I think I'm infected with Mapson.d

Computing.Net > Forums > Security and Virus > I think I'm infected with Mapson.d

I think I'm infected with Mapson.d

Original Message

Name: Eduardo
Date: November 3, 2003 at 08:13:55 Pacific
Subject: I think I'm infected with Mapson.d
OS: Windows XP Professional S
CPU/Ram: 512 MB

Comment:

I've tried everything, I have scanned my pc with norton antivirus updated, with panda online... with ad-aware 6.0, nothing, I can't find anything. I have done everything that says in Symantec website to remove mapson.d, but i can't find any of the files that I should have if my pc is infected (like ruxdll32.exe)... still my mail (edulozadahotmail.com) automatically send mass mails without my permission... mails like "teamo.pif", "thaliasex.pif"... I don't know what to do. Heres my log:
Logfile of HijackThis v1.97.3
Scan saved at 12:04:57 PM, on 11/3/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Eduardo\My Documents\Bajado\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.autoavisos.com/
N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Eduardo\Application Data\Mozilla\Profiles\default\be3vlr2s.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E9BEAD5-A8E7-494E-A1E5-A08195C92330}: NameServer = 200.58.160.25 200.58.161.25
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E9BEAD5-A8E7-494E-A1E5-A08195C92330}: NameServer = 200.58.160.25 200.58.161.25
Help me please!!!

Report Offensive Message For Removal

Response Number 1

Name: Tom41
Date: November 3, 2003 at 09:07:16 Pacific

Reply: (edit)

This entry is suspicious:
O4 - HKLM\..\Run: [mm_server] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_server.exe
Could you send me a zipped copy of mm_server.exe to analyze? click my name for the email addy..
Then run Hijack and fix that entry and reboot. For now, rename mm_server.exe to mm_server.old

Report Offensive Follow Up For Removal

Response Number 2

Name: Tom41
Date: November 3, 2003 at 09:27:49 Pacific

Reply: (edit)

Also go here and run an online virus scan and post the results:
RAV

Report Offensive Follow Up For Removal

Response Number 3

Name: Eduardo
Date: November 4, 2003 at 20:08:00 Pacific

Reply: (edit)

Hi, I've scanned my system... nothing...
Scan started at 11/4/2003 11:49:24 PM

Scanning memory...
Scanning boot sectors...
Scanning files...
Scanned
============================
Objects: 28880
Directories: 2110
Archives: 613
Size(Kb): -373325
Infected files: 0
Found
============================
Viruses found: 0
Suspicious files: 0
Disinfected files: 0
Mail files: 73

Report Offensive Follow Up For Removal

Response Number 4

Name: HossMonkey
Date: December 17, 2003 at 11:39:04 Pacific

Reply: (edit)

mm_server.exe is part of Music Match Jukebox.
Did you ever fix the problem? You should always come back & say what you did to resolve the problem so other peeps can correct the issue?

Report Offensive Follow Up For Removal


I think I'm infected with ?? Am I infected with Netbus? I Think I have A Virus I think I'm infected with something I-Worm/BadTrans Infection	Problem, think I have a virus Servic~1.exe, how do I get rid of i I am infected with UnSpyPC please h I think I might have virus I have a virus that will not delete

Heads UP-Read All

dreaded blue screen of de...

Use following form to reply to current message:

Name: From My Computing.Net Settings E-Mail: From My Computing.Net Settings Subject: I think I'm infected with Mapson.d

Comments:

  Homepage URL (*): 
Homepage Title (*): 
         Image URL:

Have you ever used OpenOffice?

Poll Finishes In 5 Days.
Discuss in The Lounge

Error 0701: USB Over Current On

Booting from disk isn't working

Dos on disk-on-module

IE & Firefox showing old website

Delgated authentication

All Posts Awaiting Replies