Honda-Acura.net

Notices
The Basement Non-Honda/Acura discussion. Content should be tasteful and "primetime" safe.

Backdoor.Greybird

Thread Tools
 
Old Feb 13, 2008 | 09:43 AM
Share
  #11  
DarkStarr's Avatar
DarkStarr
Thread Starter
Shake n Bake!
 
Joined: Feb 2006
Posts: 11,794
Likes: 1
From: Pittsburgh, PA
Default
Code:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:39:15 PM, on 2/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe
C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\lxdicoms.exe
C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Intel\Intell.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [lxdimon.exe] "C:\Program Files\Lexmark 3500-4500 Series\lxdimon.exe"
O4 - HKLM\..\Run: [lxdiamon] "C:\Program Files\Lexmark 3500-4500 Series\lxdiamon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxdiCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdiserv.exe
O23 - Service: lxdi_device -   - C:\WINDOWS\system32\lxdicoms.exe
O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 6851 bytes
Drew, not sure what you're doin here but if it doesn't work I'm gonna follow a procedure from a different website, but hopefully you have an easier idea

About to dl vundofix
Reply
0
Old Feb 13, 2008 | 09:48 AM
Share
  #12  
e3NiNe's Avatar
e3NiNe
#CustomUserTitle
 
Joined: Mar 2002
Posts: 63,855
Likes: 1
From: glass case of emotion
Default
I've had so many viruses on my work PC that I'm kinda good at getting rid of them. :chuckles:

Follow the website, if it works ... yay ... if not, then come on back.


Vundo is the nastiest virus I've ever had. It would generate random .DLL names to fire off the malicious code. Because the .DLL names are random, you could add files to the scan list.

VundoFix.exe will delete the suspect .DLL if it's even running. It's a great tool for virus removal in general. I'm just making sure that the Intel.DLL was created today and wasn't an existing .DLL modified.
Reply
0
Old Feb 13, 2008 | 09:50 AM
Share
  #13  
DarkStarr's Avatar
DarkStarr
Thread Starter
Shake n Bake!
 
Joined: Feb 2006
Posts: 11,794
Likes: 1
From: Pittsburgh, PA
Default
Cool thanks, I'll update ya when it's all said and done.
Reply
0
Old Feb 13, 2008 | 09:53 AM
Share
  #14  
e3NiNe's Avatar
e3NiNe
#CustomUserTitle
 
Joined: Mar 2002
Posts: 63,855
Likes: 1
From: glass case of emotion
Default
the following is a trash entry. You can delete this ...

Code:
R3 - Default URLSearchHook is missing
Reply
0
Old Feb 13, 2008 | 10:01 AM
Share
  #15  
flyromeo3's Avatar
flyromeo3
 
Joined: Jan 2004
Posts: 6,692
Likes: 0
From: Bethlehem PA
Default
lexmark printers :ghey:
Reply
0
Old Feb 13, 2008 | 10:16 AM
Share
  #16  
Misa's Avatar
Misa
Pic Whore
 
Joined: Jul 2004
Posts: 22,224
Likes: 1
From: NJ
Default
delete through safe mode.
Reply
0
Old Feb 13, 2008 | 10:17 AM
Share
  #17  
Misa's Avatar
Misa
Pic Whore
 
Joined: Jul 2004
Posts: 22,224
Likes: 1
From: NJ
Default
http://ccollomb.free.fr/unlocker/

its a program that lets you delete files in use.
Reply
0
Old Feb 13, 2008 | 10:55 AM
Share
  #18  
M@rshy's Avatar
M@rshy
٩(̾●̮̮̃̾•̃̾)۶
 
Joined: Aug 2004
Posts: 21,807
Likes: 0
Default
Originally Posted by Jani 5
http://ccollomb.free.fr/unlocker/

its a program that lets you delete files in use.
One of my favorite programs I used for Windows. It helped so much when XP was being a bitch and not releasing my thumb drives.
Reply
0
Old Feb 13, 2008 | 10:58 AM
Share
  #19  
reno96teg's Avatar
reno96teg
Moderator
 
Joined: Dec 2000
Posts: 21,573
Likes: 0
Default
Originally Posted by MarshyTheKid
It helped so much when XP was being a bitch and not releasing my thumb drives.
meanwhile, the majority of us have never had such a problem.
Reply
0
Old Feb 13, 2008 | 11:15 AM
Share
  #20  
Grifter's Avatar
Grifter
Senior Member
 
Joined: Dec 2000
Posts: 44,835
Likes: 0
From: the southwest
Default
Originally Posted by MarshyTheKid
One of my favorite programs I used for Windows. It helped so much when XP was being a bitch and not releasing my thumb drives.
did you try physically removing the drive?
Reply
0



Advanced Search
Reply Closed Thread Share
Forum Jump

All times are GMT -8. The time now is 06:28 PM.