re: Trojan is hiding there somewhere Sunday, July 17, 2005 at 7:06 pm Windows XP Annoyances Discussion Forum Posted by Tim (26 messages posted) Hi..ok did all that..... a few things of note>> 1- when deleting Local settings/temp I got a message saying both FRD62D and FR673A were system files and deleting could damage the whole system..so i left them for now. 2-I didnt have Viewpoint do delete in add/remove 3-didnt have AOLOpt.exe to delete 4-didnt have abd sightings of zyhatwb anywhere. Here is my log file..thank-you :-) Logfile of HijackThis v1.99.1 Scan saved at 9:59:39 PM, on 7/17/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\logonui.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\Program Files\Trend Micro\Tmas\Tmas.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Working internet\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [PopUpStopperFreeEdition] C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Program Files\Trend Micro\Tmas\Tmas.exe O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe On Sunday, July 17, 2005 at 6:13 pm, Falcon wrote: >The portions in bold are/may be random, and may have changed. > > Uninstall Viewpoint from Add/Remove Programs. > Download and update About:Buster. > Reboot to Safe Mode > Run About:Buster. > Check these entries in HijackThis and press Fix: > >R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank >R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245 >R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank >R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank >R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50245 >O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll >O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll >O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe >O4 - HKLM\..\Run: [AOL Messenger Optimized] AOLOpt.exe >O4 - HKLM\..\Run: [zyhatwb] C:\WINDOWS\zyhatwb.exe >O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\se.dll,DllInstall >O4 - HKLM\..\RunServices: [AOL Messenger Optimized] AOLOpt.exe >O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML > > > Delete these files and folders: > > C:\WINDOWS\zyhatwb.exe > C:\Documents and Settings\Administrator\Local Settings\Temp\ <-- Everything >in folder > AOLOpt.exe > C:\Program Files\Viewpoint\ > > > Reboot normally. > Run About:Buster again. > Post a fresh HijackThis log. > > >style="margin-left: 0; line-height: normal; color: black; font-size: medium"> > > > > > My Malware Removal Instructions > > > > Perform the following: > > > > Disable >System >Restore > > * > > > > > Perform an online >virus scan > > * > > > > * > > > * > > > * > > . > > > Download, update, and run these tools: > > Spybot >Search >& Destroy > > * > > > > > Lavasoft >Adaware > > * > > > > > CWShredder > > * > > > > Repeat as necessary until clean. > > > > If you still experience problems after doing these steps, download > HijackThis > > * > > and post a log to this forum. > > > To protect against reinfection, download and use these: > > If at all possible, I recommend that you use alternative software, particularly >web browsers > and email clients: > > > Web Browsers > > * > > > > * > > > * > > > > Email >Clients > > > * > > > * > > > > > If this is not a viable option, or for additional protection, use these: > > Javacool's >SpywareBlaster > > * > > > > > Javacool's >SpywareGuard > > * > > > > Malware-blocking >HOSTS file > > > * > > > > IE-SPYAD > > * > > , Internet Explorer only > > > > Optionally Reenable >System Restore > > * > . Better >alternatives > >to System Restore. > > > > If you encounter any broken links, please inform > me of them. Also note that these links direct through my web server to >allow me to keep them > up-to-date or post additional info. If you are unable to use the links above, >click the stars > instead, which are a direct link to the page in question. > > > > > > > Written in response to: re: Trojan is hiding there somewhere (Falcon: Sunday, July 17, 2005 at 6:13 pm) Responses to this message: re: Trojan is hiding there somewhere (Falcon: Sunday, July 17, 2005 at 7:32 pm) re: Trojan is hiding there somewhere (Rich Kurtz: Sunday, July 17, 2005 at 7:33 pm) All messages in this thread [show all] Trojan is hiding there somewhere (Tim: Thu, Jul 14, 2005, 8:53 pm) re: Trojan is hiding there somewhere (Ms. Eagle: Thu, Jul 14, 2005, 9:10 pm) re: Trojan is hiding there somewhere (Tim: Thu, Jul 14, 2005, 10:39 pm) re: Trojan is hiding there somewhere (Ms. Eagle: Fri, Jul 15, 2005, 9:42 am) re: Trojan is hiding there somewhere (Tim: Sat, Jul 16, 2005, 9:56 am) re: Trojan is hiding there somewhere (Ms. Eagle: Sat, Jul 16, 2005, 12:06 pm) re: Trojan is hiding there somewhere (Rich Kurtz: Sat, Jul 16, 2005, 10:36 am) re: Trojan is hiding there somewhere (Tim: Sat, Jul 16, 2005, 8:15 pm) re: Trojan is hiding there somewhere (Falcon: Sun, Jul 17, 2005, 6:13 pm) re: Trojan is hiding there somewhere (Tim: Sun, Jul 17, 2005, 7:06 pm) re: Trojan is hiding there somewhere (Falcon: Sun, Jul 17, 2005, 7:32 pm) re: Trojan is hiding there somewhere (Tim: Mon, Jul 18, 2005, 4:44 pm) re: Trojan is hiding there somewhere (Rich Kurtz: Sun, Jul 17, 2005, 7:33 pm) Reply or follow-up to this message Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows XP Discussion Forum