This is a fully patched xp box running AVG antivirus, all of spybots protections, and a hardware firewall.
I went from a auto forum to a link to one of those sites that let you upload files, and download them to share with your friends.
I clicked the download link and then ten command boxes opened up at once. I was totally fucked.
You can’t close it, you can’t do anything.
It was installing this win antivirus pro software on the computer.
Then I uninstalled the win antivirus pro software, and ran spybot.
Here’s how it looks.
Now I’ll have to post a hijackthis! log to a forum to get some help getting it cleaned.
This is one nasty nasty infection.
LZ1
June 11, 2007, 1:17pm
3
Post the hijackthis log on here…
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net \partypokernet.exe (file missing)PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net \partypokernet.exe (file missing)http://housecall60.trendmicro.com/housecall/xscan60.cab http://www.creative.com/su/ocx/15015/CTSUEng.cab http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://www.sidestep.com/get/k42037/sb02b.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120267348233 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143337248031 http://www.worldwinner.com/games/shared/wwlaunch.cab http://www.worldwinner.com/games/v45/sol/sol.cab http://www.crucial.com/controls/cpcScanner.cab http://www.worldwinner.com/games/v64/swapit/swapit.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab http://games.pogo.com/online2/pogo/zuma/popcaploader_v5.cab https://www.paypad.com/PPEpay.cab http://www.creative.com/su/ocx/15016/CTPID.cab
–
suggest using system restore to go to a previous restore point (provided that was nt disabled) if all else fails
HAHAA… yea, coming back from something like this generally takes wayyy to long, and its dam near impossible to get rid of it all for good. System resore should work, or else your going to be spending alot of time running mulptile spyware apps at the same time while being disconnected from the internet for weeks… The key is running like 3+ apps at the same time to catch all these little buggers… It usually worked for me, until i switched to mac
Ive learned a few things when it comes to my PC…
A) back in the noob days, virus attack OMG what to do.
I say just format, it’ll be easier.
find smitfraudfix and run it as well.
see where you stand after that.
stupid winantivirus pro. i see it constantly
I had the same thing, it was called Spydawn.
Smitfraudfix works.
also get peerguardian2. It wont allow the windows that show up to actually get to a page. just a blank screen, so you cant get more infected.
spybot wouldn’t touch it, same for adaware.
I ended up getting a copy of this software called spyware doctor, then getting a crack for it.
That cleaned it up fine.
IROC-Z
June 16, 2007, 3:30pm
11
I clicked the download link and then ten command boxes opened up at once. I was totally fucked.
You can’t close it, you can’t do anything.
This happend to me a few times back in the day. When that would happen, I would just power the computer down manually, then boot in safe mode and scan. Saved it a couple times doing that without having to format.
durrrrr dont go clicking links like a retarded monkey
JustinH:
spybot wouldn’t touch it, same for adaware.
I ended up getting a copy of this software called spyware doctor, then getting a crack for it.
That cleaned it up fine.
Actually it didnt, spyware doctor is not a reputable program, it makes it seem like it cleaned it out, but really it just Hid it.
Have fun
yea, i’m laughing at the “advice” too
computer is totally back to normal.
I don’t post bs, that spyware doctor program worked just fine, then I uninstalled it.
I’m not a computer newbie, so save that also. Not even close.
yet your computer was compromised …
Vile
June 19, 2007, 5:29pm
20
and the hijack log was… 100+ entries…
