Go Back   HYIPs Talk - Your HYIP Investment Forum > -->Hyips Talk Forum (NO Advertising or Ref Links) > Computer Safety and Security and Technical Support

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 04-29-2007, 07:42 PM
Newbie Amateur
 

Join Date: Apr 2007
Posts: 21
Rep Power: 0
mm22mmqq is on a distinguished road
Points: 0
Default Help! super infected computer

recently reformated my computer. However, in doing so I ended up with a bunch of viruses on my computer. I have AVG installed and it gets rid of the viruses it says but then they just re-appear. I don't know what else I can do. Please help me.

Thanks

Also, here's a copy of my hijack this log.

Logfile of HijackThis v1.99.1
Scan saved at 1:47:22 PM, on 26/04/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\DHCP.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\dllisp.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tmrsrv32.exe
C:\WINDOWS\System32\idleserv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\wbnjn.exe
C:\WINDOWS\System32\servics3.exe
C:\WINDOWS\System32\tcpipmon.exe
C:\WINDOWS\System32\logon.exe
C:\WINDOWS\System32\iexplore.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\System32\spoolsvc.exe
C:\windows\system32\uvnx.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\tcpipmon.exe
C:\WINDOWS\System32\ccjlc.exe
C:\WINDOWS\System32\ipateum.exe
c:\q7i1j3n9q3s2.exe
C:\WINDOWS\System32\svchost.exe
c:\windows\system32\uvnx.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\4.tmp
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\PROGRA~1\Grisoft\AVG7\avgwa.dat
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\cmd.exe
C:\WINDOWS\System32\cmd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.ca
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Advanced DHTML Enable] C:\WINDOWS\System32\ipateum.exe
O4 - HKLM\..\Run: [SvcManager] servics3.exe
O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe
O4 - HKLM\..\Run: [Windows Logon Application] C:\WINDOWS\System32\logon.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [uvnx] c:\windows\system32\uvnx.exe
O4 - HKLM\..\Run: [InfoData] rundll32.exe "C:\WINDOWS\System32\tamvqxtw.dll",realset
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\Owner\Desktop\HijackThis.exe /startupscan
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: CDRecorder036 - {A3BC5E20-0235-1ABF-9CE1-00AA00512036} - C:\WINDOWS\System32\tsjpf32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: DHCP Clients - Unknown owner - C:\WINDOWS\DHCP.EXE
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Unknown owner - C:\Program Files\Norton AntiVirus\isPwdSvc.exe (file missing)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Windows DLLISP Service - Unknown owner - C:\WINDOWS\dllisp.exe
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote

Paid Advertisement
  #2 (permalink)  
Old 04-29-2007, 08:15 PM
Investor
 

Join Date: Apr 2007
Posts: 331
Rep Power: 3
etitex is on a distinguished road
Points: 49
Default

I think this viruses are too much to for your pc,the worst is that you cannot even get ride of them after formatting.Well change your harddisk.
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #3 (permalink)  
Old 04-29-2007, 10:54 PM
Banned
 

Join Date: Jan 2007
Posts: 481
Rep Power: 0
blueman is on a distinguished road
Points: 0
Default

wow, so many process, i have less then half of all the process running at a given time. if avg is not good enough try using norton or mcafee. and i think this process is also a virus. c:\q7i1j3n9q3s2.exe
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #4 (permalink)  
Old 04-29-2007, 11:48 PM
Investor
 

Join Date: Apr 2007
Posts: 382
Rep Power: 3
ahmedmarz is on a distinguished road
Points: 185
Default

ohhh that is too much you should format your computer and get rid of any infection format it by fat32 prefered
__________________

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #5 (permalink)  
Old 04-30-2007, 05:10 AM
Investor
 

Join Date: Apr 2007
Posts: 141
Rep Power: 2
remo_fullyloaded is on a distinguished road
Points: 0
Default

Quote:
Originally Posted by blueman View Post
wow, so many process, i have less then half of all the process running at a given time. if avg is not good enough try using norton or mcafee. and i think this process is also a virus. c:\q7i1j3n9q3s2.exe
u r absolutely rite...sometimes we can see those .exe files in window's temp folder too
they will offten connect to net...i hav Bitdefender 10 so i can control its activity

dont worry Just format the Window's Drive that will do..!!!
__________________

Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #6 (permalink)  
Old 04-30-2007, 07:09 AM
Investor
 

Join Date: Apr 2007
Posts: 343
Rep Power: 3
moumita is on a distinguished road
Points: 12
Default

Open all the ports of your computer and then hard format it. If you have the PC restore option then you can also try that, because many times it works. Also scan the PC with Bitdefender antivirus because that is the best.
__________________
www.Go-4-Money.blogspot.com
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #7 (permalink)  
Old 04-30-2007, 10:09 AM
Newbie Amateur
 

Join Date: Apr 2007
Posts: 27
Rep Power: 0
ahmad_farouk is on a distinguished road
Points: 0
Default

you should use nod32 Anti virus
as any other antivirus software may destroy your windows software
nod32 is specific for these types of viruses
__________________

_________________
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
  #8 (permalink)  
Old 04-30-2007, 10:15 AM
Investor
 

Join Date: Apr 2007
Posts: 412
Rep Power: 3
proftiger is on a distinguished road
Points: 1
Talking

just throw away your pc and buy anther one
__________________
<a href="http://dequba.com/signup.php?REF=43528"><img src="http://dequba.com/images/bnr/aff_payouts-468.jpg" border=0></a>
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 01:40 PM.


Advertising
$150/week or $580/month!
$60/week or $220/month!
$40/week or $140/month!
$30/week or $100/month!
click to view LargeSUM.com details on Investdad.com
$25/week or $80/month!
Get the HYIPsTalk.com Buttons :
Add these buttons to your site by copying the code below:







Link Partners
HYIP Surf Talk | Partners | HYIPS Tracker

MoneyTalkPro.com - Get Paid to Post Forum

Powered by vBulletin® Version 3.7.3
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.2.0
Copyright © 2007 HYIPs Talk All rights reserved