lethal
u installed this Desktop Alert ?
i'm not familiar with it
but it seems to be ok
Run HIJACKTHIS, press SCAN and put a CHECK to the following lines.
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wcciwr.exe
Then CLOSE all other windows including this and press FIX CHECKED
After that you need to REBOOT into safe mode. It Is important that you do so or the fix may not work. Instructions to boot into safe mode here
These may be hidden files. See here for how to show hidden files.
Find and delete the following file
DO NOT WORRY if you do not find them
C:\WINNT\system32\wcciwr.exe
REboot afterwards
well … the 01 lines are finally gone now
but i would like to have findit log to confirm it
try running it again
post a final log (both hijackthis and find it if possible) for a all clean check
i'm not familiar with it
but it seems to be ok
Run HIJACKTHIS, press SCAN and put a CHECK to the following lines.
O4 - HKLM\..\Run: [Narrator] C:\WINNT\system32\wcciwr.exe
Then CLOSE all other windows including this and press FIX CHECKED
After that you need to REBOOT into safe mode. It Is important that you do so or the fix may not work. Instructions to boot into safe mode here
These may be hidden files. See here for how to show hidden files.
Find and delete the following file
DO NOT WORRY if you do not find them
C:\WINNT\system32\wcciwr.exe
REboot afterwards
well … the 01 lines are finally gone now
but i would like to have findit log to confirm it
try running it again
post a final log (both hijackthis and find it if possible) for a all clean check
i'll ask for advice on this one and post back
in the meantime take a look at the recommended programs
will post back tomorrow
im afraid you are waiting for another post
will try to get back to you tomorrow
"Silent Runners.vbs", revision 29, launched at: 09:19
Output limited to non-default values, except where indicated by "{++}"
Operating System: Windows 2000
Startup items buried in registry:
———————————
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"RemoteCenter" = "C:\Program Files\Creative\SBAudigy\RemoteCenter\Rc\RcMan.EXE" ["Creative Technology Ltd."]
"PhotoShow Deluxe Media Manager" = "C:\PROGRA~1\Ahead\NEROPH~1\data\Xtras\mssysmgr.exe" [null data]
"H/PC Connection Agent" = ""C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"" [MS]
"LogitechSoftwareUpdate" = ""C:\Program Files\Logitech\Video\ManifestEngine.exe" boot" ["Logitech Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."]
"UpdReg" = "C:\WINNT\Updreg.exe" ["Creative Technology Ltd."]
"Jet Detection" = "C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe" [empty string]
"IntelliType" = ""C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"" [MS]
"POINTER" = "C:\Program Files\Microsoft Hardware\Mouse\point32.exe" [MS]
"SymTray - Norton SystemWorks" = "C:\Program Files\Common Files\Symantec Shared\SymTray.exe SetReg" ["Symantec Corporation"]
"ccApp" = ""C:\Program Files\Common Files\Symantec Shared\ccApp.exe"" ["Symantec Corporation"]
"GhostStartTrayApp" = "C:\Program Files\Norton SystemWorks\Norton Ghost\GhostStartTrayApp.exe" ["Symantec Corporation"]
"AcctMgr" = "C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup" ["Symantec Corporation"]
"QD FastAndSafe" = ** WARNING! empty or invalid data **
"NeroFilterCheck" = "C:\WINNT\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"ZingSpooler" = "C:\Program Files\Common Files\Zing\ZingSpooler.exe" ["Sony Electronics Inc."]
"InCD" = "C:\Program Files\Ahead\InCD\InCD.exe" ["Ahead Software AG"]
"SSC_UserPrompt" = "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" ["Symantec Corporation"]
"MBM 5" = ""C:\Program Files\Motherboard Monitor 5\MBM5.EXE"" ["Alex van Kaam"]
"ShowIcon_SmartDisk Corporation_SmartDisk Flash Media Reader Support 2.1" = ""C:\Program Files\SmartDisk\Flash Media Reader\shwicon.exe" -t"SmartDisk Corporation\SmartDisk Flash Media Reader Support 2.1"" [null data]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"LVCOMSX" = "C:\WINNT\system32\LVCOMSX.EXE" ["Logitech Inc."]
"LogitechVideoRepair" = "C:\Program Files\Logitech\Video\ISStart.exe " ["Logitech Inc."]
"LogitechVideoTray" = "C:\Program Files\Logitech\Video\LogiTray.exe" ["Logitech Inc."]
"Zone Labs Client" = ""C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"" ["Zone Labs Inc."]
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ {++}
"SymTray - Norton SystemWorks" = "C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe" [null data]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "HyperTerminal Icon Ext"
-> CLSID InProcServer32 resolves to: "C:\WINNT\System32\hticons.dll" ["Hilgraeve, Inc."]
"{cc3ebf80-1a70-11d3-bdf2-00902745d0a9}" = "Mixman Shell Extention"
-> CLSID InProcServer32 resolves to: "Tk421.dll" ["Mixman Technologies Inc."]
