What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] is there any problem with microsoft site

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:09 PM, on 2/15/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
F:\Documents and Settings\Administrator\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
F:\WINDOWS\system32\inetsrv\inetinfo.exe
F:\Program Files\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
F:\Program Files\McAfee\Common Framework\FrameworkService.exe
F:\WINDOWS\system32\lserver.exe
F:\Program Files\Citrix\ICA Client\ssonsvr.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Citrix\system32\cdmsvc.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\McAfee\Common Framework\UdaterUI.exe
F:\Program Files\Citrix\system32\icabar.exe
F:\Program Files\Java\jre1.5.0_15\bin\jusched.exe
F:\Program Files\Internet Download Manager\IDMan.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\McAfee\Common Framework\McTray.exe
F:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
F:\Program Files\Citrix\ICA Client\pnagent.exe
F:\Program Files\MagicDisc\MagicDisc.exe
F:\Program Files\Citrix\Streaming Client\RadeObj.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Internet Download Manager\IEMonitor.exe
F:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Program Files\SwitchSniffer\SwitchSniffer.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
F:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
F:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Documents and Settings\Administrator\My Documents\Downloads\Programs\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.internetdownloadmanager.com/welcome.html
F2 - REG:system.ini: UserInit=F:\WINDOWS\system32\userinit.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - F:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.5.0_15\bin\ssv.dll
O4 - HKLM\..\Run: [ShStatEXE] "F:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "F:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IcaBar] "F:\Program Files\Citrix\system32\icabar.exe" /adminonly
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.5.0_15\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [IDMan] F:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-702569211-437513622-1839375560-1007\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'ctx_cpsvcuser')
O4 - HKUS\S-1-5-21-702569211-437513622-1839375560-1008\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Ctx_StreamingSvc')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O4 - Startup: MagicDisc.lnk = F:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Program Neighborhood Agent.lnk = ?
O8 - Extra context menu item: Download all links with IDM - F:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - F:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - F:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - F:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_15\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_15\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O10 - Broken Internet access because of LSP provider 'f:\documents and settings\administrator\windows\system32\mswsock.dll' missing
O15 - ESC Trusted Zone: http://runonce.msn.com
O15 - ESC Trusted Zone: http://www.rer.com
O15 - ESC Trusted IP range: http://172.16.0.1
O15 - ESC Trusted IP range: http://114.30.72.19
O17 - HKLM\System\CCS\Services\Tcpip\..\{BD5BF054-B5C6-4395-A4E3-E250DB29A832}: NameServer = 172.16.0.1,4.2.2.1
O18 - Protocol: x-owacid - {0215258F-F0A8-49DE-BF1B-0FF02EDA8807} - F:\Program Files\Microsoft\Outlook Web Access SMIME Client\mimectl.dll
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - F:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Citrix Diagnostic Facility COM Server (CdfSvc) - Citrix Systems, Inc. - F:\Program Files\Common Files\Citrix\System32\CdfSvc.exe
O23 - Service: Citrix Client Network (CdmService) - Citrix Systems, Inc. - F:\Program Files\Citrix\system32\cdmsvc.exe
O23 - Service: Citrix Encryption Service - Citrix Systems, Inc. - F:\Program Files\Citrix\system32\encsvc.exe
O23 - Service: Citrix SMA Service - Citrix Systems Inc. - F:\Program Files\Citrix\Sma\SmaService.exe
O23 - Service: Citrix Virtual Memory Optimization - Citrix Systems, Inc. - F:\Program Files\Citrix\Server Resource Management\Memory Optimization Management\Program\CtxSFOSvc.exe
O23 - Service: Citrix Health Monitoring and Recovery (CitrixHealthMon) - Citrix Systems, Inc - F:\Program Files\Citrix\HealthMon\HCAService.exe
O23 - Service: CitrixLicensing - Macrovision Corporation - F:\Program Files\Citrix\Licensing\LS\lmgrd.exe
O23 - Service: Citrix WMI Service (CitrixWMIService) - Citrix Systems, Inc. - F:\Program Files\Citrix\system32\citrix\WMI\ctxwmisvc.exe
O23 - Service: Citrix XTE Server (CitrixXTEServer) - Citrix Systems, Inc. - F:\Program Files\Citrix\XTE\bin\XTE.exe
O23 - Service: Citrix Licensing WMI (Citrix_GTLicensingProv) - Unknown owner - F:\Program Files\Citrix\Licensing\LicWMI\Citrix_GTLicensingProv.exe
O23 - Service: Citrix Print Manager Service (cpsvc) - Citrix Systems, Inc. - F:\Program Files\Citrix\system32\CpSvc.exe
O23 - Service: Citrix ActiveSync Service (CtxActiveSync) - Citrix Systems, Inc. - F:\Program Files\Citrix\System32\CtxActiveSync.exe
O23 - Service: Citrix CPU Utilization Mgmt/Resource Mgmt (ctxcpuSched) - Aurema Pty Limited - F:\Program Files\Citrix\Server Resource Management\CPU Utilization Management\bin\ctxcpusched.exe
O23 - Service: Citrix License Management Console (CTXLMC) - Alexandria Software Consulting - F:\Program Files\Citrix\Licensing\LMC\Tomcat\bin\tomcat.exe
O23 - Service: Citrix Services Manager (IMAAdvanceSrv) - Citrix Systems, Inc. - F:\Program Files\Citrix\System32\Citrix\Ima\IMAAdvanceSrv.exe
O23 - Service: Citrix Independent Management Architecture (IMAService) - Citrix Systems, Inc. - F:\Program Files\Citrix\System32\Citrix\Ima\ImaSrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - F:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - F:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - F:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Citrix MFCOM Service (MFCom) - Citrix Systems, Inc. - F:\Program Files\Citrix\System32\mfcom.exe
O23 - Service: Citrix Streaming Service (RadeSvc) - Citrix Systems, Inc. - F:\Program Files\Citrix\Streaming Client\RadeSvc.exe
O23 - Service: Citrix Resource Manager Mail (ResourceManagerMail) - Citrix Systems, Inc. - F:\Program Files\Citrix\System32\Citrix\IMA\MailService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - F:\Program Files\WinPcap\rpcapd.exe

–
End of file - 9406 bytes
Post #2
Hi

My name is Extremeboy (or EB for short), and I will be helping you with your log.

If you do not make a reply in 5 days, we will need to close your topic.

Please take note of some guidelines for this fix:
  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Please reply using the [external image: Posted Image] button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
  • Old topics are closed after 3 days with no reply, and working topics are closed after 5 days. If for any reason you cannot complete instructions within that time, that's fine, just post back here so that we know you're still here.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE

– Note: The screen instructions indicate the attach.txt must be zipped before attaching (not posted) to your forum post. Instead, we want you to include attach.txt as an attachment to upload using the "Browse" button in the text editor when making your reply.

Run Kaspersky Online Scanner
Please do a scan with Kaspersky Online Scanner.

This scan is for Internet Explorer only.

If you are using Windows Vista, open your browser by right-clicking on its icon and select Run as administrator to perform this scan.
  • Open the Kaspersky Scanner page.
  • Click on Accept and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
You can refer to this animation by sundavis.

In your next reply please include the following:
  • DSS.txt
  • Attach.txt
  • Kaspersky's Log
  • What Problems do you still have?

Important Note: For other users who are reading this topic,the instructions provided in this topic are for the original topic starter ONLY. Even if you have similar problems or even log entries to those given here, please do not follow the directions, especially those involving specific tools and scripts. Doing so can result in serious damage to your computer. Instead, please start your own topic and feel free to link to any relevant topics as needed.Please Do NOT follow the instructions provided for this topic.

With Regards,
Extremeboy
Post #3
Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 days the topic will need to be closed.

Thanks for understanding. :)

With Regards,
Extremeboy

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI