I got home to my parents and the computer is just a mess. I´m starting to get i together now, but I still have some problems.
The computer is Windows Xp, 598 MHz, 128 Ram and tiny 4 Gb hardrive.
When I first got home lsass complained when I logged on to internet, and a few minutes later it wanted to shut the computer down in 60 seconds. I couldn´t download safetyupdates from microsoft either. I think it was w32/Sdbot.worm.gen that caused the problems and I managed to get rid of it with McAfee Stinger. So I have managed to update from Microsoft and the lsass and shutdownproblems is gone.
Also commercial about how my computer was infected with spyware and I should get this and that to protect me was coming thorugh windows messenger. I took away this with Shootthemessenger.
I downloaded Sygate Personal Firewall and tried to install it. But it can´t be done. Windows Installer doesn´t work. I see a file seems to be missing according to Hijackthis. So is it just to download it or do I need to reinstall Windows Installer and how do I do that then?
Now I have ZoneAlarm as firewall instead, and SystemReg16.exe wants to connect. What file is that? What does it do? I can´t find any information about it.
And of course, if you find anything else wrong in the log, I´m grateful if you tell me.
Logfile of HijackThis v1.99.0
Scan saved at 20:06:59, on 2004-12-24
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\Messenger\msmsgs.exe
C:\WINDOWS\System32\SystemReg16.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Håkan\Lokala inställningar\Temp\Temporär katalog 1 för hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login1.telia.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - HKLM\..\Run: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKLM\..\Run: [MS Office32cb Startup] OfficeGUI32cb.exe
O4 - HKLM\..\Run: [Registry Checkup System32cd Monitor] Winregs32cdn.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] Winregs32.exe
O4 - HKLM\..\RunServices: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKLM\..\RunServices: [MS Office32cb Startup] OfficeGUI32cb.exe
O4 - HKLM\..\RunServices: [Registry Checkup System32cd Monitor] Winregs32cdn.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKCU\..\Run: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Windows Installer - Unknown - C:\DOCUME~1\HKAN~1\LOKALA~1\Temp\IXP000.TMP\MsiExec.exe (file missing)
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
The computer is Windows Xp, 598 MHz, 128 Ram and tiny 4 Gb hardrive.
When I first got home lsass complained when I logged on to internet, and a few minutes later it wanted to shut the computer down in 60 seconds. I couldn´t download safetyupdates from microsoft either. I think it was w32/Sdbot.worm.gen that caused the problems and I managed to get rid of it with McAfee Stinger. So I have managed to update from Microsoft and the lsass and shutdownproblems is gone.
Also commercial about how my computer was infected with spyware and I should get this and that to protect me was coming thorugh windows messenger. I took away this with Shootthemessenger.
I downloaded Sygate Personal Firewall and tried to install it. But it can´t be done. Windows Installer doesn´t work. I see a file seems to be missing according to Hijackthis. So is it just to download it or do I need to reinstall Windows Installer and how do I do that then?
Now I have ZoneAlarm as firewall instead, and SystemReg16.exe wants to connect. What file is that? What does it do? I can´t find any information about it.
And of course, if you find anything else wrong in the log, I´m grateful if you tell me.
Logfile of HijackThis v1.99.0
Scan saved at 20:06:59, on 2004-12-24
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Grisoft\AVGFRE~1\avgcc.exe
C:\Program\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program\Messenger\msmsgs.exe
C:\WINDOWS\System32\SystemReg16.exe
C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Håkan\Lokala inställningar\Temp\Temporär katalog 1 för hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login1.telia.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - HKLM\..\Run: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKLM\..\Run: [MS Office32cb Startup] OfficeGUI32cb.exe
O4 - HKLM\..\Run: [Registry Checkup System32cd Monitor] Winregs32cdn.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\Program\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe
O4 - HKLM\..\RunServices: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] Winregs32.exe
O4 - HKLM\..\RunServices: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKLM\..\RunServices: [MS Office32cb Startup] OfficeGUI32cb.exe
O4 - HKLM\..\RunServices: [Registry Checkup System32cd Monitor] Winregs32cdn.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Registry System16 Checkup Monitor] SystemReg16.exe
O4 - HKCU\..\Run: [WindowsRegKey upd4te2d4te] IEEXPLORE.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\MSMSGS.EXE
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\Program\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Windows Installer - Unknown - C:\DOCUME~1\HKAN~1\LOKALA~1\Temp\IXP000.TMP\MsiExec.exe (file missing)
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe