Tip: Run a free scan for common Windows errors ad

re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 9:13 am Posted by mojo7819 (5744 messages posted) Download, install, UPDATE, and run: Ad-Aware 6.0 Spybot Search & Destroy SpywareGuard Spyware Blaster (Make sure to use the update feature of these programs often.) Download UPDATE and run: CWShredder It is important to run ALL of these programs, as each do something different. Before running these, do the following: Delete temp internet files and history. Disable system Restore. When finished, Turn system Restore back on. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 9:45 am Posted by Kenneth (57 messages posted) Download HjackThis Scan Save Log Post log to your message [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 10:05 am Posted by mojo7819 (5744 messages posted) If he runs the tools I suggested, and cleans his system, there is no need to post the HJ log. If, AFTER he follows these step, the problem remains, THEN post the log. In other words, don't post it until you have tried all steps to clean up the puter. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 10:06 am Posted by hschmeath (2 messages posted) Here is my HijackThis log! Logfile of HijackThis v1.97.7 Scan saved at 12:02:57 PM, on 5/2/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Dell\Support\Alert\bin\DAMon.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe C:\Program Files\Lavasoft\Ad-aware 6\Ad-aware.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Heath\Local Settings\Temporary Internet Files\Content.IE5\4BKGDAQZ\HijackThis[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://smbusiness.dellnet.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll O2 - BHO: (no name) - {CCCE1683-C924-49E9-8EA0-14D4522A6C44} - C:\WINDOWS\System32\aphnho.dll O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: AIM (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: Yahoo! Chat 1.3 - http://cs8.chat.sc5.yahoo.com/c174/chat.cab O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup141.cab O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 10:12 am Posted by mojo7819 (5744 messages posted) Run the tools I suggested. GET RID OF Bearshare!! P2P file sharing will toast your computer! Have a read: KaZaA, KaZaA Lite, Grokster, Bearshare, eDonkey2000, Morpheus, Limewire, Overnet, Papigator, XoloX, Tesla, WinMX, Shareaza, Gnucleus and any other p2p file sharing network will kill your computer! You have absolutely NO control over what is actually included in the files that you are downloading. Many of these files contain viral contents. Many virii are spread through these file sharing networks without your knowlege. Many of these will infect every file in your shared folder, and when someone downloads a file from you, they are then infected, and they infect everyone that downloads from them. This is a never ending cycle. Most of the programs used to access these networks install loads of spyware/adware/malware onto your computer in the process of installing the program. Many people are under the false impression that if they use kazaa lite or another program that "claims" to be free of spyware, that they are safe. This is a costly misconception! Even IF these programs are actually spyware free, this, in no way, stops the spread of virii through the network. By reading some of the virus information from the Symantec sites below, you will see that many of these virii will disable your anti-virus programs, to prevent them from being detected. So the argument that it is safe to use file sharing networks as long as you run an anti-virus program is incorrect. Some good reading: http://users.sisna.com/mjmcmillan/myweb2/P2P.htm Kazaa Delivers More Than Tunes http://www.net-security.org/news.php?id=4852 Also, here are just a few of the hundreds of virii that spread through p2p file sharing networks. Read how these are spread (through kazaa and other p2p file sharing networks): w32.hllp.spreda.b w32.hllw.astef w32.hllw.kefy w32.beagle.x@mm w32.beagle.w@mm w32.hllw.sanker w32.hllw.cassidy w32.hllw.merkur.e@mm w32.hllw.kazkaz vbs.pelic.worm w32.hllw.winur w32.kwbot.f.worm w32.hllw.huntocx Here is a list from Symantec's site that includes a number of virii that are spread through kazaa and other p2p file sharing networks. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 10:17 am Posted by mojo7819 (5744 messages posted) It would also be a good idea to run an online virus scan. An online scanner is available at: Trend Micro or Panda or McAfee or Symantec [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 12:37 pm Posted by Kenneth (57 messages posted) Spyware Blaster will only stop new spywares from being loaded on the computer (it says so on majorgeeks.com) Spyware Guard tells you to not use spyware blaster if you have sypware guard (it will do the same thing as spyware blaster but it will also scan *.exe and *.cab files before being executed on the machine, but it will not stop one that has already been executed in the past. If the files are already saved then they are there.) CWshredder will only stop instances of CoolWebSearch and nothing else. If you read his hijack log you will see that the instances of spyware guard , adaware and hijack this were already running and the problem is still there indicated by R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) I am not trying to be a thorn I am just trying to help. