User Name Password Register
DaniWeb IT Discussion Community
All
What is DaniWeb IT Discussion Community?
You're currently browsing the Viruses, Spyware and other Nasties section within the Tech Talk category of DaniWeb, a massive community of 397,779 software developers, web developers, Internet marketers, and tech gurus who are all enthusiastic about making contacts, networking, and learning from each other. In fact, there are 2,488 IT professionals currently interacting right now! Registration is free, only takes a minute and lets you enjoy all of the interactive features of the site.
Please support our Viruses, Spyware and other Nasties advertiser:

TROJ STILEN.A, ADW RULEDOR.C, BKDR SANDBOX.S detected using Trend Micro House Call

Join Date: Feb 2004
Location: Oztralya
Posts: 7,685
Reputation: crunchie is a jewel in the rough crunchie is a jewel in the rough crunchie is a jewel in the rough 
Rep Power: 22
Solved Threads: 419
Moderator
Featured Poster
crunchie's Avatar
crunchie crunchie is offline Offline
Spyware Killer

Re: TROJ STILEN.A, ADW RULEDOR.C, BKDR SANDBOX.S detected using Trend Micro House Call

  #4  
May 22nd, 2004
Open Task manager &end process on the following:
IEHost.exe
vb5ley.exe
AutoUpdate.exe
pcsvc.exe
dpi.exe
msxml2r.exe

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm

O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL (file missing)
O2 - BHO: NavErrRedir Class - {4FC95EDD-4796-4966-9049-29649C80111D} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL

O4 - HKLM\..\Run: [1qN8] C:\documents and settings\kelly\local settings\temp\1qN8.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [oFnO39i] vb5ley.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exe
O4 - HKCU\..\Run: [msxml2r] C:\WINDOWS\system32\msxml2r.exe

navigate to & delete

C:\PROGRA~1\INCRED~1< folder
C:\documents and settings\kelly\local settings\temp< entire contents of this temp folder
C:\Program Files\AutoUpdate< folder
C:\WINDOWS\system32\pcs< folder
C:\Program Files\Common Files\Dpi< folder

C:\WINDOWS\System32\IEHost.exe< file
C:\WINDOWS\system32\msxml2r.exe< file

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Reboot normally after doing the above then post a fresh log plz.
Proud member of ASAP (Alliance of Security analysis Professionals).
Opera How you got infected AVAST anti-virus Comodo Firewall Spywareblaster

Please do not PM me for help. Instead, post in the public forum where others may benefit.
Reply With Quote  
All times are GMT -4. The time now is 4:46 am.
Forum system based on vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
©2003 - 2008 DaniWeb® LLC