Malware Removal Forums

please help to get rid of this

stranger666 · 2005-06-16T22:51:16+00:00

Hi All! Recently I picked up some malware - every now and then the message box would come up saying "WARNING: Windows Firewall detected suspicious network activity on your computer. Malicious software codes try to steal your privacy information, such as credit card numbers, electronic mail accounts, financial data or passwords. Do you want to learn how to protect your computer?" Could someone tell me how to get rid of it? This is my hijackthis log: Logfile of HijackThis v1.99.0 Scan saved at 6:51:55 PM, on 6/16/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Fi

12 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

wng_z3r0 Admin/Teacher Emeritus

June 26, 2005, 4:55 AM UTC

I KNOW what ICQ is, but malware loves to hide as legitimate names.
I see no reason for icq.exe to have all these ports open:
1069, 3670, 1069 205.188.5.228:5190 ESTABLISHED, UDP MAIN:1039 *:* 1216

and 205.188.5.228
is whois'd to an AOL account, but why should that be happening?

ANYWAYS: please search and tell me the info of icq.exe

Thanks.
wng

stranger666

June 26, 2005, 10:53 PM UTC

OK, here it is (I hope that is what you meant)
Location: C:\Programs\Inet\ICQ\icq.exe
File Version: 5.5.6.3916
Company: ICQ Inc
Created: Wednesday, May 25, 2005, 6:12:25 PM
Modified: Tuesday, October 14, 2003, 1:03:50 PM
Accessed: Today, June 26, 2005, 6:47:53 PM

That should be it.... What's next?

wng_z3r0 Admin/Teacher Emeritus

June 29, 2005, 12:18 AM UTC

sorry for the delay

google doesn't like the location ICQ is running from:
http://www.google.com/search?q=C:\Programs\Inet\ICQ\icq.exe

Do you know anything about this Inet?

edit: also, when did you install ICQ on your computer?

stranger666

June 29, 2005, 1:50 AM UTC

Yep, the location is quite normal. I install all my programs in the Programs folder, which then gets divided into Inet, Utilities, Image etc.. So the location is fine.
The date is OK as well - I recently reinstalled the whole system, including ICQ.
So I don't think my poor internet pager was hacked by the wicked virus.

wng_z3r0 Admin/Teacher Emeritus

June 29, 2005, 3:19 AM UTC

ok. just checking

I dunno what's causing the prompts. If I were to guess, it would be kazza lite.

I will ask around... perhaps someone sees something I dont.
wng

stranger666

June 29, 2005, 3:36 AM UTC

Doubtful. I've been using Kazaa for a long time, never had a problem. And all this stuff started happenning right after I visited some sites looking for cracks - so it is a virus (or spyware), not a program, that causing all this to happen.

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.