I am gonna SCREAMMMMM

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by FreethinkerX, Jun 14, 2004.

  1. FreethinkerX

    FreethinkerX Private E-2

    :eek: Below is my dos prompt...i am having problems....
    it reads:

    C:\Documents and Settings\Administrator>

    and when i try to change directories it goes right back to this....

    C:\Documents and Settings\Administrator>dir

    06/13/2004 02:47a <DIR> .
    06/13/2004 02:47a <DIR> ..
    06/01/2004 12:06a <DIR> .jpi_cache
    06/13/2004 11:09p <DIR> Desktop
    06/13/2004 02:35p <DIR> Favorites
    06/13/2004 02:46p <DIR> My Document
    05/15/2004 10:05p <DIR> Start Menu
    0 File(s) 0 bytes
    7 Dir(s) 17,672,814,592 bytes free

    like i have a directory called . or .. :mad:

    Can anyone lend me a hand??? i believe that the iexplorer has caught one of those nasty pests....lol....grrrrrr

    here is my Logfile of HijackThis HELP PLEASE!!!!

    Logfile of HijackThis v1.97.7
    Scan saved at 2:49:42 PM, on 6/13/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    D:\Program Files\Norton Personal Firewall\NISUM.EXE
    D:\Program Files\Norton Personal Firewall\ccPxySvc.exe
    D:\Program Files\NavNT\defwatch.exe
    C:\WINNT\system32\svchost.exe
    D:\Program Files\NavNT\rtvscan.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\system32\Tablet.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\MsgSys.EXE
    C:\WINNT\Mixer.exe
    D:\PROGRA~1\NavNT\vptray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    D:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
    C:\WINNT\system32\Wtablet\TabUserW.exe
    D:\Program Files\Hewlett-Packard\hp psc 700 series\FRU\Remind32.exe
    d:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
    C:\WINNT\system32\hpoipm07.exe
    d:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Documents and Settings\Administrator\My Documents\New Folder\HijackThis.exe
    N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\40ur9jrz.slt\prefs.js)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - d:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [vptray] D:\PROGRA~1\NavNT\vptray.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\system32\spool\DRIVERS\W32X86\hpoopm07.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKCU\..\Run: [ATI Launchpad] "D:\Program Files\ATI Multimedia\main\LaunchPd.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] d:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Hewlett-Packard Recorder.lnk = D:\Program Files\Hewlett-Packard\hp psc 700 series\FRU\Remind32.exe
    O4 - Global Startup: HPAiODevice.lnk = D:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
    O4 - Global Startup: TabUserW.exe.lnk = C:\WINNT\system32\Wtablet\TabUserW.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: ATI TV (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: ICQ 4.0 (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://support.charter.com/sdccommon/download/tgctlcm.cab
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    FreethinkerX, Jun 14, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Nice avitar Free!

    Yes you do have a directory called . and ..
    . is short for "the current directory"
    .. is short for "back up one directory level"

    So if you were in c:\windows\system and did a DIR:
    . = c:\windows\system
    .. = c:\windows

    What exactly are you entering on the command line to change directories?
     
    chaslang, Jun 14, 2004
    #2
  3. FreethinkerX

    FreethinkerX Private E-2

    cd c:/>

    isn't it suposed to open with c:/> ?? ???


    and thankx for the compliment! *blushing* lol
     
    FreethinkerX, Jun 14, 2004
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    So you are running from a command prompt. Right?

    Do not use / use \

    Example: cd c:\
     
    chaslang, Jun 14, 2004
    #4
  5. FreethinkerX

    FreethinkerX Private E-2

    i see.....i thougth that the dos prompt was suposed to open at c:

    no i was doing a netstat and ipconfig to see what my network was up to! lol i thougth i had a nasty pest and deleted a file called .plugin141_02.trace....woops....go ahead and say it....lol...it's suposed to be there eh?

    can you read my HijackThis log and see if all is well?....when you have the time of course!

    Thankx so much for all your help!
     
    FreethinkerX, Jun 14, 2004
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you having any particular problems? I will take a quick look at the log now but I gotta go get some sleep so it will be a real fast look.
     
    chaslang, Jun 14, 2004
    #6
  7. FreethinkerX

    FreethinkerX Private E-2

    you too sweet! nah you can do it some other time....i don't want to keep you from your beauty sleep....lmao...

    i have just put a new network up and i used to live with a master hacker and i know he is capable of just about anything....and i don't want him *sneaking* in my network....so any little thing and i am thinking he is in the network....see???

    thank God i know how to network and wipe and clean all the machines here.....any suggestions for a *private* (at least i am a E-2)??? lol.....

    Thanks again for all your help Sergeant Major chaslang!
    *huggles* Free
     
    FreethinkerX, Jun 14, 2004
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Jun 14, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your welcome! I saw a firewall. That's good. I see no virus scanner, that's bad. Here's a good free one, AVAST! Home: http://www.majorgeeks.com/download1968.html
     
    chaslang, Jun 14, 2004
    #9
  10. FreethinkerX

    FreethinkerX Private E-2

    no virus scanner??? like you mean norton corp? i have that installed and running on all the machines....
     
    FreethinkerX, Jun 14, 2004
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yeah! Okay I do see a bunch of Norton/Symantec stuff there. I told you it was bed time. LOL. My eyes are failing.
     
    chaslang, Jun 14, 2004
    #11
  12. FreethinkerX

    FreethinkerX Private E-2

    goto B:>ed

    *winks*
     
    FreethinkerX, Jun 14, 2004
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds