Read-only historical archive Reconstructed community archive · captured 17 November 2010

Forum index / Computers / Virus

Virus

16 posts · page 1 of 1

WEAK
post #1
21 January 2006, 00:34 UTC#1
My Norton Anti Virus has been compromised. My 'auto-protect' is disabled and it wont let me turn it back on. I ran 'hijack this', below is my logfile. Can you tell me if you see anything odd?

QUOTE
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\CTF\ctfmon.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX03.594\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = [IP address redacted]
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5_1_6_0.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [YBrowser] C:\Program Files\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [IPInSightLAN 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 02] "C:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - http://files.member.yahoo.com/dl/installs/sbc/yinst.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Wilbur
post #2
21 January 2006, 00:38 UTC#2
A lot of things don't look right. Restart your computer in safemode (F8 at startup) and run norton then.
Doyle
post #3
21 January 2006, 00:38 UTC#3
WEAk... Dont use Norton. I know I sound like I just have a grudge with norton but really... it sucks and will not work right. get this www.nod32.com asap.

It looks like a trojan which could have someone on your comp now.

ill look to see if I can spot it in the list
WEAK
post #4
21 January 2006, 00:44 UTC#4
Doyle, I agree that Norton isnt that great. It has problems removing spyware and is easily compromised, but usually it gets the job done. I'll look into your suggestion though. Thanks.

btw, I've restarted my comp, and now Norton is okay. However, ifI turn 'auto protect' off and try to turn it back on, it wont work..

btw, the keylogger you see in that log isnt apart of the problem, thats something I installed myself. Just lettin ya know.
Doyle
post #5
21 January 2006, 00:51 UTC#5
Dude... try nod though. And then get spybot... also makesure you ahve a firewall... www.zonelabs.com

If you need a key or anything for any just ask ill sort it for ya on AIM.... but you say that NORTON gets the job done? How would you not know if its not? I keylogger or trojan dont popup telling you... most just sit there logging shit and send it... you would never know.
WEAK
post #6
21 January 2006, 01:12 UTC#6
Whens the last time you used Norton? Everytime a worm, virus, or trojan tries to infiltrate my computer I get a norton pop up telling me it was blocked.
Belly
post #7
21 January 2006, 01:13 UTC#7
yeah my norton is a piece of shit, it doesnt pick up half the stuff that AVG does.

Sorry thats not much help too ya, just backing up what Doyle said that norton sucks.


How do you know its telling you about EVERY worm thats got in?

Its telling you about some, but the ones it doesnt pop up for, then your none the wiser.
Doyle
post #8
21 January 2006, 01:21 UTC#8
QUOTE(WEAK @ Jan 21 2006, 02:12 AM) [snapback]269358[/snapback]

Whens the last time you used Norton? Everytime a worm, virus, or trojan tries to infiltrate my computer I get a norton pop up telling me it was blocked.

I have only ever used Norton once... and that was back in 1999 when I tested it on some tools I made.

But I have had people use it who I know. My old Boss used it and I installed KAV on his PC and it found over 500 worms and trojans on his computer... one worm got in and uploaded everything from that coder to his computer.

If you ahve memory to spare get KAV though... only reason I use NOD32 is it is great on memory

the problem with Norton is they will NOT change there sig system... Every program has a SIG like MD5 or something... well Norton got a system taht back in the 90s cost them alot! and they will not change it... even though it is very outdated.

To get past Norton all you need to do is get a Trojan... Pack it witha new packer and norton will not pick it up. And every kid who uses a trojan knows this... which is why people who hack love norton :D

KAV: http://www.kaspersky.com/
mako
post #9
21 January 2006, 01:43 UTC#9
My norton works pretty good. Like Weak says, when a trojan or something tries to enter , a pop-up appears saying that it was blocked...

The only shit that its installed in my pc its the something called "Bargain.Buddy" adware.. o.o
Doyle
post #10
21 January 2006, 01:47 UTC#10
QUOTE(mako @ Jan 21 2006, 02:43 AM) [snapback]269371[/snapback]

My norton works pretty good. Like Weak says, when a trojan or something tries to enter , a pop-up appears saying that it was blocked...

The only shit that its installed in my pc its the something called "Bargain.Buddy" adware.. o.o

But like I said.... How od you know when oe gets past? Norton has far less defs then most others do... even AVG and thats free....
Belly
post #11
21 January 2006, 01:50 UTC#11
yeah my avg will update new virus deinatitions usually at least every other day, notron sometimes wont have any updates for weeks.
Doyle
post #12
21 January 2006, 01:52 UTC#12
Not just that... most virus companys have more then ONE sig per virus just incase its packed. Norton uses one.
Hookedonlemons0410
post #13
21 January 2006, 01:54 UTC#13
She-it I had more then that!
Just get AVG free edition. Wilbur said it in one of the earlier virus threads
Wilbur
post #14
21 January 2006, 02:38 UTC#14
QUOTE(Hookedonlemons0410 @ Jan 21 2006, 01:54 AM) [snapback]269382[/snapback]

Wilbur said it in one of the earlier virus threads

:D

I have had a lot of viruses, they're annoying as fuck. Just don't download sketchy files or go to strange sites.
Hookedonlemons0410
post #15
21 January 2006, 03:37 UTC#15
QUOTE(Wilbur @ Jan 21 2006, 02:38 AM) [snapback]269388[/snapback]

QUOTE(Hookedonlemons0410 @ Jan 21 2006, 01:54 AM) [snapback]269382[/snapback]

Wilbur said it in one of the earlier virus threads

:D

I have had a lot of viruses, they're annoying as fuck. Just don't download sketchy files or go to strange sites.

Well thank you for letting me know so far ahead wilbur!
[/sarcasm]
d889
post #16
22 January 2006, 02:15 UTC#16
there's a lot of bad shit in that list, get rid of norton ... all of it and use norton corporate instead http://d889.com/files/norton/norton_av9_csun.exe

www.kaspersky.com run that online scanner and it will find all of the bad shit, print the list and remove the files in safe mode. then hope that windows doesnt take a dump.