eternal_drake

Members
 View Profile  See their activity

  • Content Count

    2

  • Joined

  • Last visited

 Content Type 

Posts posted by eternal_drake

  1. Searching For Removal Of Optix1bot Trojan[INACTIVE]

    in Malware Removal

    Posted

    Ok I downloaded the Service Pack, and here is my new log

    Logfile of HijackThis v1.99.1

    Scan saved at 7:22:50 PM, on 2/21/2006

    Platform: Windows XP (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\LiteStep\litestep.exe

    C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    C:\WINDOWS\System32\nvsvc32.exe

    C:\Program Files\Common Files\AOL\1140419464\ee\aolsoftware.exe

    C:\Program Files\Winamp\winampa.exe

    C:\WINDOWS\SYSTEM32\rundll32.exe

    C:\Program Files\Xfire\Xfire.exe

    C:\WINDOWS\System32\wuauclt.exe

    C:\WINDOWS\explorer.exe

    C:\Program Files\Downloaded Programs\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm

    R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll

    O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdcatch.dll

    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll

    O2 - BHO: CIEStub Class - {EBBFE27C-BDF0-11D2-BBE5-00609419F467} - C:\WINDOWS\System32\amcis2.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:\PROGRA~1\FRESHD~1\FRESHD~1\fdiebar.dll

    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll

    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140419464\ee\AOLSoftware.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp

    O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe

    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

    O4 - Global Startup: Belkin 11Mbps Wireless Desktop Network Card Monitor.lnk = C:\WINDOWS\SYSTEM32\BelkinMonitor.exe

    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html

    O9 - Extra button: FreshDownload - {A0336B93-642C-4CEE-89A0-CB9B00E0D2F3} - C:\Program Files\FreshDevices\FreshDownload\fd.exe

    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

    O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab

    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect1.gravity.co.kr/nprotect/npx.cab

    O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/nprotect/nPKeyCrypt/npkcx.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  2. Searching For Removal Of Optix1bot Trojan[INACTIVE]

    in Malware Removal

    Posted

    some guy on Irc tricked me into changing my username to O12345678 and it banned me and injected the Optix1Bot trojan, http://www.gaiaonline.com/gaia/redirect.ph...iri%3DOptix1Bot.

    here is my HJT log:

    Logfile of HijackThis v1.99.1

    Scan saved at 5:12:30 PM, on 2/21/2006

    Platform: Windows XP (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:

    C:WINDOWSSystem32smss.exe

    C:WINDOWSsystem32csrss.exe

    C:WINDOWSsystem32winlogon.exe

    C:WINDOWSsystem32services.exe

    C:WINDOWSsystem32lsass.exe

    C:WINDOWSsystem32svchost.exe

    C:WINDOWSSystem32svchost.exe

    C:WINDOWSSystem32svchost.exe

    C:WINDOWSSystem32svchost.exe

    C:WINDOWSsystem32spoolsv.exe

    C:LiteSteplitestep.exe

    C:Program FilesCommon FilesLightScribeLSSrvc.exe

    C:WINDOWSSystem32nvsvc32.exe

    C:WINDOWSSystem32wdfmgr.exe

    C:WINDOWSSYSTEM32rundll32.exe

    C:Program FilesXfireXfire.exe

    C:WINDOWSSystem32wuauclt.exe

    C:WINDOWSSystem32svchost.exe

    C:Program FilesInternet ExplorerIEXPLORE.EXE

    C:Program FilesWinampwinamp.exe

    C:Program FilesHydraIRCHydraIRC.exe

    C:PROGRA~1MOZILL~1FIREFOX.EXE

    C:WINDOWSexplorer.exe

    C:WINDOWSSystem32msipcsv.exe

    C:Program FilesDownloaded ProgramsHijackThis.exe

    R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Local Page = C:WINDOWSSYSTEMblank.htm

    R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:Program FilesAOLAOL Toolbar 3.0aoltb.dll

    O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:PROGRA~1FRESHD~1FRESHD~1fdcatch.dll

    O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:Program FilesAOLAOL Toolbar 3.0aoltb.dll

    O2 - BHO: CIEStub Class - {EBBFE27C-BDF0-11D2-BBE5-00609419F467} - C:WINDOWSSystem32amcis2.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx

    O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - C:PROGRA~1FRESHD~1FRESHD~1fdiebar.dll

    O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:Program FilesAOLAOL Toolbar 3.0aoltb.dll

    O4 - HKLM..Run: [WinampAgent] C:Program FilesWinampwinampa.exe

    O4 - HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSSystem32NvCpl.dll,NvStartup

    O4 - HKLM..Run: [nwiz] nwiz.exe /install

    O4 - HKLM..Run: [NeroFilterCheck] C:WINDOWSsystem32NeroCheck.exe

    O4 - HKLM..Run: [QuickTime Task] "C:Program FilesQuickTimeqttask.exe" -atboottime

    O4 - HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSSystem32NvMcTray.dll,NvTaskbarInit

    O4 - HKLM..Run: [HostManager] C:Program FilesCommon FilesAOL1140419464eeAOLSoftware.exe

    O4 - HKLM..RunOnce: [Run IPH] C:Program FilesCommon FilesAOLIPHSendIPHSend.exe

    O4 - HKCU..Run: [MSMSGS] "C:Program FilesMessengermsmsgs.exe" /background

    O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background

    O4 - HKCU..Run: [Yahoo! Pager] C:Program FilesYahoo!Messengerypager.exe -quiet

    O4 - HKCU..Run: [Aim6] "C:Program FilesCommon FilesAOLLaunchAOLLaunch.exe" /d locale=en-US ee://aol/imApp

    O4 - Startup: Xfire.lnk = C:Program FilesXfireXfire.exe

    O4 - Startup: Adobe Gamma.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe

    O4 - Global Startup: Belkin 11Mbps Wireless Desktop Network Card Monitor.lnk = C:WINDOWSSYSTEM32BelkinMonitor.exe

    O8 - Extra context menu item: &AOL Toolbar Search - c:program filesaolaol toolbar 3.0resourcesen-USlocalsearch.html

    O9 - Extra button: FreshDownload - {A0336B93-642C-4CEE-89A0-CB9B00E0D2F3} - C:Program FilesFreshDevicesFreshDownloadfd.exe

    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm

    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm

    O16 - DPF: Win32 Classes - file://C:WINDOWSJavaclasseswin32ie4.cab

    O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://nprotect1.gravity.co.kr/nprotect/npx.cab

    O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://nprotect1.gravity.co.kr/nprotect/nPKeyCrypt/npkcx.cab

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:PROGRA~1MSNMES~1msgrapp.dll" (file missing)

    O23 - Service: Adobe LM Service - Adobe Systems - C:Program FilesCommon FilesAdobe Systems SharedServiceAdobelmsvc.exe

    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:Program FilesCommon FilesLightScribeLSSrvc.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:WINDOWSSystem32nvsvc32.exe