"{59850401-6664-101B-B21C-00AA004BA90B}" = "Microsoft Office Binder Unbind"
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\MICROS~3\Office\1033\UNBIND.DLL" [MS]
"{57C51AF9-DEF7-11D3-A801-00C04F163490}" = "Ghost Shell Extension"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Norton SystemWorks\Norton Ghost\GhoShExt.dll" ["Symantec Corporation"]
"{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}" = "Shell Extensions for RealOne Player"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Real\RealPlayer\rpshell.dll" ["RealNetworks, Inc."]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{950FF917-7A57-46BC-8017-59D9BF474000}" = "Shell Extension for CDRW"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Ahead\InCD\incdshx.dll" ["Ahead Software AG"]
"{5464D816-CF16-4784-B9F3-75C0DB52B499}" = "Yahoo! Mail"
-> CLSID InProcServer32 resolves to: "C:\PROGRA~1\Yahoo!\Common\ymmapi.dll" ["Yahoo! Inc."]
"{400CFEE2-39D0-46DC-96DF-E0BB5A4324B3}" = "My Logitech Pictures"
-> CLSID InProcServer32 resolves to: "C:\Program Files\Logitech\Video\Namespc2.dll" ["Logitech Inc."]
"{3BD7B71F-D654-4E60-84B2-5D8C426C0A7C}" = (no title provided)
-> CLSID InProcServer32 resolves to: "C:\WINNT\system32\dbocx.dll" [null data]
"{2E560250-ED08-4CE3-941F-B72BB5BA2BD5}" = (no title provided)
-> CLSID InProcServer32 resolves to: "C:\WINNT\system32\mWlslib.dll" [null data]
"{6694B1A2-9451-43CD-89C6-593CFA3B26CD}" = (no title provided)
-> CLSID InProcServer32 resolves to: "C:\WINNT\system32\guard.tmp" [file not found]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! "AtiExtEvent\DLLName" = "Ati2evxx.dll" ["ATI Technologies Inc."]
Startup items in "John C. Luf" & "All Users" startup folders:
————————————————————-
C:\Documents and Settings\John C. Luf\Start Menu\Programs\Startup
"Desktop Alert" -> shortcut to: "C:\Program Files\Desktop Alert\desktopalert_1334198.exe" [null data]
"ListProAlarms" -> shortcut to: "C:\Program Files\Ilium Software\ListPro\ListProAlarms.exe" [null data]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]
"SATARaid" -> shortcut to: "C:\Program Files\Silicon Image\SiISATARaid\SATARaid.exe" ["Silicon Image, Inc."]
"strings.exe" [null data]
"Timex Data Link USB Launcher" -> shortcut to: "C:\Program Files\Timex\Data Link USB\DataLinkLauncher.exe" ["Timex Corporation"]
Enabled Scheduled Tasks:
————————
"Norton AntiVirus - Scan my computer" -> launches: "C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe /task:"C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Tasks\mycomp.sca"" ["Symantec Corporation"]
"Norton SystemWorks One Button Checkup" -> launches: "C:\Program Files\Norton SystemWorks\OBC.exe /CUSTOM /SCHEDULE" ["Symantec Corporation"]
"Symantec Drmc" -> launches: "C:\Program Files\Common Files\Symantec Shared\SymDrmc.exe /CUSTOM /SCHEDULE" [null data]
"Symantec NetDetect" -> launches: "C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE" ["Symantec Corporation"]
"{3BF27E4F-FF80-49A2-B006-EF4FD18D03BE}_SON_OF_HAL_John C. Luf" -> launches: "C:\WINNT\system32\mobsync.exe /Schedule="{3BF27E4F-FF80-49A2-B006-EF4FD18D03BE}_SON_OF_HAL_John C. Luf"" [MS]
"{424D7DB8-0BE5-4D92-B16C-D5A0C25F130E}_SON_OF_HAL_John C. Luf" -> launches: "C:\WINNT\system32\mobsync.exe /Schedule="{424D7DB8-0BE5-4D92-B16C-D5A0C25F130E}_SON_OF_HAL_John C. Luf"" [MS]
"{C3A967C4-DD7A-4628-A7BF-48B4A04A421B}_SON_OF_HAL_John C. Luf" -> launches: "C:\WINNT\system32\mobsync.exe /Schedule="{C3A967C4-DD7A-4628-A7BF-48B4A04A421B}_SON_OF_HAL_John C. Luf"" [MS]
Running Services (Display Name, Service Name, Path {Service DLL}):
——————————————————————
Ati HotKey Poller, Ati HotKey Poller, "C:\WINNT\system32\Ati2evxx.exe" ["ATI Technologies Inc."]
Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINNT\system32\CTsvcCDA.EXE" ["Creative Technology Ltd"]
GhostStartService, GhostStartService, "C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE" ["Symantec Corporation"]
InCD Helper, InCDsrv, "C:\Program Files\Ahead\InCD\InCDsrv.exe" ["Ahead Software AG"]
Norton AntiVirus Auto Protect Service, navapsvc, ""C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe"" ["Symantec Corporation"]
Norton Unerase Protection, NProtectService, "C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE" ["Symantec Corporation"]
SAVScan, SAVScan, "C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe" ["Symantec Corporation"]
Speed Disk service, Speed Disk service, "C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE" ["Symantec Corporation"]
Symantec Core LC, Symantec Core LC, "C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe" ["Symantec Corporation"]
Symantec Event Manager, ccEvtMgr, ""C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"" ["Symantec Corporation"]
Symantec Settings Manager, ccSetMgr, ""C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"" ["Symantec Corporation"]
TrueVector Internet Monitor, vsmon, "C:\WINNT\system32\ZoneLabs\vsmon.exe -service" ["Zone Labs Inc."]
———-
This report excludes default entries except where indicated.
To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
———-
