Austech



iTrader Today's Posts Donate My Posts Classifieds Site Rules FAQ's
Go Back   Austech > Technology > Security and Privacy
Register Members List Upgrade Account Search Today's Posts Mark Forums Read

Security and Privacy Spyware , Proxies , all security and privacy issues and software.

Reply
 
LinkBack (2) Thread Tools Search this Thread Display Modes
Old 24-05-08, 07:59 PM   2 links from elsewhere to this Post. Click to view. #1 (permalink)
Premium Member
 
Biggun's Avatar
 

iTrader: (5)
Join Date: Jan 2008
Location: Blue Mountains
Posts: 351
Spent time on board: 1 Week, 3 Days and 3:51:05
Biggun is on a distinguished road
Default Virus On Kids Computer?

My kids computer seems to have something horribly wrong!!!!!! Its running AVG Free AV, Spybot, Adaware. But still millions of popups and all sorts of crazy behavior. I have run all of the above programs to no avail. Getting desperate. Dont want to re format if poss. Any help appreciated.
Cheers
Biggun is online now   Reply With Quote
Old 24-05-08, 08:45 PM   #2 (permalink)
I'am Not a Bloody Joke
 
best4less's Avatar
 

iTrader: (10)
Join Date: Jan 2008
Location: Australia
Posts: 2,948
Spent time on board: 2 Months, 2 Weeks, 3 Days and 10:41:00
best4less is on a distinguished road
Default

check in here you'll find your answers i am sure

System error! virus pop up
__________________
Please wipe your feet before walking all over me
best4less is online now   Reply With Quote
Old 24-05-08, 09:34 PM   #3 (permalink)
Quadmeister
 
PhillTheQuad's Avatar
 

iTrader: (7)
Join Date: Jan 2008
Location: nelson bay
Posts: 618
Spent time on board: 2 Weeks, 4 Days and 10:46:49
PhillTheQuad is on a distinguished road
Default

i suggested these 2 < below

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:46:00 PM, on 24/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\system32\service.exe
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\[user]\Local Settings\Temporary Internet Files\Content.IE5\SFK3A9I2\HiJackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by OptusNet
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SurfingEnhancer - {57636FBF-8C24-0D22-E203-3D4DFA59E2A4} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BeSideit IE Helper - {83C35173-E029-42f1-9692-0341EE379A0D} - C:\Program Files\QdrDrive\QdrDrive16.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\s wg.dll
O2 - BHO: (no name) - {E542F48C-E00D-4DA8-B1B0-C3A2EA525BCE} - C:\Program Files\NetMeeting\hysicyja66225.dll
O2 - BHO: SmartEnhancer - {F608C2D0-846D-4F0E-E47A-88367C887707} - C:\Program Files\SmartEnhancer\SmartEnhancer-1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7 < this
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [MDNS] C:\WINDOWS\system32\service.exe < this
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
O4 - HKCU\..\Run: [VnrPack16] "C:\Program Files\VnrPack\VnrPack16.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites - Add to Windows Live Favorites
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://dsl.optusnet.com.au/
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6...ws-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys

--
End of file - 6659 bytes

Last edited by ssrattus : 25-05-08 at 03:40 PM. Reason: removed user name
PhillTheQuad is offline   Reply With Quote
Sponsored Links
Old 25-05-08, 12:50 PM   #4 (permalink)
Huge Member
 

iTrader: (0)
Join Date: Jan 2008
Location: Super Duper Secret Members Forum
Posts: 298
Spent time on board: 1 Day and 23:00:39
biggeorge is on a distinguished road
Default

Start by getting rid of any and all yahoo and google toolbars.

Actually, just trash all the shit thats not necessary.

Do you have Kazza or anything similar??? For getting mp3 files, sharing, etc.

Looks like you might need to retrain your kids to "just say no" to some things, like "should I automatically install google toolbar?" etc..

Biggun, PM me and let me know what programs you have running. You never need to reformat it.
biggeorge is offline   Reply With Quote
Old 25-05-08, 01:43 PM   #5 (permalink)
Super Moderator
 
ssrattus's Avatar
 

iTrader: (0)
Join Date: Jan 2008
Posts: 1,368
Spent time on board: 1 Month, 0 Weeks, 4 Days and 6:29:00
ssrattus will become famous soon enough
Default

Follow the steps in the link here Malware Removal and Prevention will get you on your way to cleaning up your PC.
ssrattus is online now   Reply With Quote
Old 25-05-08, 03:12 PM   #6 (permalink)
Senior Member
 

iTrader: (0)
Join Date: Jan 2008
Posts: 114
Spent time on board: 4 Days and 3:56:50
Colin 2905 is on a distinguished road
Default

Quote:
Originally Posted by Biggun View Post
Its running AVG Free AV, Spybot, Adaware.

I had been using AVG Free 7.5 on my machines at home until recently, but with its impending demise since the release of 8, I thought I'd read up on 8 before trying it. What I read about AVG 8 (bloated, resource hog, clashes with Spybot, etc) was enough for me to not even try it, but move to Avast 4.8 Home (free) instead.
Colin 2905 is offline   Reply With Quote
Sponsored Links
Old 25-05-08, 06:34 PM   #7 (permalink)
Premium Member
 
Biggun's Avatar
 

iTrader: (5)
Join Date: Jan 2008
Location: Blue Mountains
Posts: 351
Spent time on board: 1 Week, 3 Days and 3:51:05
Biggun is on a distinguished road
Default

Thanks All, Seem to have fixed it. Thanx Best4L, SDFix was what fixed it. I Usually use Avira AV, but have just been lazy.
@ Biggeorge, Yeah its got Google toolbar and they use limewire lol, got to get off my ass and do some preventative maintenance, instead of all this salvage work. Will keep advised of the outcome.

Cheers
Biggun is online now   Reply With Quote
Old 25-05-08, 08:55 PM   #8 (permalink)
Senior Member
 
Studio1's Avatar
 

iTrader: (0)
Join Date: Jan 2008
Location: Inside the toaster
Posts: 540
Spent time on board: 4 Days and 3:48:54
Studio1 is on a distinguished road
Default

Limewire is SPYWARE CITY.

Kazaa and most other file sharing programs fall in the same category.

[Emule is the only one I have found so far that seems fairly benign]

Biggest problem I find with kids is they have no idea what they are clicking on - and click things indiscriminately before they even realise what they've done.

You need some really robust AV software, a good firewall, some tough anti-spyware apps and try to lock their PC down so that malicious programs can't self-install - always run their account as a user-privilege rather than an administrator account.
Studio1 is offline   Reply With Quote
Reply


LinkBacks (?)
LinkBack to this Thread: http://www.austech.info/security-privacy/6545-virus-kids-computer.html
Posted By For Type Date
Security and Privacy [Archive] - Austech This thread Refback 11-07-08 10:45 PM
Austech - Powered by vBulletin This thread Refback 25-05-08 05:47 PM

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


server monitor
All times are GMT +10. The time now is 05:16 PM.


Powered by vBulletin Version 3.6.0
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.

Ad Management by RedTyger