Very Very worried

Unknown
edited July 2004 in Spyware & Virus Removal
I was on some other forums.. where someone gave a link to this website. I foolishly clicked it thus making lots of adverisements come up on the screen.
I quickly got rid of these however, norton came up with a warning saying that i have been infected by a virus (i forgot what it was called :( )

I quit all the windows that were brought up, got off internet explorer and checked if my browser had been hijacked. It hadent, i checked if i have been infected with a key logger, i hadent, i checked if i had adware on my PC, i hadent, i did a full system scan on norton, nothing came up.

Nothing seems out of the ordinary on my pc, but im very worried about that notice that norton said at the time it was happening.

Advice please? :(

Comments

  • shwaipshwaip bluffin' with my muffin Icrontian
    edited July 2004
    Can you give us a link to where you got the link to these forums (the one that caused the popups/etc)?

    Short-Media is dedicated to helping people remove computer problems, not infect them.

    If you'll run hijackthis, available from the first link in my sig, we'll take a look at it and make sure there are no problems on your computer.
  • gin999
    edited July 2004
    Here is the HJT log, from what i see there is nothing out if the ordinary, as i say there doesent seem to be anything wrong with my pc atm, but norton did pick somthing up. however on subsequent scans norton picks nothing up.

    As for the forum link, the thread was deleted by a moderator :S


    Logfile of HijackThis v1.97.7
    Scan saved at 15:30:40, on 31/07/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\GetRight\getright.exe
    C:\Program Files\GetRight\getright.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Archives\HijackThis.exe

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe
    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited July 2004
    Looks good.

    Getright used to have spyware in it...but it's supposedly clean now.
  • gin999
    edited July 2004
    someone posted the link on forum.mythofsoma.net

    However the post is gone now, moderators deleted it
  • gin999
    edited July 2004
    So should i not be worried that norton picked up a virus when i clicked the link.

    And that when i ran a propper norton scan nothing came up?

    Should i not be worried m8?
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited July 2004
    Nah...if norton detected it, it most likely did not install anything, or if it did, norton removed it. The virus-free system scan is also a good sign.
  • gin999
    edited July 2004
    Ok thanks for the help m8, fast, helpful replies are what i like to see, and its very reasuring that helpful people like you are around ;)

    Thanks alot :)
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited July 2004
    glad to help. make sure to check out our other forums as well, especially the folding forum:

    http://www.short-media.com/forum/forumdisplay.php?f=14

    If you have a new infection, please start a new thread. If you have problems related to this, please PM a mod, and we'll re-open the thread.
This discussion has been closed.