starsniper 0 Report post Posted June 19, 2005 Okay, so I was talking to my friend on IM yesterday and then she sends me a message saying OMFG LOOK AT HER or something like that and then a link. I stupidly opened it and then two seconds later she IMs me telling me not to cause it seems to be a virus. Usually I don't accept those kind of things but it was from her so I let my guard down. Apparently she had got it from another one of her friends. It's a .pif virus I know that much but it doesn't do much, I can still open AIM and my task manager with no weird things but when I reboot my computer, my C:\WINDOWS folder pops up at the startup for no reason at all. Then when I x out of the window, I can't find that system folder anymore but according to Norton and Spybot, the folder isn't missing. I rebooted again and saw nothing really missing but I don't know. Anything to do with that folder makes me paranoid. Help me please?~Abby Share this post Link to post Share on other sites
Klass 0 Report post Posted June 19, 2005 This thread has useful information as well as programs.http://forums.xisto.com/topic/84093-topic/?findpost=1064304790I would check your registry entries in the "Run" sections listed in the above link. Anything out of the ordinary you should delete but only if you understand what it will do. Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.I would check the registry then post here what is in the run entries of the collowing keys listed in the above link.I will tell you what to do with them, or I will tell you I have no idea what it is. Share this post Link to post Share on other sites
starsniper 0 Report post Posted June 19, 2005 I didn't know how to paste in the code so here's a screenshot: I already see some things wrong but I don't know for sure, all I know is...I'm not running Winamp now Share this post Link to post Share on other sites
Toxica 0 Report post Posted June 19, 2005 Yes, I too have gotten a virus from AIM. I was messaged from a friend to "check this out" and i stupidly accepted. It took me a foreign website download which was called photo something. After it installed it produces a program with the MS-DOS icon in my hard drive. I ran 3 virus test and it was succesfuly removed though, it didn't harm much though. And about a week later i got another virus from AIM which didnt let me right click. And another a few days ago from AIM which wouldn't let me open windows explorer. But i got it all taken care of and my computer is clean. I think there is way more than one virus running in aim. And this virus spreads pretty quickly. Almost all my friends on my buddylist had it because i got the exact message from a lot of them saying "hey check this out" or "lesbian pic" or something in that matter. Also watch out i have gotten one off of MSN too. Share this post Link to post Share on other sites
starsniper 0 Report post Posted June 19, 2005 So far, nothing's happened to my computer other than the C:\WINDOWS folder popping up everytime I reboot and my System Restore is retarded and won't restore even to a month ago. Nothing bad's happened yet, no files deleted but I think some were added and they slow my computer down a great deal. It's just annoying~Abby Share this post Link to post Share on other sites
Klass 0 Report post Posted June 19, 2005 See the last line:Windows Taskbar..... C:\Windows\\\\\\\\\Delete it, that is what is causing it to start when you turn your computer on.After you delete it, restart your computer, If it pops up you need to run a virus scan, spyware/adware scan to remove it. Share this post Link to post Share on other sites
starsniper 0 Report post Posted June 19, 2005 Okay, so it stopped poping up but the WINDOWS folder still won't show up when I still look for it in my Hard Drive though norton and all that says it exists ;__; Share this post Link to post Share on other sites
Klass 0 Report post Posted June 19, 2005 I would download and run these programs listed here:http://forums.xisto.com/topic/84093-topic/?findpost=1064304790Install, Update, Scan. Definatly do the free ones, and Microsoft AntiSpyware. After you run them once, reboot, run them again, Reboot (fingers crossed) the issues should be gone. Share this post Link to post Share on other sites
starsniper 0 Report post Posted June 19, 2005 No change ? Cept my computer's faster and I just rid myself of a shitload of spyware. But I still can't see my C:\WINDOWS folder and when I tried to run it I got the one in the C:\Documents and Settings area. It's like the folder's disappeared but it can still be detected. Oh yeah, I did a log of Hijack This, tell me if there's anything I need to get rid of Logfile of HijackThis v1.99.1 Scan saved at 5:34:08 PM, on 6/19/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\PROGRA~1\AWS\WEATHE~1\Weather.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Abigail\My Documents\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com/en-us/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.livejournal.com/?page=0&nojs=1 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com/en-us/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.livejournal.com/?page=0&nojs=1 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/en-us/ R3 - Default URLSearchHook is missing O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {D70E6A20-7060-4829-B3D7-B6624A1DE7C6} - (no file) O2 - BHO: (no name) - {EC4F1829-3447-083B-76BA-8422F2ABED50} - (no file) O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: (no name) - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1 O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O8 - Extra context menu item: &AIM Search - re http://forums.xisto.com/ Files\AIM Toolbar\AIMBar.dll/aimsearch.htm O8 - Extra context menu item: &Google Search - re http://forums.xisto.com/ files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Backward Links - re http://forums.xisto.com/ files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - re http://forums.xisto.com/ files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - re http://forums.xisto.com/ O8 - Extra context menu item: Similar Pages - re http://forums.xisto.com/ files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - re http://forums.xisto.com/ files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU) O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} - http://www.wildtangent.com/ O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://forums.xisto.com/no_longer_exists/ O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://zone.msn.com/en-us/home O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://forums.xisto.com/no_longer_exists/ O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://forums.xisto.com/no_longer_exists/ O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe Share this post Link to post Share on other sites
starsniper 0 Report post Posted June 19, 2005 Nevermind about the windows folder being hidden. I got it back to the way it was though that stupid pif thing gave me a scare. I think I'm pretty clean now but is there anything else I should be worried about on that Hijack This thing?~Abby Share this post Link to post Share on other sites
Klass 0 Report post Posted June 19, 2005 I do not see anything out of the ordinary.Check Add/Remove programs and remove any programs:a. You don't recognize (Do a Web Search first to make sure you don't know what it is)b. You did not install nor did anyone that uses the computer installc. Any programs you haven't used in over a week or on a daily basis.If you do not need these to startup when your computer starts you can disable them from the registry from your above image:Realplayer: C:\Program Files\Common Files\Real\Update_OB\realsched.exeI forget what this was but I always remove it (you make the judgment call before removing it): C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exeQuicktime: C:\Program Files\QuickTime\qttask.exeWinamp: C:\Program Files\Winamp\winampa.exeWeatherbug: C:\PROGRA~1\AWS\WEATHE~1\Weather.exeMSN Messenger: C:\Program Files\MSN Messenger\MsnMsgr.Exe Share this post Link to post Share on other sites
