Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsSystem AdministrationAntivirus Protection

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #16  
Old February 8th, 2013, 02:14 AM
joe3321 joe3321 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jan 2013
Posts: 12 joe3321 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 21 m 38 sec
Reputation Power: 0
Uh, is anyone able to help me restore my computer to working condition? I'm getting the feeling my thread went dead... Hiker? Anyone?

Reply With Quote
  #17  
Old February 8th, 2013, 02:11 PM
salem's Avatar
salem salem is online now
Contributed User
Click here for more information
 
Join Date: Jun 2005
Posts: 3,838 salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)salem User rank is General 12nd Grade (Above 100000 Reputation Level)  Folding Points: 153 Folding Title: Novice Folder
Time spent in forums: 2 Months 3 Weeks 2 Days 17 h 44 m 22 sec
Reputation Power: 1774
Since your HJT log has a lot of these...
O23 - Service: Network Connections (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

and svchost.exe is one of those critical things for normal operation, then I think the following things should be considered.

1. Copy from a trusted source the svchost.exe file from another XP machine to this one.

2. If you have limited explorer functionality, and if you haven't done so already, make a backup of anything you want to keep. At this stage, you should consider the backup contaminated, so don't be in a rush to use it without going over it with several scanners at some point.

> I'm using a custom built desktop with windows XP operating system.
3. Probably on another machine.
Locate and download all the latest drivers for any hardware you've got installed in the machine.
Locate and download all the software which you currently use.
Locate and note any licence / registration information for any purchased software.
If you've been busy installing / uninstalling / updating for a number of years, there could be all sorts of detritus lying around, not to mention the left-overs of whatever malware made it onto your machine.

The reasonably safe thing to do next is buy another hard disk (almost certainly larger than the one you have, probably faster as well), re-install everything you need and then plug your old hard disk in as a slave. This can then be scanned purely as a data drive without letting any malware get any chance of running and hooking itself into the OS.

A clean OS with just what you currently need installed should be a lot more responsive.

One word of caution though.
Since you're running XP, there will be well over 100 updates when MS update finally kicks in.
You might try applying them in batches.
__________________
If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
If at first you don't succeed, try writing your phone number on the exam paper

Reply With Quote
  #18  
Old February 8th, 2013, 03:33 PM
DonR DonR is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Oct 2009
Posts: 462 DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)DonR User rank is Captain (20000 - 30000 Reputation Level)  Folding Points: 29722 Folding Title: Starter FolderFolding Points: 29722 Folding Title: Starter Folder
Time spent in forums: 2 Weeks 1 Day 23 h 30 m 43 sec
Reputation Power: 216
If you have a bootable XP CD, you can recover that missing file using the Recovery Console [along with the EXPAND command].
I'm sure you can find lots of tutorials, using google, to help you get into recovery console and on how to use the EXPAND command.

this link tells you how to get into recovery console >>LINK<<

Once in recovery console, and at the C:\ prompt, you will need to switch back to your cd/dvd drive letter [assuming X: here], then, cd to your i386 folder
Code:
cd x:\i386

then, issue this command to expand the svchost file into the correct place.
Code:
expand svchost.ex_ C:\Windows\system32\svchost.exe

Confirm by pressing Y for yes. Remove the CD.
Then, reboot into the OS with safemode ....goto Start>Run and issue the command "sfc /scannow" (without the quotes)..reinsert your XP cd and let it scan and replace whatever corrupted/missing files it finds.
Hopefully this will allow you to get an antivirus installed to let you scan/clean up your OS.

Otherwise, you will need to use salem's advice.
good luck.

Last edited by DonR : February 10th, 2013 at 11:08 AM.

Reply With Quote
  #19  
Old February 10th, 2013, 02:29 AM
joe3321 joe3321 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Jan 2013
Posts: 12 joe3321 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 1 h 21 m 38 sec
Reputation Power: 0
so i did like donR suggested and went and found the software for my svchosts. I installed it and things are all but back to normal. Having done so i've begun doing sticky's anti-virus walkthrough, the following are the logs that were generated:

malware-bytes:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.02.10.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Serain :: TJE-E221F6EFC6F [administrator]

2/10/2013 3:12:53 AM
mbam-log-2013-02-10 (03-12-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 204205
Time elapsed: 3 minute(s), 19 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|AntiMalware (Trojan.FakeMS) -> Data: "C:\Documents and Settings\All Users\Application Data\AntiMalware.exe" -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Documents and Settings\All Users\Application Data\AntiMalware.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

(end)

will update after restart

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationAntivirus Protection > Advanced version of moneypak virus, need some high-level help please

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap