Re: IRC Packets being generated. Dont know where from...
From: David H. Lipman (DLipman~nospam~_at_Verizon.Net)
Date: 04/27/05
- Next message: Dean J Garrett: "Re: lsass.exe?"
- Previous message: Scooter: "IRC Packets being generated. Dont know where from..."
- In reply to: Scooter: "IRC Packets being generated. Dont know where from..."
- Next in thread: Scooter: "Re: IRC Packets being generated. Dont know where from..."
- Reply: Scooter: "Re: IRC Packets being generated. Dont know where from..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 26 Apr 2005 18:29:12 -0400
From: "Scooter" <scott@serra.com>
| I have a PC that is generating IRC Query packets on our network.
| I've turned off all the services it will let me and its still there.
| If I boot into Safe mode it does not send the packets.
| I've included a copy of the Packet and a HiJackThis Log...
|
|
| HELP! |
< snip >
|
| ----------------------------------------------------
| HiJackThis Log
| ----------------------------------------------------
| StartupList report, 4/26/2005, 2:46:19 PM
| StartupList version: 1.52
Scooter:
This is NOT the place for a HJT log and from what your log states it is an OLD version.
The following are HJT Log Parsers..
http://hjt.iamnotageek.com/
http://www.hijackthis.de/en
I do suggest you perform the following...
Dump the contents of the IE Temporary Internet Folder cache (TIF)
Start --> Settings --> Control Panel --> Internet Options --> Delete Files
Dump the contents of the Mozilla FireFox Cache
Tools --> Options --> Privacy --> Cache --> Clear
1) Download TrendMicro Sysclean by one of the following 2 methods
Trend Sysclean Method 1
---------------------------------------
Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp
Latest Trend signature files.
http://www.trendmicro.com/download/pattern.asp
Create a directory.
On drive "C:\"
(e.g., "c:\sysclean")
Download SYSCLEAN.COM and place it in that directory.
Download the signature files (pattern files) by obtaining the ZIP file.
For example; lpt600.zip
Extract the contents of the ZIP file and place the contents in the same directory as
SYSCLEAN.COM.
Trend Sysclean Method 2
---------------------------------------
Download the utility SYSCLEAN_FE at the following URL --
http://www.ik-cs.com/got-a-virus.htm
SYSCLEAN_FE automates the download and execution process of the Trend Sysclean Package.
Direct URL --
http://www.ik-cs.com/programs/virtools/Sysclean_FE.exe
2) Download and install Ad-aware SE (free personal version v1.05)
http://www.lavasoftusa.com/
3) Update Adaware with the latest definitions then exit the software.
4) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
5) Reboot your PC into Safe Mode and shutdown as many applications as possible
6) Using the Trend Sysclean and Ad-aware SE utilities, perform a Full Scan of your
platform and clean/delete any infectors found
7) Restart your PC and perform a "final" Full Scan of your platform using both Trend
Sysclean and Ad-aware SE
8) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
9) Reboot your PC.
10) Create a new Restore point
* * Please report back your results * *
-- Dave http://www.claymania.com/removal-trojan-adware.html http://www.ik-cs.com/got-a-virus.htm
- Next message: Dean J Garrett: "Re: lsass.exe?"
- Previous message: Scooter: "IRC Packets being generated. Dont know where from..."
- In reply to: Scooter: "IRC Packets being generated. Dont know where from..."
- Next in thread: Scooter: "Re: IRC Packets being generated. Dont know where from..."
- Reply: Scooter: "Re: IRC Packets being generated. Dont know where from..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