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 12:59 pm Posted by Kenneth (57 messages posted) Start with fixing these items R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\aphnho.dll/sp.html (obfuscated) R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause After you fix these items shutdown, restart run hijack this again see if they are back. I am not completely sure about this one. O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - http://www.installengine.com/engine/isetup.cab But if it is bad, spyware guard should find it. Post back with results [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:01 pm Posted by mojo7819 (5744 messages posted) I run SpywareBlaster AND SpywareGuard both, with no problems. Does it not make sense to install and run these tools to check for and correct problems AND protect from future instances of them or others? Why fix ONLY the problem you are experiencing at this moment, when you can fix all the problems on your computer AND protect it from any more garbage being installed. Although HiJack This is a great program, it will only find the problems and help you kill them. It does not, however, prevent them from returning again in a couple minutes. This is why I only advise to use it after all other scans for garbage have failed. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:08 pm Posted by mojo7819 (5744 messages posted) Another reason I don't reccomend HT is that it is VERY dangerous if you do not know EXACTLY what to fix and what not to fix. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:19 pm Posted by Kenneth (57 messages posted) OK aggreed. Spyware Guard should be run from now on but it will most likely not fix the current problem. ATTENTION: Mojo is right. HijackThis is EXTREMELY dangerous if you just go through and check everything and choose fix. Don't do that. Would really suck and then you would have 30+ posts in the next few days, (assuming you could get online). [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:30 pm Posted by Kenneth (57 messages posted) Mogo, I have been looking at past posts (tounge twister). How can you spend so much time helping people that refuse to search annoyances for the answer to there question. There have been atleast 10 sasser worm and 10 about:blank listings in the last 24 hours. I got on here thought I would help a couple people out and relized that they were all complaining about the same thing. Homepage Hijacked, lsass.exe terminated. Something to think about! [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:37 pm Posted by mojo7819 (5744 messages posted) Those are not the only ones! Every day, there are repeated posts about the same subject. It seems nobody can figure out how to go back and check the titles of the last 20 or 50 posts. Doing so would eliminate 80% of the new posts. Some of the most asked questions deal with: Homepage hijacked Unwanted toolbars Spyware in general Looking for drivers A bunch of networking questions that can be answered by looking in "Networking" in the left pane of the page Shutdown problems Startup problems Problems caused by using p2p file sharing (these will kill a computer!!!) Formatting or installing XP Windows update problems (I refuse to update Windows, and my computer runs like a top) Can't sign into MSN or Hotmail Trying to run old windows or DOS programs in XP The list goes on and on. Some come in groups, meaning you might get several of the same questions on a particular day. [Reply or follow-up to this message] Oops Sunday, May 2, 2004 at 1:37 pm Posted by Kenneth (57 messages posted) Didn't mean to call you Mogo, Mojo............(there, I feel better now) [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 1:51 pm Posted by Kenneth (57 messages posted) Well, 90% of those problems could be fixed by two things. Spyguard (downloaded at birth) Turning on the firewall that is BUILT IN. I guess Bill Gates should have made that a default. If someone didn't like it they could spend their time posting "How do I turn off my Firewall" [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 2:07 pm Posted by mojo7819 (5744 messages posted) Maybe not 90% but quite a few. It didn't take long before I made a text file with all the responses, and I just copy and paste into the test box to post on the forum. I am always adding or editing it with new stuff. This Sasser Worm is an example of what I keep saying about doing the Windows updates. Why in the world would you keep installing updates to repair holes in XP, one at a time, when all you have to do is turn on the firewall in XP, and repair ALL, or at least most of the holes at one time? That, and use a good, updated A/V program and the spyware arsenal that I post, and you really don't have any reason to do the updates. They cause more problems than they solve. I haven't done updates in over a year, and I don't experience any of the problems people come in here with. Another pet peeve of mine is p2p file sharing. I wrote up a post on this the other night, and posted it a couple times. If you are interested in seeing it, let me know, and I will post it here. