Disinfecting a PC… part 2



Ok, the last post got a bit long with the hijackthis log, but I wanted to include the whole picture. I put a few comments in, but thought it might be useful to include the notes I took at the time. For starters I leave it unplugged from the network. (There is no network card in this machine.) It’s important when working on an infested PC to leave it isolated so that it can’t continue to spread viruses or spam or whatever it may be doing. Assume if it’s infested with something that it could be spewing out bad stuff. If you must, isolated it and prevent it from routing to the outside world… the safest is usually to leave the cable unplugged for the initial look over.


Left net cable off, Booted and looked – installer icon in system tray which disappeared before I could get a tooltip for it. Looks spywareish… webshots (didn’t they bundle with spyware at some point?) Looking at msconfig – jawa32 looks suspect. SurfSidekick 2 (ssk.exe), ssdpsrv.exe (???), ylgril.exe, C:Program FilesVBouncerVBouncerInner.exe /S, C:WINDOWSSYSTEMpuswxc.exe, c:windowssystemsaie.exe, C:WINDOWSGuqvqmm.exe, C:WINDOWSXecrtyr.exe, C:WINDOWSaqadcup.exe, C:WINDOWSgoidr.exe, C:Program FilesCommon Filesslmssslmss.exe,C:PROGRA~1BMCENT~1BMLauncher.exe.(?)

So, in the above I’ve highlighted the running processes or startup entries that I don’t recognize right off, or don’t seem normal.

Running hijack this… and analyzing… (Log was included in previous post.)
Several BHO’s
jawa32.exe looks to be a trojan backdoor.agent.bg ??
Looks fairly infested… installing AVG and updating.

Got spybot S&D, ad-aware and bhodemon in the wings…. just in case…

AVG failed install… It gave an error accessing the registry…

Local machine: installation failed
Initialization:
Error: Checking of state of the item registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionAvg7RunOnceParams failed.
The configuration registry database is corrupt. (1009)

Time to use a working networked pc…

Related Posts

Blog Traffic Exchange Related Posts
  • More on Sony's copyright infringement with their DRM Rootkit "What a tangled web..." there is more today at freedom-to-tinker on the evidence that Sony (and or first4internet), have infringed on copyrighted code in their DRM software XCP which has been at the middle of quite a bit of controversy the last few weeks. Most of the coverage has been......
  • Windows cleanmgr takes too long at compress old files Here's a quick fix for Windows 2000 and XP when using cleanmgr to clean out temporary files. I've run across many systems that it just freezes (or takes way too long) calculating space saved by compressing old files, or hangs just saying "compress old files". Well, here's one way to......
  • Zotob worm bites big media outlets According to several reports there are several big media outlets seeing what is reported as the zotob worm which exploits a Microsoft Windows vulnerability (MS05-039) disclosed last week. There seems to be no better way for something to make the news than for it to affect the companies that bring......
Blog Traffic Exchange Related Websites
  • Funny Windows Errors - How to Fix Registry Errors in Windows Have you ever wondered why your computer sometimes encounters funny windows errors after several weeks from your purchase? Your windows operating system may behave unusually, and if you think about it this happens when you install and uninstall programs in your computer. It is also common that over time, you......
  • How to Do Home Window Installation Replacing and installing windows can seem like a daunting and expensive task, but it can actually be incredibly simple to do yourself. When you do your own home window installation, you’ll be greatly cutting down on the costs since most of the cost of having windows installed is the labor.......
  • Fix Windows Registry Error For many people who do not know that their computer has on it, a registry cleaner can be a great idea. Oftentimes, people have computers for a year and two, and then begin to experience slower speeds when they are using it. This is not usually a problem with the......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site