TechSpot

Got a Remon.sys, need help..

By morpeous03
Sep 23, 2005
  1. Hi RealBlackStuff,

    --- from your last messaged to me..
    Follow these instructions EXACTLY
    How to remove Begin2Search/Coolwebsearch and Other Nasties

    Then see How to post your Hijackthis log-files as an attachment.

    And read a few of the other Rootkit posts!
    -------

    I have followed the steps but still, I got the file "c:\windows\system32\remon.sys". And also I read some of your post about Rootkits, none of those files exist in my pc.

    Please help me, my pc is really becoming problematic since I got this virus.
    unable to sent files and download files, and frequently I need to shut it down.

    -- another problem, I can't attached my HJT log file.. I keep getting 'BAD Request - Your browser sent a request that this server could not understand Apache Server at www.techspot.com Port 80"

    Can you please make this thread as an exemption and please kindly look at my log. Thanks
    ----------------------------
    Logfile of HijackThis v1.99.1
    Scan saved at 11:20:59 PM, on 9/23/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\javapanel.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hot-searches.com/index.php?v=6&aff=7826020
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.0.0.1:8080
    O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
    O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
    O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
    O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll (file missing)
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
    O23 - Service: ECA (cpanel) - Unknown owner - C:\WINDOWS\javapanel.exe
    O23 - Service: Apache Tomcat (Tomcat5) - Unknown owner - C:\Program Files\Apache Software Foundation\Tomcat 5.0\bin\tomcat5.exe" //RS//Tomcat5 (file missing)
     
  2. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    See the 'modified' log, with only the 'baddies' left.

    Get rid of Flashget, riddled with adware. Go to www.stardownloader.com and get their free StarDownloader instead.

    javapanel is the main baddie.

    And Hijackthis can and will do ABSOLUTELY NOTHING for or against rootkit infections!
     
  3. morpeous03

    morpeous03 TS Rookie Topic Starter

    Thanks man for the quick reply.... I'll try it ... thanks again...
     
  4. Mahzer

    Mahzer TS Rookie

    Definately know that renom.sys all to well myself.. And know it is the roottool.toolkit hack.. From what I have seen on here in posting and, and from what I have used so far, that it is a pretty nasty lil thing.. I had the pop ups from Norton Anti about it.. And did go and get Spybot and Hi jack.. and both have seemed, so far, to take care of the problem.
    Hope it has worked out for you as well.

    But the way I see it.. if someone REALLY wants to to get into my system.. I know there isn't much there for them to look at. lol

    Hope your solutions worked too
     
  5. morpeous03

    morpeous03 TS Rookie Topic Starter

    Works like a charm.. thanks you so much..-- remon.sys was gone..
     
  6. morpeous03

    morpeous03 TS Rookie Topic Starter

    can you suggest which virus protection program should I use.. currently Norton Anti-virus program is installed in my PC.. I'm thinking of uninstalling NAV and start using AVG Anti-virus.. do you think that would be a good move?
    Thanks for the help again!
     
  7. RealBlackStuff

    RealBlackStuff TS Rookie Posts: 6,503

    Yeah, screw Norton and get AVG, best thing ever you could do for your PC.
    Also get a Firewall, free from http://soho.sygate.com
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...