Weird programs in my system

• kaobeikaobu

  11 Oct 06, 08:32

  reformat
• ditzy

  11 Oct 06, 08:34

  Originally posted by davidche:

  nvsc32,exe
  NPFMNTOR.EXE
  NAVAPSVC.EVE
  AluSchedulerSvc.exe
  svchost.exe
  spoolsv
  symlcsvc
  SPBBCSvc.exe
  CCEVTMGR.EVE
  CCSETMGR.EXE
  
  AND LOADS MORE.....

  Here is something I found last night. Check it out.
  
  http://www.what-process.com/list-processes.aspx?l=L
• ditzy

  11 Oct 06, 08:35

  Originally posted by davidche:

  THEY ARE JUST STUPID TROJANS WHO DONT O ANY HARM.

  heyheyhey, don't take my word for it.
• davidche

  11 Oct 06, 08:38

  Originally posted by StarPuppy:

  maybe u should try removing ur tmp files first?
  
  by deleting them via safe mode?

  nah!! lets see wad mayi does. Cos the files from tmp are already quarantined and after reboot, the strange processes in my task manager are still running!!
  
• StarPuppy

  11 Oct 06, 08:39

  Originally posted by ditzy:

  heyheyhey, don't take my word for it.

  advice sir?
  
  
• FBI

  11 Oct 06, 08:39

  Originally posted by davidche:

  nah!! lets see wad mayi does. Cos the files from tmp are already quarantined and after reboot, the strange processes in my task manager are still running!!
  

  u need something more powerful..
  
  cuase they are not easily remove de..
• davidche

  11 Oct 06, 08:43

  Originally posted by ditzy:

  Here is something I found last night. Check it out.
  
  http://www.what-process.com/list-processes.aspx?l=L

  looks like those proceses arent dangerous at all.
• ndmmxiaomayi

  11 Oct 06, 09:07

  Originally posted by davidche:

  posted the report liao. wad to do now? theres still damn alot of prgrams running in my processes under sytem. weird named ones.

  Follow this website to clear all your temp files.
  
  Another HijackThis log please.
• ndmmxiaomayi

  11 Oct 06, 09:09

  Originally posted by StarPuppy:

  WTH...how come u got so many trojans
  
  

  One only and a hijacker... where got a lot? Only that it created lots of files.
• davidche

  11 Oct 06, 09:15

  Logfile of HijackThis v1.99.1
  Scan saved at 9:15:27 AM, on 10/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINNT\System32\smss.exe
  C:\WINNT\system32\winlogon.exe
  C:\WINNT\system32\services.exe
  C:\WINNT\system32\lsass.exe
  C:\WINNT\system32\svchost.exe
  C:\WINNT\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINNT\system32\spoolsv.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\WINNT\System32\nvsvc32.exe
  C:\WINNT\System32\svchost.exe
  C:\WINNT\system32\WgaTray.exe
  C:\WINNT\Explorer.EXE
  C:\WINNT\system32\ctfmon.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\PROGRA~1\COMMON~1\SYMANT~1\SECURI~1\NSCSRVCE.EXE
  C:\WINNT\system32\svchost.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\WINNT\System32\spool\DRIVERS\W32X86\3\HPZSTC10.exe
  D:\OFFICE11\WINWORD.EXE
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\eMule\emule.exe
  E:\++++++DAVID++++++\hijackthis\HijackThis.exe
  
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [MSConfig] C:\WINNT\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7
  O4 - HKCU\..\RunServices: [PcSync] PCsync.exe
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Žg—p FlashGet ‰º�Ú - C:\Program Files\FlashGet\jc_link.htm
  O8 - Extra context menu item: ‘S•”Žg—p FlashGet ‰º�Ú - C:\Program Files\FlashGet\jc_all.htm
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: �}!�fo2a?N - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.rd.yahoo.com/home/messenger/bjk/clientbtn/?http://cn.messenger.yahoo.com/ (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O15 - Trusted Zone: http://*.lead.com.sg
  O15 - Trusted Zone: http://*.moreatonce.com
  O15 - Trusted Zone: http://schdnavdo.schooldna.com
  O15 - Trusted Zone: http://schdnaweb.schooldna.com
  O15 - Trusted Zone: http://schdnaweb1.schooldna.com
  O15 - Trusted Zone: http://schdnaweb2.schooldna.com
  O15 - Trusted Zone: http://www.schooldna.com
  O15 - Trusted Zone: http://*.schooldna.com
  O16 - DPF: i.Game CardGame - http://210.59.226.160/client/CardGamec/com/igame/CardGame.cab
  O16 - DPF: i.Game CChess - http://210.59.226.135/client/CChessc/com/igame/CChess.cab
  O16 - DPF: Yahoo! Chess - http://download.games.yahoo.com/games/clients/y/ct2_x.cab
  O16 - DPF: Yahoo! Chinese Checkers - http://download.games.yahoo.com/games/clients/y/cct0_x.cab
  O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clients/y/dot8_x.cab
  O16 - DPF: Yahoo! GoStop - http://download.games.yahoo.com/games/clients/y/gst1_x.cab
  O16 - DPF: Yahoo! MahJong - http://download.games.yahoo.com/games/clients/y/ot0_x.cab
  O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potf_x.cab
  O16 - DPF: Yahoo! Towers 2.0 - http://download.games.yahoo.com/games/clients/y/ywt0_x.cab
  O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall ?u?W�}??r) - http://housecall60.trendmicro.com/housecall/xscan60.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
  O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
  O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
  O16 - DPF: {488A4255-3236-44B3-8F27-FA1AECAA8844} (CEditCtrl Object) - https://img.alipay.com/download/aliedit.cab
  O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136900077500
  O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136900523140
  O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://download.shockwave.com/pub/otoy/OTOYAX.cab
  O16 - DPF: {8C4A2492-3FED-41F2-BBAB-34E802844F8D} (IESettings Class) - http://schdnaweb.schooldna.com/schooldna/login/dnaClientIE.CAB
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
  O16 - DPF: {A43C6FC7-09F6-4E04-B8E3-683F3BDFEF7C} (IMMail Class) - http://www.songtouch.com/activex/TPIMActiveX.cab
  O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
  O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
  O16 - DPF: {C3A57B60-C117-11D2-BD9B-00105A0A7E89} (SAXFile ActiveX Control) - http://www.lead.com.sg/LEAD/Common/saxfile.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: WgaLogon - C:\WINNT\SYSTEM32\WgaLogon.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  
  
• davidche

  11 Oct 06, 09:18

  Originally posted by ndmmxiaomayi:

  Follow this website to clear all your temp files.
  
  Another HijackThis log please.

  delelte current users temp / users temp / windows temp/ temp internet files /all of the above?
• ndmmxiaomayi

  11 Oct 06, 09:22

  Originally posted by davidche:

  delelte current users temp / users temp / windows temp/ all of the above?

  All, as per the website.
• ndmmxiaomayi

  11 Oct 06, 09:23

  Now clean liao....
  
  To remove all the infections, open AVG Anti-Spyware. Click on the Infections button. Select All and click Remove finally.
• davidche

  11 Oct 06, 09:24

  Originally posted by ndmmxiaomayi:

  All, as per the website.

  As in all of the files including java and bin and history and cookie?
• davidche

  11 Oct 06, 09:26

  Originally posted by ndmmxiaomayi:

  Now clean liao....
  
  To remove all the infections, open AVG Anti-Spyware. Click on the Infections button. Select All and click Remove finally.

  but i didnt scan the system in safe mode leh(only in normal mode) does it matter?
• ndmmxiaomayi

  11 Oct 06, 09:28

  Originally posted by davidche:

  As in all of the files including java and bin and history and cookie?

  Yup.
• ndmmxiaomayi

  11 Oct 06, 09:29

  Originally posted by davidche:

  but i didnt scan the system in safe mode leh(only in normal mode) does it matter?

  It doesn't matter.
• davidche

  11 Oct 06, 09:47

  
• ndmmxiaomayi

  11 Oct 06, 09:50

  Originally posted by davidche:

  

  Image too small to see...
• davidche

  11 Oct 06, 09:50

  
• ndmmxiaomayi

  11 Oct 06, 10:05

  Nothing is wrong... just that Symantec is using lots of resources... that's why it's slow.