Jump to content

hijackthis log


Recommended Posts

Hello ,

And :) My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the runscanbutton.png button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
    gmer_zip.gif
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Link to post
Share on other sites

my ex has been hacking me now for 8 months, he claims he isnt anymore.can someone tell me if i am safe from him by reading this log? ty, D

ok the problem is I know he is still hacking me from colorado because he laughed about it yesterday on phone! here are the logs u requested. TY,DOTL Extras logfile created on: 5/29/2010 1:17:59 PM - Run 1

OTL by OldTimer - Version 3.2.5.1 Folder = C:\Users\Owner\Desktop

Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18904)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.00 Gb Total Physical Memory | 0.00 Gb Available Physical Memory | 21.00% Memory free

3.00 Gb Paging File | 1.00 Gb Available in Paging File | 44.00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 149.05 Gb Total Space | 100.01 Gb Free Space | 67.10% Space Free | Partition Type: NTFS

Drive D: | 702.31 Mb Total Space | 696.67 Mb Free Space | 99.20% Space Free | Partition Type: UDF

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: OWNER-PC

Current User Name: Owner

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0E65BDC6-6C36-409F-815F-08DC8EEB572D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |

"{105AFF53-B8A0-4BC9-A662-4B6827EC9E4D}" = rport=137 | protocol=17 | dir=out | app=system |

"{20FB029A-87E1-4842-A3C3-AF7F14501F83}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |

"{434D6C03-B8DD-4065-8F9A-ECB173EC945B}" = lport=445 | protocol=6 | dir=in | app=system |

"{657168D6-EC49-4938-B29A-31AFF56D96BA}" = rport=138 | protocol=17 | dir=out | app=system |

"{69C543F4-1934-4C3A-8A6F-6ACAEABD5069}" = rport=139 | protocol=6 | dir=out | app=system |

"{8246A749-E341-49DD-AAEE-4B649533D28C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |

"{92FBF260-EAF1-4B66-B596-03EB61D0CDDA}" = lport=138 | protocol=17 | dir=in | app=system |

"{B40AFD38-DB4F-418A-B38E-00D13580838A}" = rport=445 | protocol=6 | dir=out | app=system |

"{B672819E-B1D2-4CEC-9DA2-595122ED153D}" = lport=2869 | protocol=6 | dir=in | app=system |

"{BB832FAC-46F0-417A-9E54-E672E10F9B59}" = lport=139 | protocol=6 | dir=in | app=system |

"{C8168FF2-79C2-4CAF-B598-43DBA6CF3E9F}" = lport=445 | protocol=6 | dir=in | app=system |

"{CBB7D0C7-D51C-4171-A9B1-910976C0D184}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |

"{FF5C798D-C401-433D-BF4A-A65F55258F19}" = lport=137 | protocol=17 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0110CB67-A537-446D-9A2A-5A5F65F97FF8}" = protocol=6 | dir=out | app=c:\windows\system32\wudfhost.exe |

"{05A19DDB-0E8F-40CF-B305-0BC9890D0432}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{15519723-4246-49E9-BDF3-2E5677514D84}" = protocol=6 | dir=out | svc=upnphost | app=c:\windows\system32\svchost.exe |

"{18A4D4CA-152C-4608-A1E7-953BBC951571}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |

"{1FB8DC14-E788-4788-A937-79EB3434E964}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"{51A5A87C-FB5F-4D4B-BC6C-C763C7561327}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |

"{52D0EB18-6D2A-48E2-B46F-2C61D96A1B51}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |

"{57B6C2A8-969E-4666-A620-CCA0E17030DB}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |

"{77BEB5FD-CED3-4A5E-B78B-CDCECA48C12E}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |

"{9C93FE01-AB2C-4B84-8938-AC55FCCF6C0E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |

"{A4EEA86A-6F94-45DE-B581-A3395CFF3229}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |

"{ADE6B716-D341-4CC4-A492-64C48762FF5C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |

"{AF1B0365-2F41-4CEE-B727-495116360ACF}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |

"{B98C19C5-07C0-4C22-B978-70135B423BAF}" = protocol=6 | dir=out | app=system |

"{CCC8D8A6-821F-499A-AC89-B8D2F33C9034}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

"{DEDA875B-BF78-4BF0-AAB5-552DF5588639}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

"{DF4B690B-62EF-474E-A0E8-B46CEE8E1170}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |

"{E2477276-E8A0-47E3-8A5F-1BF5DF3CFC49}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{E8AEDF39-237D-4F49-AEE7-C79D399BAC88}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |

"{F5494356-E072-45ED-B8D9-9B87B0F435D9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |

"TCP Query User{ACC7DE2A-E00C-4A2A-9815-597DCD15EB81}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |

"TCP Query User{CE2B84BE-E0A6-49B6-87AE-6B756ABE5D79}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

"TCP Query User{F5172A4C-C648-4F11-8A3E-B7650A089227}C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=6 | dir=in | app=c:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{0452B350-9F47-445E-99F5-DC0939145988}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |

"UDP Query User{09C1F7C9-69F1-4E3F-8029-0CCF3668B408}C:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe" = protocol=17 | dir=in | app=c:\users\owner\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe |

"UDP Query User{2D830B9A-82CC-445A-B07B-1E0C21510797}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

