Interview Question in Service Packs and Patches


 

Interview Question :: Packed.Generic.180


I am fed up with Packed.Generic.180, please help...

Below is the Hijack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:21 AM, on 9/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch...
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan....
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Netbooster Client\Client\ventc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Netbooster Client\squid\ventcsquid.exe
C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Netbooster Client\squid\ventcunlinkd.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\AutoProtect\DrvMonitor.exe
C:\Program Files\DNA\btdna.exe
C:\Documents and Settings\siddhart\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://assistmypc.googlepages.com/index....
O2 - BHO: (no name) - {43F247ED-E81B-4B51-826F-FBF2E2894F15} - C:\WINDOWS\system32\jkkJyXqq.dll
O2 - BHO: {8a05129c-dce9-6148-0de4-2304810b31e5} - {5e13b018-4032-4ed0-8416-9ecdc92150a8} - C:\WINDOWS\system32\lhxsew.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [a80ad716] rundll32.exe "C:\WINDOWS\system32\vmflglsa.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WinUpdater AutoRun] C:\AutoProtect\DrvMonitor.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\siddhart\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.4.15.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.4.15.0\gears.dll
O10 - Unknown file in Winsock LSP: vwlsp.dll
O10 - Unknown file in Winsock LSP: vwlsp.dll
O10 - Unknown file in Winsock LSP: vwlsp.dll
O10 - Unknown file in Winsock LSP: vwlsp.dll
O20 - AppInit_DLLs: lhxsew.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.e...
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Update Service (gupdate1c899952ff71f2) (gupdate1c899952ff71f2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.E...
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates,
Answers to "Packed.Generic.180 "
RE: Packed.Generic.180 ?

Your machine is infected.



Here are the some of the trouble spots:



O2 - BHO: (no name) - {43F247ED-E81B-4B51-826F-FBF2E2894F15} - C:\WINDOWS\system32\jkkJyXqq.dll

O2 - BHO: {8a05129c-dce9-6148-0de4-2304810b31e5} - {5e13b018-4032-4ed0-8416-9ecdc92150a8} - C:\WINDOWS\system32\lhxsew.dll

O4 - HKLM\..\Run: [a80ad716] rundll32.exe "C:\WINDOWS\system32\vmflglsa.dll",b

O10 - Unknown file in Winsock LSP: vwlsp.dll

O10 - Unknown file in Winsock LSP: vwlsp.dll

O10 - Unknown file in Winsock LSP: vwlsp.dll

O10 - Unknown file in Winsock LSP: vwlsp.dll

O20 - AppInit_DLLs: lhxsew.dll



Use something like autoruns to disable the startup of lhxsew.dll, vmflglsa.dll, and vwlsp.dll. Simply uncheck the box next to their entries.



After rebooting, make sure you have an updated antivirus and scan your machine. If the antivirus misses any of these files, manually delete them yourself.



You can perform online virus scanning, as well:



http://housecall.trendmicro.com/

http://security.symantec.com/sscv6/defau...

http://www.kaspersky.com/virusscanner
 
Vote for this answer ::  
Update Alert Setting