Possible spyware?

plantman1 · Mar 3, 2007

My computer mysteriously would only boot to the
Windows welcome screen (even in safe mode) and go no
further after I walked away for a little while.
Reboots did not help. I rebuilt my PC, but I fear
that either something sneaked onto it during the
rebuilding process, or hid itself in one of the
manufacturer's hidden utility directories. Every
thing that I have scanned with so far seems to find
nothing, however, my firewall keeps popping up
warnings that it is blocking dns and Netbios packets,
specifically from one address (not mine) within the
subnet of my ISP (not from my provider either). My
firewall is constantly showing 2 copies of SVCHOST
comminicating with the world, but I don't know for
what. Even rootkit scanners don't show me anything
that I can say "this is what I need to fix" or "I'm
OK". I am afraid to put my data back on my PC, but I
also dread going through the long rebuild process
again. My scan with HIJACK this follows:

P.S. Can HiJackThis detect root kits?

Edit: Removed inline Hijackthis log

DavidGP · Mar 3, 2007

Welcome to Majorgeeks!

Multiple SVCHOST files in Task Manager is normal and you can have upto 5 or 6, and this is fine.

But to rule out malware as a culprit Hijackthis on its own is useless, its better to folllow the below steps and let the malware gurus here assess your security.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

Log in or Sign up

Possible spyware?

plantman1 Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member