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 2:28 pm Posted by Kenneth (57 messages posted) Post on main page (not that I think anyone would read it) [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Sunday, May 2, 2004 at 2:40 pm Posted by mojo7819 (5744 messages posted) I'm not going to start a new thread for it, but here it is: KaZaA, KaZaA Lite, Grokster, Bearshare, eDonkey2000, Morpheus, Limewire, Overnet, Papigator, XoloX, Tesla, WinMX, Shareaza, Gnucleus and any other p2p file sharing network will kill your computer! You have absolutely NO control over what is actually included in the files that you are downloading. Many of these files contain viral contents. Many virii are spread through these file sharing networks without your knowlege. Many of these will infect every file in your shared folder, and when someone downloads a file from you, they are then infected, and they infect everyone that downloads from them. This is a never ending cycle. Most of the programs used to access these networks install loads of spyware/adware/malware onto your computer in the process of installing the program. Many people are under the false impression that if they use kazaa lite or another program that "claims" to be free of spyware, that they are safe. This is a costly misconception! Even IF these programs are actually spyware free, this, in no way, stops the spread of virii through the network. By reading some of the virus information from the Symantec sites below, you will see that many of these virii will disable your anti-virus programs, to prevent them from being detected. So the argument that it is safe to use file sharing networks as long as you run an anti-virus program is incorrect. Some good reading: http://users.sisna.com/mjmcmillan/myweb2/P2P.htm Kazaa Delivers More Than Tunes http://www.net-security.org/news.php?id=4852 Also, here are just a few of the hundreds of virii that spread through p2p file sharing networks. Read how these are spread (through kazaa and other p2p file sharing networks): w32.hllp.spreda.b w32.hllw.astef w32.hllw.kefy w32.beagle.x@mm w32.beagle.w@mm w32.hllw.sanker w32.hllw.cassidy w32.hllw.merkur.e@mm w32.hllw.kazkaz vbs.pelic.worm w32.hllw.winur w32.kwbot.f.worm w32.hllw.huntocx Here is a list from Symantec's site that includes a number of virii that are spread through kazaa and other p2p file sharing networks. [Reply or follow-up to this message] re: TROJAN OR VIRUS ... help ... not sure what to do! Monday, May 3, 2004 at 1:41 pm Posted by Brian (630 messages posted) I finally solved my virus / worm / trojan problems permanently and haven't had a single worry in months. using a dual boot system with XP on the main partition using NTFS , and a small partition formatted in FAT16 running my old Windows 98. I connect to the internet using EXCLUSIVELY Win98 on the FAT 16 partition, and use XP normally on the other with any other programs required as well. Since a FAT 16 formatted drive can't even see the other formatted in NTFS,the partition/drive running XP can't under any circumstances become infected. If for some reason you pick up anything from the internet, and it screws up your Win98 partition - who cares? - you just re-load Win98 in about 30mins as many times as you want (unlike XP) and away you go again - works great, and as as far as I know - foolproof. > >It didn't take long before I made a text file with all the responses, and I just >copy and paste into the test box to post on the forum. I am always adding or editing >it with new stuff. > >This Sasser Worm is an example of what I keep saying about doing the Windows updates. > Why in the world would you keep installing updates to repair holes in XP, one at >a time, when all you have to do is turn on the firewall in XP, and repair ALL, or >at least most of the holes at one time? That, and use a good, updated A/V program >and the spyware arsenal that I post, and you really don't have any reason to do the >updates. They cause more problems than they solve. I haven't done updates in over >a year, and I don't experience any of the problems people come in here with. > >Another pet peeve of mine is p2p file sharing. I wrote up a post on this the other >night, and posted it a couple times. If you are interested in seeing it, let me >know, and I will post it here. > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows XP Discussion Forum