system being overtaken

Hi, jack here, or rather his friend Diana. Jack's english really sucks big time ;)
For several days now his comp has been acting up. After me checking it, it appears that he has hijacking warnings all being logged , a keylogger a browser hijack and so on.. I tried as much as possible to get rid of it but i aint that good yet, not by long shot. I even downloaded stuff here to get rid of it all..please can you help him out?
I told him he could try in his best english and after in dutch. He doesn't even bother if someone would help out by actually getting in to his comp. He's kinda desperate and oh so pissed off. lol..I would..You can answer here or send him mail at [email protected]
I would very much apreciate any effort in helping him..so thank you in advance,
Diana. :D

Well I might as well start before somebody else does:

1) What OS are we dealing with?
2) What patch level is he at?
3) What AV and Spyware programs have been run?
4) What were the results? (names of things found)
5) Has he got back-ups? :D

More info is required for people here to start helping you/him out.

By the way, there are a lot of good people here that speak Dutch so if he has to communicate in Dutch, he will likely still get help.

Cheers:

Thank you for responding this quick :p
The thing is i just now checked and everything dissapeared, i wanted to check his log book too and i can't even get in to it...although what i can recall were warnings like: browser hijack; an application trying to get info about creditcards no. passwords and so on. his system breaks down all the time, he gets pages he never requested. i have to restart the comp to get more info on the warnings..oh man it is going to be a long night

OK Darl'in, take a deep breath and calm down. Please answer some or all of the questions I asked above and I am sure we (the community) will be able to help you out. Remember, it's just a computer, you can always build a new one. :D

Cheers:

"Takes a deep breath". Okay will do.
What he used: spyware removers; browser hijack recovery; keylogger stopper ( i had to disable it because i couldn't get anywhere); spyware begone, adware. he has no backups (aaahh) The warnings, system overtake, UNDIS user mode 1/0 Driver (file ndisuiwo.sys.
Application Hijacking has been detected
The application: C:\WINDOWS.0\system32\smss.exe try to launch another application: C:\WINDOWS.0\system32\wbem\wmiprvse.exe

The application hijacking could be something big to nothing.
www.neuber.com/taskmanager/process/wmiprvse.exe.html

This explains a little more about the file and if you scroll down to the comments, other people have posted about their findings after looking into files some worms manipulate.

Okay, zipc0de :)
Im trying to recover some data, to post here. Settings seemed to be altered ( and it wasn't me) and it might take a while before i can post more specific info. Thank you too :)

If you could follow the instructions here
then we will, at least, have a level playing field.

Just run the basic tools [in SAFE mode]
then run HJT, and save the results in a .txt file and post 'em here.

as stated prior, if Jack or yourself feel better 'speaking' in Dutch, then we Do have several members from that region, who will be able to help too .............

Also the questions from DjM
with some extra's too

OS
patch level
internet connection
amount of 'surf' time [exposure]
level of competance [yours AND Jack's]
time scale since this has been noticable
scale of potential loss [bank account / P2P / CC # / Jokes :p / thesis etc
your security routine
age of PC

Pax

and don't worry about the long nights ...............







that's what busted PC's were MADE for :D

Name the worms and jack has them in this comp..i need a break, been sitting in front of this comp for about 5 hours now, the good news he's back online and protected.. although. I will come online later with my own comp, to give you the requested details. You guys are the greatest and funny too :p, thank you so much and talk to you later. DjM, you have a great weekend and we'll catch up after the weekend. bye for now, Diana

If it's too much, and the data on the PC aint too important

clean install, on a new partition
start afresh
don't get too attached to a screen :p

Really its not much and clean install might be an option, since he already lost almost everything. This i got already: cable connection; online 10 hours every day. Time scale: 2 weeks. security routine: none ( changed that yesterday) all he used was @Home AV
age of pc: 2 months, except for video card and hard disk( both 1 year)

You should see me with my comp.. sometimes falling asleep with my head on the keyboard.
lol :D
Talk to you later, going home now..
bye Diana (yeasty-ginger)

CLEAN re-install

then introduce 'Jack' to a LART :D

I agree with foxyloxley, do clean reinstall (this what you will always do after 2 months; if you u use
windows, i suggest you learn and shift to a better platform like Linux,or *BSD)

Quote:

---

(this what you will always do after 2 months; if you u use windows, i suggest you learn and shift to a better platform like Linux,or *BSD)

---

That's the biggest load of crap I've seen posted in here in months. If someone posts trash like that it is best ignored.

cheers

I wrote it beacuse thats what most of the windows users do, tell me you were'nt a born windows
guru Relyt or were you, even you must have reinstalled windows a couple of times. I have been
runnind redhat linux 6.2 since 2000 on a server, it runs like heaven tell me how many
windows users or administrators can claim that.

Windows can be pretty stable, maybe not as stable as a few linux/BSD distributions, but its not that bad. As long as you keep virus software up to date, patch up the system, and don't look at porn/download files you don't know about it is a good user friendly system.

Hi guys :)

The box is in the clear, thank you all for your suggestions.




Mijn dank is groot en zal eeuwig duren ;)

Diana (yeasty-ginger)

Here's the latest on jack's box.
Used the advice here and everything is back to normal :)
My friend Jack is a happy man again,

xoxo

yeasty.

Quote:

---

Originally posted here by yeasty-ginger
Here's the latest on jack's box.
Used the advice here and everything is back to normal :)
My friend Jack is a happy man again,

xoxo

yeasty.

---

Good to hear, glad you could find some help here, welcome to the community.

Cheers:

Good Lord, some months later, this last message caught my eye. Sorry DjM thank you for your welcome words ;) How are you doing? Byebye, Ginger. :D

Hey guys, I think I sussed it:
OS - Bicycle
Patches - those little rubber ones
Problem - Puncture
Antivirus - polio on sugar cube and tetanus

He came of his bicycle and got a puncture.

I never realised "what OS" was such a hard question to answer.



Jon The fit head Front

I think you just just re-install and patch it upto date. If you are using windows - run the firewall.

Should any member wish to neg the ass off this idiot, I shall certainly have no objection :D

Err..............it was a belated, but polite reply to DjM

:)

Lawdy...a woman with a LART...that is soooo sexy.

:p

What is LART? What is a Woman?



Jonny Pimp

I used to be a real phony, Jonny. Used to tell my users "there are no stupid questions."

Now WE know that's not true...

;)

Quote:

---

I used to be a real phony, Jonny. Used to tell my users "there are no stupid questions."

---

Yes, that is true.................but the death penalty remains in force :p :D

The death penalty? I never looked at it that way, nigil.

I always thought of my job as "shoving in the knife."

:)

Quote:

---

The death penalty? I never looked at it that way, nigil.

---

No, I hadn't either, except for when someone accidentally gets my name wrong!!

........Kill Nihil Kill

Ok, found out what a LART was..............you geek




Jonny don't come round here with ya geeky ways and and ya uncouth social inadequacies Frond