Unsolved
This post is more than 5 years old
1 Rookie
•
44 Posts
0
6929
April 21st, 2004 16:00
I think someone else is connecting into my computer remotely...
Hi all.
Last night my laptop was acting a bit odd. I have gotten in the habit of updating my NAV just about every time I'm online, and last night I did a system scan. It caught some virus, I forget which, and then, I kept getting popups for some .exe virus.
Sorry, I'm not at home and didn't write down the name.
Anyhow, I went to shut off my computer, and a windows message popped up that said "There are 1 or more users connected to your system. Shutting down will disconnect them"
What's up with that? Is someone logging into my system remotely???
What should I do? What software can I use to detect and eliminate such threats??
Thank you for your help!
No Events found!
Tull Fan
75 Posts
0
April 21st, 2004 18:00
That message appears when you shut down a computer that is connected to a network, and someone else is still logged on the network. Do you have your laptop connected to a home network with other computers?
Dimension 8200
Pentium 4, 3.06GHz w/ HT
1GB RDRAM
Win XP Pro, SP1
64MB GeForce4 MX with TV-Out
80GB WD ATA100 hard drive
120GB WD Caviar "JB" hard drive
ADS Pyro 1394 card
Canopus ADVC-100
Adobe Premiere Pro
Samsung 48X CD-ROM SC-148C
Philips DVD+RW/+R D28
Creative SB Live! audio card
Dimension 4600
Pentium 4, 2.60GHz w/ HT
512MB DDR SDRAM
Win XP Pro, SP1
17 in. Digital Flat Panel Display
64MB GeForce4 MX with TV-Out
80GB WD Ultra ATA HD
16X DVD-Rom Drive
48X CD-RW Drive
Creative SB Live! audio card
Message Edited by Tull Fan on 04-21-2004 03:11 PM
Tull Fan
75 Posts
0
April 21st, 2004 18:00
Do you have multiple user accounts set up on your computer? If you do, you may have accidentally logged on to your system as a different user.
Strati
1 Rookie
•
44 Posts
0
April 21st, 2004 18:00
Strati
1 Rookie
•
44 Posts
0
April 21st, 2004 19:00
No, I do not have multiple user accounts. I have win98, which I don't think even supports that.
Any other ideas?
Thank you for your help so far!
Strati
1 Rookie
•
44 Posts
0
April 22nd, 2004 01:00
Ok. I just got home and checked, and the file that kept tripping NAV was: wuapd.exe located in My Documents.
I have five wuapd.exe files in quarantine.
Anyone know what it is?
Thanks!
Strati
1 Rookie
•
44 Posts
0
April 22nd, 2004 04:00
Logfile of HijackThis v1.97.7
Scan saved at 10:55:28 PM, on 4/21/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\PANORAMA\PANORAMA.EXE
C:\WINDOWS\START MENU\PROGRAMS\ACCESSORIES\DESKTOP.EXE
C:\PROGRAM FILES\UNITED DEVICES\UD.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\UNITED DEVICES\UD_1396140.EXE
C:\PROGRAM FILES\UNITED DEVICES\UD_1396140_0.DIR\UD_LIGFIT_RELEASE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\ARCSOFT\PHOTOSTUDIO 5\PHOTOSTUDIO.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\HJT\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [AIM] C:\PROGRAM FILES\AIM95\aim.exe -cnetwait.odl
O4 - Startup: Panorama 32.lnk = C:\Program Files\Panorama\Panorama.exe
O4 - Startup: Shortcut to DeskTop.exe.lnk = C:\WINDOWS\Start Menu\Programs\Accessories\DeskTop.exe
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
O4 - Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/23b00e7f36a5a47b0904/netzip/RdxIE601.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k42037/sb028.cab
jwatt
4.4K Posts
0
April 22nd, 2004 04:00
Download, install, and run HijackThis as described in the first link listed below. Post the HijackThis log in this thread.
Is your connection to the Internet protected by a firewall? If not, you should consider the information in the link " Are you running a firewall? You should be!" listed below.
Jim
Strati
1 Rookie
•
44 Posts
0
April 22nd, 2004 04:00
The other file that keeps tripping my Norton is navpxaw32.exe
I have seven of those files in quarantine, in addition to 5 of: wuapd.exe
Anyone have any idea what either of these are?
jwatt
4.4K Posts
0
April 22nd, 2004 05:00
The HijackThis experts are probably all asleep right now. ChrisRLG (UK) will likely spot this one first.
I attempted to locate any references to navpxaw32.exe, and only found one searching Google groups. Unfortunately, I don't know what language this is!
Jim
Texruss
2 Intern
•
3.4K Posts
0
April 23rd, 2004 13:00
Re: wuapd.exe Probably a randomly named Trojan file recently seen on the Net. The other file also is likely the same..I didn't look for it.
Looking at your log I see only one malicious threat:
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/23b00e7f36a5a47b0904/netzip/RdxIE601.cab
Netster (full registry editing removal instructions for advanced users at Pest Patrol)
For average users: Check that 016 malicious ActiveX script in Hijackthis, with no other windows open fix checked. If you go to that site again you will reaquire the entry and action.
As for the network messages:
O4 - Startup: UD Agent.lnk = C:\Program Files\United Devices\UD.EXE
The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start -> Programs
There are several HJT entries for United Devices, I just pasted one and a description of the service. It's possible it is complaining when you shut down...not sure, just a guess. Uninstall United Devices in Add/Remove Programs to check this out.
Texruss