are my com infected ?

• xrauss

  16 Apr 07, 03:59

  Logfile of HijackThis v1.99.1
  Scan saved at 3:54:32 AM, on 4/16/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  C:\WINDOWS\system32\CTsvcCDA.exe
  C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\WgaTray.exe
  C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Documents and Settings\bz-\My Documents\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.imesh.com/search/index.html?src=ssb
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.imesh.com/search/index.html?src=ssb
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.imesh.com/search/index.html?src=ssb
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.imesh.com/search/index.html?src=ssb
  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [BearFlix] "C:\Program Files\BearFlix\BearFlix.exe" /pause
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
  O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O15 - Trusted Zone: http://toolbar.imageshack.us
  O16 - DPF: {0FC64BDC-D14D-4F04-802D-4B9104DF16FB} (SystemCheck Class) - http://www.singnet.com.sg/technical/helptools/pc-check/media/ALTControl.cab
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
  O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
  O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1139071743843
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
  O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
  O16 - DPF: {E55FD215-A32E-43FE-A777-A7E8F165F551} (Flatcast Viewer 4.15) - http://www.flatcast.com/de/download/NpFv415.dll
  O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4876/mcfscan.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{547552C8-942C-4863-89AE-0171B93EB82E}: NameServer = 165.21.100.88 165.21.83.88
  O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware Pro\aawservice.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
  O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
  O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
  O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  
  because it say my internet privacy is being compromised
  
  and given me this http://85.255.113.66/privacyWarning.php
  when i use IE
  so how to solve ?
• ndmmxiaomayi

  16 Apr 07, 08:13

  Did you install from the link provided?
  
  If no, then you are safe.
• xrauss

  16 Apr 07, 14:46

  if install and deleted ?
• alexkusu

  16 Apr 07, 14:48

  its just a scam for you to click the link
• ndmmxiaomayi

  16 Apr 07, 15:09

  Originally posted by xrauss:

  if install and deleted ?

  Your log does look clean...
  
  If installed and deleted and have no problems, then it's OK.
• xrauss

  16 Apr 07, 15:16

  i think i install the link which lead mi to download the client .. but the client download remain at 0% so i delete the link ..
  anyway thanks for advices
• xrauss

  16 Apr 07, 18:21

  hmm i scan with avg .. it show user32.dll and ntoskrnl.exe infected files during the test .. and found no threat at the end of scan .. so shld i delete those 2 ?
• ltachi

  16 Apr 07, 18:25

  im having problems with system 32 too.
  
  16bit md-dos subsystem
  
  c:\windows\system32\command.com
  c:\windows\system32\autoexec.nt. the system file is not suitable for running ms-dos and mircosoft windows applications
  choose 'close' to terminate the application
  
  close ignore
  
  it keeps popping up.when im playing dota.the thing pop up.i have to alt tab to close it.when i return to dota i die.lol.whats happening?and when the thing pop up.my cpu makes a noise..like 'something jammed' sound
• turbo_drift

  16 Apr 07, 18:27

  Originally posted by ltachi:

  im having problems with system 32 too.
  
  16bit md-dos subsystem
  
  c:\windows\system32\command.com
  c:\windows\system32\autoexec.nt. the system file is not suitable for running ms-dos and mircosoft windows applications
  choose 'close' to terminate the application
  
  close ignore
  
  it keeps popping up.when im playing dota.the thing pop up.i have to alt tab to close it.when i return to dota i die.lol.whats happening?and when the thing pop up.my cpu makes a noise..like 'something jammed' sound

  is it this one??
  
  
• xrauss

  16 Apr 07, 18:35

  mine only appear in avg scanning it displayed as infected files and the result show changed .. i haf no ideas what happend
• turbo_drift

  16 Apr 07, 18:38

  Originally posted by xrauss:

  mine only appear in avg scanning it displayed as infected files and the result show changed .. i haf no ideas what happend

  Maybe u could try this??
  
  http://www.microsoft.com/downloads/details.aspx?familyid=74AD4188-3131-429C-8FCB-F7B3B0FD3D86&displaylang=en
  
  If cannot, come back again..
• xrauss

  16 Apr 07, 19:10

  
• turbo_drift

  16 Apr 07, 19:11

  xrauss, i think u have to wait for mayi liaox..
• xrauss

  16 Apr 07, 19:12

  btw how to make my image viewable and dun need to click for it ?
• turbo_drift

  16 Apr 07, 19:13

  Originally posted by xrauss:

  btw how to make my image viewable and dun need to click for it ?

  Use [ img ] paste url here [/ img ]
  
  Remove all the spaces in between the [ ] ...
• xrauss

  16 Apr 07, 19:18

  my screenshot so small how to make it bigger ? thanks alot
• turbo_drift

  16 Apr 07, 19:24

  Originally posted by xrauss:

  my screenshot so small how to make it bigger ? thanks alot

  Upload again and use the last one...
  
  
• xrauss

  16 Apr 07, 19:27

  ok thanks alot
• ndmmxiaomayi

  16 Apr 07, 23:27

  Originally posted by xrauss:

  hmm i scan with avg .. it show user32.dll and ntoskrnl.exe infected files during the test .. and found no threat at the end of scan .. so shld i delete those 2 ?

  No problems...
  
  It's just AVG acting up... MS has updated their copies of files resulting in the bad detection.
• xrauss

  16 Apr 07, 23:30

  oh i see .. ok thanks alot