrote:Try this. Go to start > run >
services delete Winnotify

hrum455.txt seems to be from spyware too- if you open it what's in it? (it's only a text file).
I deleted it manually like you said and it seems to be gone. hrum455.txt has a bunch of encrypted stuff in it and I still can't get rid of this shit...I'll post my final log later on today.

Thanks a lot to PhoeniX and everyone for the help...greatly appreciated :up:
Top
User avatar
raw
Posts: 2739
Joined: Tue Nov 16, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by raw »

raw wrote:This is the best adware remover I have ever used.

http://siri.geekstogo.com/SmitfraudFix.php
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Okay, performance is still better than it used to be but I'm still having problems with that hrum455.txt file which seems to be a Trojan, as confirmed but my Lavasoft Ad-Aware program...

WIN32.TROJAN.AGENT
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[58]=File : C:\System Volume Information\_restore{1B6B7025-8781-469B-AAFB-B175C5A796FB}\RP385\snapshot\MFEX-1.DAT
obj[59]=File : C:\WINDOWS\system32\hrum455.txt

I found the path in the registry and it's HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows

It's listed as an AppInit_DLLs
Type REG_SZ
Data C\WINDOWS\system32\hrum455.txt

Now, what do you guys think....should I just delete the binary value in the registry since none of the programs I've tried seems to get rid of it? Deleting it manually in sytem32 won't work either cause the file reappears!

Thanks homos.
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Huh-oh, seems like MFEX-1.DAT is part of the same problem here....here's the value in the registry...

\??\C:\WINDOWS\system32\hrum455.txt
!\??\C:\DOCUME~1\DUHARD~1.ARE\LOCALS~1\Temp\temp.fr2B77
\??\C:\System Volume Information\_restore{1B6B7025-8781-469B-AAFB-B175C5A796FB}\RP385\snapshot\MFEX-1.DAT
!\??\C:\DOCUME~1\DUHARD~1.ARE\LOCALS~1\Temp\temp.frAF9B
\??\C:\WINDOWS\system32\hrum455.txt
!\??\C:\DOCUME~1\DUHARD~1.ARE\LOCALS~1\Temp\temp.fr5DD4

...am I being hacked by the NASA?
Top
+JuggerNaut+
Posts: 22175
Joined: Sun Oct 14, 2001 7:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by +JuggerNaut+ »

try running a reg cleaner too, spanky
Top
Duhard
Posts: 6216
Joined: Sat Dec 11, 1999 8:00 am

Re: Any of you noobs can help me get rid of this shit?

Post by Duhard »

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:10:22 AM, on 8/31/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\devldr32.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.quake3world.com/forum/index.php
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\ICQLite\ICQLite\ICQLite.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe

--
End of file - 15385 bytes
Top
Locked

Return to “Technology & Troubleshooting”