What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help To Find The Log

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I downloaded HijackThis but I am not sure what the "Log" is and where to find it. Because I really want to delete the viruses which Norton has not been able to delete for a very long while now…So after finding the Log I was wandering if any of you could please help me deleting them as well. I would appreciate it very much :) Thank you!
Post #2
Nevermind, I found the Log and everything on my own :) Now I just need some help, whenever anyone has free time, to help determine the problem. I really appreciate it, Thank you very much :)

Logfile of HijackThis v1.99.1
Scan saved at 5:21:05 PM, on 4/14/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\spool\runapp\MSNS.exe
C:\WINNT\system32\regsvc.exe
C:\winnt\system32\dllcache\FireDaemon.EXE
C:\WINNT\system32\dllcache\runbatch.exe
C:\WINNT\system32\spool\runapp\winocx.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Bell\Access Manager\app\TangoService.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Mixer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\RUNDLL32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINNT\system32\ctfmon.exe
C:\PROGRA~1\AIM95\aim.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\WINNT\system32\wuauclt.exe
C:\Documents and Settings\Rusu\Local Settings\Temp\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wdcojrheovghj.com/mF0/K8prHHK6dgFys…Tx4zW1qi0O.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://healthandfitness.sympatico.msn.ca/Home/
O2 - BHO: (no name) - {2104D7D2-03E1-3D47-5CE7-D54199BCB01B} - C:\DOCUME~1\Rusu\APPLIC~1\1DVDSU~1\htm live.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Microsoft Manager] windll23.exe
O4 - HKLM\..\Run: [outlook] outlook.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vcccs] C:\winnt\system32\xvasad.exe
O4 - HKLM\..\Run: [VMansdnfqs] cxcadq.exe
O4 - HKLM\..\Run: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKLM\..\Run: [DSAcass] C:\winnt\system32\cacasp.exe
O4 - HKLM\..\Run: [ddqdsxnfqs] dqddss.exe
O4 - HKLM\..\Run: [Scvhost] Scvhost.exe
O4 - HKLM\..\Run: [Microoft Timing] pupdate.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] msnmessenger.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [glue obj gram setup] C:\Documents and Settings\All Users\Application Data\32 iso glue obj\Idollive.exe
O4 - HKLM\..\RunServices: [Microsoft Manager] windll23.exe
O4 - HKLM\..\RunServices: [VMansdnfqs] cxcadq.exe
O4 - HKLM\..\RunServices: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKLM\..\RunServices: [ddqdsxnfqs] dqddss.exe
O4 - HKLM\..\RunServices: [Scvhost] Scvhost.exe
O4 - HKLM\..\RunServices: [Microoft Timing] pupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] msnmessenger.exe
O4 - HKCU\..\Run: [Microsoft Manager] windll23.exe
O4 - HKCU\..\Run: [outlook] outlook.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [VMansdnfqs] cxcadq.exe
O4 - HKCU\..\Run: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKCU\..\Run: [ddqdsxnfqs] dqddss.exe
O4 - HKCU\..\Run: [Scvhost] Scvhost.exe
O4 - HKCU\..\Run: [Microoft Timing] pupdate.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] msnmessenger.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Axis Chin] C:\DOCUME~1\Rusu\APPLIC~1\FRAGCO~1\FLAPFAST.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxresearch.com/Preloader.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare NT Utilities 2.6 (DNTUS26) - DameWare Development LLC - C:\WINNT\SYSTEM32\DNTUS26.EXE
O23 - Service: hcpwlf - Unknown owner - \\69.157.78.58\D$\IEXPLORE.EXE" -service (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: FireDaemon Service: ntsysvers (ntsysvers) - Unknown owner - C:\winnt\system32\dllcache\FireDaemon.EXE
O23 - Service: W2K PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINNT\system32\pctspk.exe
O23 - Service: reclaim - Unknown owner - C:\WINNT\system32\spool\runapp\MSNS.exe
O23 - Service: FireDaemon Service: runbatch (runbatch) - Unknown owner - C:\winnt\system32\dllcache\FireDaemon.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: stbcy - Unknown owner - \\69.157.78.96\D$\IEXPLORE.EXE" -service (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: FireDaemon Service: sysdll (sysdll) - Unknown owner - c:\winnt\system32\spool\spools\FireDaemon.EXE
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Bell\Access Manager\app\TangoService.exe
Post #3 last edited
hi sorry to keep you waiting ;) in order to help you i need a fresh hijackthis log, can you rescan and post a new one for me thank you FYI: we have not been overlooking or ignoring you, most of us helpers just look for topics with 0 replies this looks like it will be fun :P
Post #5
Here it is

Logfile of HijackThis v1.99.1
Scan saved at 7:39:53 PM, on 4/25/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE
C:\WINNT\system32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\spool\runapp\MSNS.exe
C:\WINNT\system32\regsvc.exe
C:\winnt\system32\dllcache\FireDaemon.EXE
C:\WINNT\system32\spool\runapp\winocx.exe
C:\WINNT\system32\dllcache\runbatch.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Bell\Access Manager\app\TangoService.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Mixer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINNT\system32\RUNDLL32.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINNT\system32\ctfmon.exe
C:\PROGRA~1\AIM95\aim.exe
C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LVComS.exe
C:\Program Files\Logitech\Video\LowLight.exe
C:\PROGRA~1\Bell\ACCESS~1\app\TangoManager.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Rusu\Local Settings\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://wdcojrheovghj.com/mF0/K8prHHK6dgFys…Tx4zW1qi0O.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://healthandfitness.sympatico.msn.ca/Home/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://healthandfitness.sympatico.msn.ca/Home/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2104D7D2-03E1-3D47-5CE7-D54199BCB01B} - C:\DOCUME~1\Rusu\APPLIC~1\1DVDSU~1\htm live.exe
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Microsoft Manager] windll23.exe
O4 - HKLM\..\Run: [outlook] outlook.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [vcccs] C:\winnt\system32\xvasad.exe
O4 - HKLM\..\Run: [VMansdnfqs] cxcadq.exe
O4 - HKLM\..\Run: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKLM\..\Run: [DSAcass] C:\winnt\system32\cacasp.exe
O4 - HKLM\..\Run: [ddqdsxnfqs] dqddss.exe
O4 - HKLM\..\Run: [Scvhost] Scvhost.exe
O4 - HKLM\..\Run: [Microoft Timing] pupdate.exe
O4 - HKLM\..\Run: [Microsoft Windows Update] msnmessenger.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [glue obj gram setup] C:\Documents and Settings\All Users\Application Data\32 iso glue obj\Idollive.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\RunServices: [Microsoft Manager] windll23.exe
O4 - HKLM\..\RunServices: [VMansdnfqs] cxcadq.exe
O4 - HKLM\..\RunServices: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKLM\..\RunServices: [ddqdsxnfqs] dqddss.exe
O4 - HKLM\..\RunServices: [Scvhost] Scvhost.exe
O4 - HKLM\..\RunServices: [Microoft Timing] pupdate.exe
O4 - HKLM\..\RunServices: [Microsoft Windows Update] msnmessenger.exe
O4 - HKCU\..\Run: [Microsoft Manager] windll23.exe
O4 - HKCU\..\Run: [outlook] outlook.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [VMansdnfqs] cxcadq.exe
O4 - HKCU\..\Run: [Microsoft Lmhosting Service] lmhosts.exe
O4 - HKCU\..\Run: [ddqdsxnfqs] dqddss.exe
O4 - HKCU\..\Run: [Scvhost] Scvhost.exe
O4 - HKCU\..\Run: [Microoft Timing] pupdate.exe
O4 - HKCU\..\Run: [Microsoft Windows Update] msnmessenger.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Axis Chin] C:\DOCUME~1\Rusu\APPLIC~1\FRAGCO~1\FLAPFAST.exe
O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe
O4 - Global Startup: Reboot.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxresearch.com/Preloader.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{757149C4-AB8E-4039-AFE2-0A6BF980E4C7}: NameServer = 206.47.244.108 206.47.244.15
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DameWare NT Utilities 2.6 (DNTUS26) - DameWare Development LLC - C:\WINNT\SYSTEM32\DNTUS26.EXE
O23 - Service: hcpwlf - Unknown owner - \\69.157.78.58\D$\IEXPLORE.EXE" -service (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: FireDaemon Service: ntsysvers (ntsysvers) - Unknown owner - C:\winnt\system32\dllcache\FireDaemon.EXE
O23 - Service: W2K PCtel speaker phone (Pctspk) - PCtel, Inc. - C:\WINNT\system32\pctspk.exe
O23 - Service: reclaim - Unknown owner - C:\WINNT\system32\spool\runapp\MSNS.exe
O23 - Service: FireDaemon Service: runbatch (runbatch) - Unknown owner - C:\winnt\system32\dllcache\FireDaemon.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: stbcy - Unknown owner - \\69.157.78.96\D$\IEXPLORE.EXE" -service (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: FireDaemon Service: sysdll (sysdll) - Unknown owner - c:\winnt\system32\spool\spools\FireDaemon.EXE
O23 - Service: Tango Service (TangoService) - Unknown owner - C:\Program Files\Bell\Access Manager\app\TangoService.exe
Post #6 last edited
hi

there are numerous items that point to a serious backdoor infection!

the safest way to clean it would be format ans reinstall windows .
we can attemp to clean if though if you wish ;) :D

see this:
http://www.dslreports.com/faq/10063




Download the trial version of TDS-3 anti trojan from here:
http://www.diamondcs.com.au/tds/downloads/tds3setup.exe
Install it, but do not launch it yet

Update it: right click the link below, select "save as"
http://www.diamondcs.com.au/tds/radius.td3

Save it to the directory where you installed tds-3, overwriting the previous radius.td3.

Then launch tds-3. in the top bar of tds window click System Testing> Full System Scan.
Detections will appear in the lower pane of TDS window. After the scan is finished ( it'll take a while ) right click the list> select save as txt. Save it and post the contents of the scandump.txt here

After posting the scanlog go ahead and right click the list again, this time select delete! Delete everything labelled positive identification

NOTE: if you get any positive identification detections leave those for a while, also leave undeleted if you get anything labelled suspicious

also post a fresh hijackthis log

closed

If you need this topic reopened, please request this by sending an email to us at the following

link
(Click for address)
Include your post user name and detail why you need it

reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked

at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI