Member Avatar for ezza114

Hi, my name's erin and i was searching the web for information on how to get rid of the virus or trojan that puts a red cirle with a white cross in your system tray. It's been there for ages and i simply can't get rid of it, and now there are two of them! :eek: I have windows xp and i just downloaded hijack this and got a log file, here it is:

Logfile of HijackThis v1.99.1
Scan saved at 3:00:29 PM, on 18/07/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Telstra\Toolbar\bpumTray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\winstall.exe
C:\Program Files\stam\draa.exe
C:\winstall.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\F.Phillipe\Desktop\Dvd Decrpter\Erin\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [Lwinst Run Profiler] .\Lwtest.exe /detect /quiet /launch ".\Lwpevntm.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [BigPond Toolbar] "C:\Program Files\Telstra\Toolbar\bpumTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [Cwda] C:\Program Files\stam\draa.exe
O4 - HKCU\..\Run: [SNInstall] C:\winstall.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.
O15 - Trusted Zone: *.
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.ysbweb.com
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *. (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList =
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

If anyone could help me that would be fantastic, i'm not really that knowledgeable about a computers technical stuff, but if you could tell me it step by step i would most appreciate it. Thanks very much, Erin :)

  • 2 Contributors
  • 3 Replies
  • 309 Views
  • 21 Hours Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

A short expert summary and safe action plan based on the HijackThis report posted by : the log shows multiple persistent autoruns (two instances of a winstall.exe name and a draa.exe under Program Files\stam), a Winlogon notify DLL (drct16.dll), a suspicious service registered as moto that points to a svchost executable in the Windows folder, and browser hijack/proxy/homepage changes. That combination is typical of a multi-component trojan that keeps a tray icon (the “red circle with white cross”), redirects browsing and actively blocks AV installers.

Containment and backup: isolate the machine from the network immediately. Important personal files should be copied to external media from a clean environment (boot from a Linux live USB or remove the drive and attach it to a clean PC). On a separate clean PC, create up-to-date bootable rescue media (offline rescue ISOs or reputable on-demand scanners) and use those to perform offline scans; offline scanning removes kernel/driver components much more reliably than in-OS tools.

In-OS cleanup guidance (Safe Mode recommended): run HijackThis in scan-only mode and remove the clearly malicious autorun entries (the two winstall.exe runs and the draa.exe entry), the Winlogon notify (drct16), the O16/DPF entry that points to a remote CHM->EXE, and the suspicious moto service registration. Do NOT remove SDHelper.dll (that is Spybot’s helper). Export/backup the registry (at least HKLM\SOFTWARE and HKCU\Software) before changes and clear unknown Trusted Sites and proxy overrides in Internet Options -> Connections -> LAN Settings.

If manual service/file removal is necessary (only by someone comfortable with commands), common commands are:

net stop "moto"
sc delete "moto"
attrib -s -h -r C:\winstall.exe
del /f /q C:\winstall.exe

After removal, reboot and run multiple updated scanners (offline rescue + on-demand scanners). If AV installers remain blocked or the system still behaves suspiciously, a full reinstall onto a legally licensed OS is the most reliable final solution. Note that flagged forum policy about pirated Windows; this guidance avoids any activation/patch workarounds and focuses solely on malware removal.

Recommended Answers

All 3 Replies

Member Avatar for dlh6213

Hi Erin, welcome to DaniWeb :D

Please follow the recommendations and instructions in the three links below.

When you get to the third one, after completing the basic HijackThis stuff (in the first post), go to post #4 and follow the instructions there.

If you have questions about anything, feel free to ask. When you're done, post a new HijackThis log so we can clean up anything that's left.

Member Avatar for ezza114

Hi Dlh6213,

thanks for getting back to me so quickly, i read through how to protect your pc and there are a few things i can't do. I have tried to install norton and the virus seems to be stopping me from installing any programs onto my computer. After norton wouldn't work i tried mcafee and that wouldn't install either, so i'm in a bit of a pickle. But that's not the only problem, i'm unable to access the windows security update because my computer has a pirated copy of xp pro. I realise this is illegal and have been trying to get a legal copy, but cannot afford it at the moment. Could i use another computer to download the updates? If so, would my computer let me install them?
Would it just be easier to wipe the whole computer and start from scratch? Except i don't know how to do that other than system restore, but the virus files could have been backed up by that, so that isn't really an option.
I would really appreciate it if you could give me some advice as to what i can do. Thanks very much, Erin :D

Member Avatar for dlh6213

I'm afraid forum rules don't allow assistance with pirated software (http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules).

All I can suggest is that you obtain a legal copy of an operating system.

If you can't afford Windows, there are several affordable Linux systems available, such as Linspire (http://www.linspire.com/product_page.php).

If you decide to get Windows XP, you can find instructions for installing it here:
http://www.daniweb.com/techtalkforums/thread6632.html

Good luck to you :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.