hijackThis log file

Process list saved on 7:29:08 PM, on 9/28/2005 Platform: Windows XP (WinNT 5.01.2600) [pid] [full path to filename] [file version] [company name] 448 C:\WINDOWS\System32\smss.exe 5.1.2600.0 Microsoft Corporation 536 C:\WINDOWS\system32\winlogon.exe 5.1.2600.149 Microsoft Corporation 580 C:\WINDOWS\system32\services.exe 5.1.2600.0 Microsoft Corporation 592 C:\WINDOWS\system32\lsass.exe 5.1.2600.0 Microsoft Corporation 756 C:\WINDOWS\system32\svchost.exe 5.1.2600.0 Microsoft Corporation 804 C:\WINDOWS\System32\svchost.exe 5.1.2600.0 Microsoft Corporation 1056 C:\WINDOWS\system32\spoolsv.exe 5.1.2600.0 Microsoft Corporation 1444 D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe 1560 C:\WINDOWS\System32\svchost.exe 5.1.2600.0 Microsoft Corporation 1660 C:\WINDOWS\System32\wbem\wmiapsrv.exe 5.1.2600.0 Microsoft Corporation 1696 C:\WINDOWS\system32\svchost.exe 5.1.2600.0 Microsoft Corporation 1204 C:\WINDOWS\Explorer.EXE 6.0.2600.0 Microsoft Corporation 192 C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe 1.3.6.5 eLitecore Technologies Ltd. 2004 C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe 1500 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2600.0 Microsoft Corporation 556 C:\WINDOWS\java\infosys.exe 1376 C:\WINDOWS\System32\msiexec.exe 2.0.2600.0 Microsoft Corporation 264 D:\Setup Files\hijackthhis\HijackThis.exe 1.99.0.1 Soeperman Enterprises Ltd.

Run Hijack This!

Click the "Open the Misc Tools" section Button.

Click the "Open Process Manager" Button.

IN the list of processes find:

1500 C:\Program Files\Internet Explorer\iexplore.exe 6.0.2600.0 Microsoft Corporation
556 C:\WINDOWS\java\infosys.exe

Click it to highlight it, then click Kill process, close Hijack This!

Run the "Move on Boot" file (mboot.exe)

Click:

Next –> … "Browse" for this file:

C:\WINDOWS\java\infosys.exe

Click it to highlight it, then click: Open

That file should show up in the text box.

Click:

Next –> Check Delete file –> Next –> Start –> Finish

Click mboot.exe again, and go thru the same process, "browsing" for these files if they still exist:

C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
C:\WINDOWS\java\sysofni.ini
C:\WINDOWS\java\sysofni.bak2

Then cross your fingers, , reboot and post a new log file.

Please do the instructions in this post again:

Click Me

Does the account you use to do these "fixes" have "adminstrator" privileges?

Did you get an error when you tried to "Kill process" on infosys.exe ?

Please download/unzip this:

Registry Search by Bobbi Flekman

on regsearch.exe, and search for these strings:

infosys
sysofni
hostx
bkinst
ATLEvent
8109AF33-6949-4833-8881-43DCC232B7B2
72AC6865-B1D3-4C32-A27B-4B3BF04DE655
2316230A-C89C-4BCC-95C2-66659AC7A775
BB54DE33-E539-4749-BFAC-CC49617E8F2A

It may take a while to run, so be patient. When finished, the search results will appear in your text editor.

You can only search for 3 at a time. There are 9 search strings, so you'll have to search 3 times.

Paste the contents of the results into your next post.

REGEDIT4 ; Registry Search by Bobbi Flekman ; Version: 1.0.2.1 ; Results at 9/29/2005 12:45:47 PM for strings: ; 'bkinst' ; 'atlevent' ; 'bb54de33-e539-4749-bfac-cc49617e8f2a' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents] @="CATLEvents Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CLSID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CLSID] @="{BB54DE33-E539-4749-BFAC-CC49617E8F2A}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CurVer] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents\CurVer] @="ATLEvents.ATLEvents.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1] @="CATLEvents Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1\CLSID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ATLEvents.ATLEvents.1\CLSID] @="{BB54DE33-E539-4749-BFAC-CC49617E8F2A}" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }] @="CATLEvents Object" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\InprocServer32] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\ProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\ProgID] @="ATLEvents.ATLEvents.1" [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\Programmable] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\TypeLib] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\VersionIndependentProgID] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\VersionIndependentProgID] @="ATLEvents.ATLEvents" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB54DE33-E539-4749-BFAC-CC49617E8F2A}] ; End Of The Log… REGEDIT4 ; Registry Search by Bobbi Flekman ; Version: 1.0.2.1 ; Results at 9/29/2005 12:58:05 PM for strings: ; 'infosys' ; 'sysofni' ; 'hostx' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB54DE33-E539-4749-BFAC-CC49617E8F2A }\InprocServer32] @="C:\\DOCUME~1\\LAN\\LOCALS~1\\Temp\\sysofni.dat" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "*infosys"="C:\\WINDOWS\\java\\infosys.exe rerun" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\infosys] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\infosys] "DllName"="C:\\DOCUME~1\\LAN\\LOCALS~1\\Temp\\sysofni.dat" [HKEY_USERS\S-1-5-21-682003330-152049171-1060284298-1005\Software\Microsoft\Sear ch Assistant\ACMru\5603] "002"="sysofni.bak" [HKEY_USERS\S-1-5-21-682003330-152049171-1060284298-1005\Software\Microsoft\Wind ows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*] "j"="C:\\WINDOWS\\java\\infosys.exe" [HKEY_USERS\S-1-5-21-682003330-152049171-1060284298-1005\Software\Microsoft\Wind ows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe] "g"="C:\\WINDOWS\\java\\infosys.exe" ; End Of The Log… REGEDIT4 ; Registry Search by Bobbi Flekman ; Version: 1.0.2.1 ; Results at 9/29/2005 1:08:02 PM for strings: ; '2316230a-c89c-4bcc-95c2-66659ac7a775' ; '72ac6865-b1d3-4c32-a27b-4b3bf04de655' ; '8109af33-6949-4833-8881-43dcc232b7b2' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS ; End Of The Log…

I still need the info from this post:

Click Me

I've never had this much trouble removing this infection.

I'm trying to figure out (as Yosimite Sam would say) "what in tarnation is going on??!!??"

OMG!!!!!

What did you do??!!!!!!!!!!!!!!????

IT"S FIXED!!!!!!




M68

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

I really thank You very very much. My comps speed is just way too good as compared to earlier. THANK YOU yet again for bearing with me and not getting frustrated after all my unsuccessful attempts. I really appreciate all ure replies and i sincerely wish u good all your life THANK YOU, cvano.

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.