943,513 Members | Top Members by Rank

Ad:
Jun 8th, 2004
0

found 2 trojans w/ CWShreadder, HJT needs advice.

Expand Post »
This is my sister's old home business computer. P200, Win98, 256 mb ram.
It would make a good boat anchor.

I knew it was having problems so I told her I would try to help. I ran CWShreadder three times in safe mode and found 2 Trogans. CWS now says its clean.

Ran updated Ad-ware and found only 12 issues. Also Ran Spybot which fix several issues.

The following is a the HJT log: :lol: Your feedback is grealty appreciated!

Logfile of HijackThis v1.97.7
Scan saved at 10:05:29 PM, on 6/7/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\DESKTOP\TECH LOG FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchalot.com/search.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = nov
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = nov
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = nov
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = nov
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = nov
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = nov
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - (no file)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [QAGENT] D:\QUICKENW\QAGENT.EXE
O4 - HKLM\..\Run: [RealJukeboxSystray] "D:\REALJUKEBOX\tsystray.exe"
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINDOWS\SYSTEM\hpoopm07.exe
O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MICROS~3\GAMECO~1\COMMON\SWTRAYV4.EXE
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [CSINJECT.EXE] C:\Program Files\Norton SystemWorks\Norton CleanSweep\CSINJECT.EXE
O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\drivers\WingMan Software\Lwtest.exe" /detect /quiet /launch "C:\drivers\WingMan Software\LwEmon.exe /noui"
O4 - HKCU\..\Run: [System MScvb] C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\GTAFC5MV\DOCUMENTS.PIF
O4 - Startup: Media Manager Indexer.lnk = C:\Program Files\Common Files\Microsoft Shared\Media Manager\AIRSVCU.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\HP OfficeJet G Series\bin\hpodev07.exe
O4 - Startup: Introducing Media Manager.lnk = C:\Program Files\Common Files\Microsoft Shared\Media Manager\SPLASHA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Acrobat Assistant.lnk = D:\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Startup: Webshots.lnk = D:\Webshots\WebshotsTray.exe
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...irector/sw.cab
=====================================================

Please also make recommendations as to crapware she is running that is bogging down her already snail slow system.
Similar Threads
Reputation Points: 10
Solved Threads: 0
Light Poster
ajelliott is offline Offline
43 posts
since May 2004
Jun 8th, 2004
0

Re: found 2 trojans w/ CWShreadder, HJT needs advice.

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchalot.com/search.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = nov

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = nov

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = nov

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = nov

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = nov

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = nov

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = nov

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

O2 - BHO: (no name) - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - (no file)


O4 - HKCU\..\Run: [System MScvb] C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\GTAFC5MV\DOCUMENTS.PIF


Now reboot into safe mode and delete the following files and folders if found .

C:\WINDOWS\TEMPORARY INTERNET FILES\CONTENT.IE5\GTAFC5MV\DOCUMENTS.PIF ...delete this file


to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log
Team Colleague
Reputation Points: 1056
Solved Threads: 790
I hate 20 Questions
caperjack is online now Online
12,713 posts
since Aug 2003
Jun 8th, 2004
0

Re: found 2 trojans w/ CWShreadder, HJT needs advice.

just a few things that i would fix ,so they don't run at startup if I owned Old Betsy.
I would also uninstall Norton System Works .


O4 - HKLM\..\Run: [RealJukeboxSystray] "D:\REALJUKEBOX\tsystray.exe"

O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE

O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe

O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Acrobat Assistant.lnk = D:\Adobe\Acrobat 5.0\Distillr\AcroTray.exe

O4 - Startup: Webshots.lnk = D:\Webshots\WebshotsTray.exe
Team Colleague
Reputation Points: 1056
Solved Threads: 790
I hate 20 Questions
caperjack is online now Online
12,713 posts
since Aug 2003
Jun 13th, 2004
0

Re: found 2 trojans w/ CWShreadder, HJT needs advice.

My sister just returned from London on vacation. I have waited to run these fixes to get her verification before making any major changes to her computer.

We now have the changes and I have showed her the HJT logs. I will post the updated log once we get a chance to run the fixs.

Thank you for your help and support on this one.
Reputation Points: 10
Solved Threads: 0
Light Poster
ajelliott is offline Offline
43 posts
since May 2004

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: can't get rid of malware (HijackThis log inside)
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Big Baddie wont cant DL dllfix.exe - Please review HJT log





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC