Jump to content
Sign in to follow this  
Followers 0
ApoKalypse

Netconfig.exe

By ApoKalypse, in Windows

Recommended Posts

ApoKalypse    1

ApoKalypse
Posted (edited)

untitledqm1.jpg

salam, bleh aku tau tak apakah benda yg dlm startup tu? aku dah delete sblm ni tp ada lg... location nya di C:\WINDOWS\netconfig.exe

Edited by ApoKalypse

Share this post

Link to post
Share on other sites

ApoKalypse    1

ApoKalypse
Posted

erk,virus ke??? benda ni even aku dah del dia kat startup tp dia akan ada balik lepas aku restart pc.... aku pakai kaspersky... mmg dah update...

Share this post

Link to post
Share on other sites

ApoKalypse    1

ApoKalypse
Posted

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 9:35:10 AM, on 6/15/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\netcmd.exe

C:\WINDOWS\system32\VTTimer.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

D:\Program Files\Internet Download Manager\IDMan.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\oodag.exe

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

D:\Program Files\Internet Download Manager\IEMonitor.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Webroot\Spy Sweeper\SSU.EXE

C:\Program Files\uTorrent\uTorrent.exe

D:\Program Files\Ufasoft\SocksChain\SocksChain.exe

C:\Documents and Settings\Administrator\My Documents\Downloads\Programs\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Thunder Browser Helper - {0055C088-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Thunder\ComDlls\xunleiBHO_Now.dll

O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll

O2 - BHO: ThunderAtOnce Class - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - D:\Program Files\Thunder\ComDlls\TDAtOnce_Now.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - D:\PROGRA~1\FlashFXP\IEFlash.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [VTTimer] VTTimer.exe

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\Run: [spySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray

O4 - HKCU\..\Run: [iDMan] "D:\Program Files\Internet Download Manager\IDMan.exe" /onboot

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKUS\S-1-5-19\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O4 - Global Startup: netconfig.lnk = C:\WINDOWS\netconfig.exe

O8 - Extra context menu item: Download All Links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm

O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll

O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)

O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{536CF224-6DEA-4D9B-B426-98DC5F3AD4E5}: NameServer = 202.188.0.133 202.188.1.5

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe

O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)

O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--

End of file - 7414 bytes

mmg ada AV lain detect virus...ni HijackThis log aku baru check..

AhnLab-V3 2007.6.12.2 06.14.2007 no virus found

AntiVir 7.4.0.32 06.14.2007 no virus found

Authentium 4.93.8 06.15.2007 no virus found

Avast 4.7.997.0 06.14.2007 no virus found

AVG 7.5.0.467 06.14.2007 PSW.Generic3.PGJ

BitDefender 7.2 06.15.2007 no virus found

CAT-QuickHeal 9.00 06.14.2007 (Suspicious) - DNAScan

ClamAV devel-20070416 06.15.2007 no virus found

DrWeb 4.33 06.14.2007 no virus found

eSafe 7.0.15.0 06.14.2007 no virus found

eTrust-Vet 30.7.3719 06.14.2007 no virus found

Ewido 4.0 06.14.2007 no virus found

FileAdvisor 1 06.15.2007 Low threat detected

Fortinet 2.85.0.0 06.15.2007 PossibleThreat

ni result dari VirusTotal...

Share this post

Link to post
Share on other sites

johnburn    6

johnburn
Posted

First, disable dulu protection SpySweeper sbb bleh ganggu hijackThis untuk remove entri2 bermasalah tu..

Jlnkan hijackThis dan tandakan entri2 berikut:

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O4 - Global Startup: netconfig.lnk = C:\WINDOWS\netconfig.exe

O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)

Download ibprocman

Jalankan aplikasi tersebut dan matikan process C:\WINDOWS\system32\netcmd.exe.

Pergi ke C:\WINDOWS\ dan delete netconfig.exe

Pergi ke C:\Windows\System32 dan delete netcmd.exe

Restart Pc dan scan dngn hijackThis dan pastekan log baru..

Share this post

Link to post
Share on other sites

johnburn    6

johnburn
Posted

bro johnburn, ko pernah kena virus ni ke? bahaya tak virus ni?

Aku tak penah kene..

Sori, arhn yg aku bg kat atas tu tak lengkap sbb aku nak cpt time tu.. :P

Ni yg lengkap:

First, disable dulu protection SpySweeper sbb bleh ganggu hijackThis untuk remove entri2 bermasalah tu..

Jlnkan hijackThis dan tandakan entri2 berikut:

O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Default user')

O4 - Global Startup: netconfig.lnk = C:\WINDOWS\netconfig.exe

O9 - Extra button: (no name) - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - (no file)

Tutup semua windows dan tekan butang 'Fix checked'

Download ibprocman

Jalankan aplikasi tersebut dan matikan process C:\WINDOWS\system32\netcmd.exe.

Pergi ke C:\WINDOWS\ dan delete netconfig.exe

Pergi ke C:\Windows\System32 dan delete netcmd.exe

Restart Pc dan scan dngn hijackThis dan pastekan log baru..

Share this post

Link to post
Share on other sites

ApoKalypse    1

ApoKalypse
Posted

NETCONFIG.exe adalah Trojan, tgk site bwh ni:

http://www.castlecops.com/s2432-netconfig.html

http://www.tasklist.org/task_netconfig_exe_2213.html

http://www.sysinfo.org/startuplist.php?let...&offset=150

http://fileinfo.prevx.com/fileinfo.asp?PXC=f14a56108101

*by the way,probs aku dah settle :lol:

Share this post

Link to post
Share on other sites

scorps    1

scorps
Posted

ApoKalypse, kenapa tak bagi je link nii :unsure:

http://forum.lowyat.net/topic/472932

dah boleh tutup nii

Share this post

Link to post
Share on other sites

ApoKalypse    1

ApoKalypse
Posted

scorps, bleh ke kasi link tu? bukan satu kesalahan ke? sbb mcm 'inviter' je...

*aku baru dlm forum ni so kena la jaga2...x salah kan aku tanya...

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
Sign in to follow this  
Followers 0
Go To Topic Listing
×
×
  • Create New...