Disinfecting a PC… part 2



Ok, the last post got a bit long with the hijackthis log, but I wanted to include the whole picture. I put a few comments in, but thought it might be useful to include the notes I took at the time. For starters I leave it unplugged from the network. (There is no network card in this machine.) It’s important when working on an infested PC to leave it isolated so that it can’t continue to spread viruses or spam or whatever it may be doing. Assume if it’s infested with something that it could be spewing out bad stuff. If you must, isolated it and prevent it from routing to the outside world… the safest is usually to leave the cable unplugged for the initial look over.


Left net cable off, Booted and looked – installer icon in system tray which disappeared before I could get a tooltip for it. Looks spywareish… webshots (didn’t they bundle with spyware at some point?) Looking at msconfig – jawa32 looks suspect. SurfSidekick 2 (ssk.exe), ssdpsrv.exe (???), ylgril.exe, C:Program FilesVBouncerVBouncerInner.exe /S, C:WINDOWSSYSTEMpuswxc.exe, c:windowssystemsaie.exe, C:WINDOWSGuqvqmm.exe, C:WINDOWSXecrtyr.exe, C:WINDOWSaqadcup.exe, C:WINDOWSgoidr.exe, C:Program FilesCommon Filesslmssslmss.exe,C:PROGRA~1BMCENT~1BMLauncher.exe.(?)

So, in the above I’ve highlighted the running processes or startup entries that I don’t recognize right off, or don’t seem normal.

Running hijack this… and analyzing… (Log was included in previous post.)
Several BHO’s
jawa32.exe looks to be a trojan backdoor.agent.bg ??
Looks fairly infested… installing AVG and updating.

Got spybot S&D, ad-aware and bhodemon in the wings…. just in case…

AVG failed install… It gave an error accessing the registry…

Local machine: installation failed
Initialization:
Error: Checking of state of the item registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionAvg7RunOnceParams failed.
The configuration registry database is corrupt. (1009)

Time to use a working networked pc…

Related Posts

Blog Traffic Exchange Related Posts
  • Windows XP Unable to Login After Cleaning Out Rogue Antivirus This article may come in handy if you are out there battling the latest rogue du jour. Occasionally I have been through a cleaning process for these rogues and got to a point where the scanner had run and cleaned things out (whether it was malwarebytes antimalware or superantispyware.) It......
  • Hard drive testing utilities Windows users know chkdsk, linux users know fsck... users of each MIGHT have heard of SMART. These are different ways of TESTING hard drives. Well, there's also a utility called TestDisk that looks promising for recovering data... Here's the clip from their site. "free data recovery software! It was primarily......
  • Cleaning up after WMF exploit - is it clean? So, I've got most of the baddies cleaned out and I'm not getting popups anymore. No nags on boot, the boot process is quicker, but is it really clean? I found a few files (winlogon.exe, alg.exe in particular) that could be legitimate windows file names. Am I running the good......
Blog Traffic Exchange Related Websites
  • Talking To Not At Your Readers Many corporate blogs fail simply because they strike a wrong chord with readers. If you want to use your blog to increase traffic and sales and improve your relations with the public, it is vital to develop a technique that will allow you to talk to your readers, not at......
  • How to Do Home Window Installation Replacing and installing windows can seem like a daunting and expensive task, but it can actually be incredibly simple to do yourself. When you do your own home window installation, you’ll be greatly cutting down on the costs since most of the cost of having windows installed is the labor.......
  • How to Stop Annoying Computer Error Messages Error pop-ups are annoying. They can cause our computers to freeze and crash, and reduce our productivity. I'm going to give you a three step process to deal with computer errors messages of varying degrees. No one step will work for every error so try them in order to determine......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site