"{011A2240-08DF-45BB-AA4E-1A78637CCF80}" = RPS CRT

"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan

"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime

"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan

"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{258749E2-3A46-42B1-9A01-BF977AA06FAC}" = RPS CRT

"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java 6 Update 20

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java 6 Update 7

"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support

"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com

"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax

"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003

"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch

"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter

"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution

"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8

"{AF36CE1D-FD2C-4BA0-93FA-1196785DD610}" = Adobe Flash Player 10 Plugin

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm

"{C716522C-3731-4667-8579-40B098294500}" = Toolbox

"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport

"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software

"{E3D4F451-5F04-4082-BE21-1C0C1ADF5014}" = Vz In Home Agent

"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential

"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply

"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer

"{F8FD83C8-7ECA-4362-A4C9-E0F19849574B}" = Stationery and Brochure Maker

"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Browser Defender_is1" = Browser Defender 2.0.6.15

"CNXT_MODEM_PCI_HSF" = Soft Data Fax Modem with SmartCP

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"HDMI" = Intel® Graphics Media Accelerator Driver

"HijackThis" = HijackThis 2.0.2

"HP Imaging Device Functions" = HP Imaging Device Functions 8.0

"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0

"HPExtendedCapabilities" = HP Customer Participation Program 8.0

"HPOCR" = HP OCR Software 8.0

"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio

"LimeWire" = LimeWire 5.5.8

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"RadialpointClientGateway_is1" = Verizon Servicepoint 1.5.24

"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software

"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set

"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software

"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software

"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software

"Spyware Doctor" = Spyware Doctor 7.0

"UndeletePlus_is1" = Undelete Plus 2.98

"Verizon Help and Support" = Verizon Help and Support Tool

"Verizon High Speed Internet_is1" = Verizon High Speed Internet

"verizon_broad" = Verizon Broadband Toolbar (IE only)

"Yahoo! Companion" = Yahoo! Toolbar

"Yahoo! Mail" = Yahoo! Internet Mail

"Yahoo! Mail Advisor" = Yahoo! Mail Advisor

"Yahoo! Search Defender" = Yahoo! Search Protection

"Yahoo! Software Update" = Yahoo! Software Update

"YInstHelper" = Yahoo! Install Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 5/29/2010 2:01:00 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 1024

Description =

Error - 5/29/2010 2:01:58 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:01:58 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:01:58 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 1024

Description =

Error - 5/29/2010 2:02:53 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:02:53 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:02:53 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 1024

Description =

Error - 5/29/2010 2:03:47 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:03:47 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 11606

Description =

Error - 5/29/2010 2:03:47 PM | Computer Name = Owner-PC | Source = MsiInstaller | ID = 1024

Description =

[ System Events ]

Error - 5/29/2010 1:49:40 PM | Computer Name = Owner-PC | Source = Service Control Manager | ID = 7026

Description =

Error - 5/29/2010 1:58:22 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 1:58:23 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 1:58:23 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 1:58:55 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 2:00:09 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 2:01:05 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 2:02:03 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 2:02:58 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

Error - 5/29/2010 2:06:04 PM | Computer Name = Owner-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20

Description =

< End of report >

Extras.Txt

Link to post
Share on other sites

Hi, can you also post OTL.txt and the GMER log?

Hacking a computer is not as simple as it sounds sometimes. Do you have any symptoms that might indicate malware at work?

Yes, i will send tomorrow as i am using my iphone to email u now! The thing is he is one of best hackers out there, i assure u! He is in colorado, i am in texas! I have changed passwords etc, doesnt help! He calls me and tells me what my emails say!!!! Sometimes when looking at desktop , command prompt appears! I no longer can use laptop at all its fried, after him stating he would send me virus to my home network! One day when here visiting, he was supposed to be fixing minor issues laptop, i left and when returned hm he was in room w modem/desktop, and he had my laptop, his laptop, his iphone all out! I asked why he said so he could get faster service! Yikes,! Didnt know what he was doing! Ty, d

Link to post
Share on other sites

I will wait for the logs. Please take your time :D

I no longer can use laptop at all its fried, after him stating he would send me virus to my home network!
Can you please give me a detailed description about what problems there are exactly? also, if you have a network, make sure you isolate all computers on that network to avoid reinfection.

Make sure you change all your email passwords (use strong passwords), its surprisingly easy to hack an email account for those with bad intentions.

Link to post
Share on other sites

Hi, can you also post OTL.txt and the GMER log?

Hacking a computer is not as simple as it sounds sometimes. Do you have any symptoms that might indicate malware at work?

elise, i cant find gmer log, i will redo and send to you. issues again that i can say for sure is the command prompt popping up,and changing passwords only work from computers out of my apt. ty,d

OTL.Txtresult.txt

Link to post
Share on other sites

Hi again,

Unfortunately Hijackthis is not going to be of much help here. It shows some entries OTL shows and thats about it. Please rerun GMER as instructed, uncheck the Devices option and run the scan.

If it really doesn't want to work, try to run GMER with only the Sections option checked.

Link to post
Share on other sites

Hello ,

And :) My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.Hi elise, i have tried all day to get gmer log, it keeps freezing even in safe mode! I give up , ty for ur time. D

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the runscanbutton.png button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
    gmer_zip.gif
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Link to post
Share on other sites

Hello again,

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

  • 3 weeks later...
  • Root Admin

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.