|
Explorer restarts
|
|
Member
|
3. August 2006 @ 08:49 |
Link to this message
|
hey all,
i just ahd a virus and im pretty sure i got rid of it. i dont know what virus cos when norton caught ti it was just called "Trojan Horse" there was no specific name. I went to the symantec website and followed their instructions to get rid of it and norton doesnt see it anymore and the file it listed is gone. Im still having some problems though because sometimes when i start up IE my comp decides it should restart explorer for some reason. This is kinda annoying because i lose most of my tray icons. Also i seem to be getting lots of random pop ups advertising for something called Win Tasks pro 5 or sumthin that i hadnt been getting since i looked up some of my processes at http://www.processlibrary.com/ but neither norton or Spybot S&D find adware that would cause this.
any ideas or suggestion would be very helpful :)
"Religion is the opium of the masses" - Karl Marx
|
|
Advertisement
|
|
|
|
|
david66
Senior Member
|
3. August 2006 @ 10:48 |
Link to this message
|
|
malaware has been put on your computer do a system restore to a point before the problem began
|
Member
|
3. August 2006 @ 11:11 |
Link to this message
|
|
symantec told me turn off system restore when i got rid of my virus so all the back ups were deleted. They said that windows could accidently restore the virus so i shud turn system restore off until the virus was gone and when i did that it erased all my previous restore points and the problem has been there since i removed the virus so i dont have a restore point to use :/
"Religion is the opium of the masses" - Karl Marx
|
Senior Member
|
3. August 2006 @ 13:02 |
Link to this message
|
Most AV programs have a really hard time getting rid of trojan virus type malware. It's best to use an Anti-trojan or AT, program like Ewido, a2 Anti-Trojan, Spybot Search & Destroy (if your pariticular virus is included in the definitions list).
Symantec (Norton), McAfee and AVG Free versions will most likely not even be able to quarantine the trojan, much less remove it.
If you need help in manually removing the virus, please post back here with the name of the trojan (Norton may have said "no name" but you will have to find out by using another program to find it), and I'll be happy to show you how to get rid of it.
This message has been edited since posting. Last time this message was edited on 3. August 2006 @ 13:03
|
Member
|
3. August 2006 @ 18:10 |
Link to this message
|
well im not usin a free version of norton its full version norton 2006 and ill search google, but Spybot doesnt find anything and hwen it does the stuff seems to come back even after i fix it, but ill try to get ewido or sumthin and see if it gives me a name then post back thx for ur help :)
"Religion is the opium of the masses" - Karl Marx
This message has been edited since posting. Last time this message was edited on 3. August 2006 @ 19:06
|
Member
|
3. August 2006 @ 19:25 |
Link to this message
|
|
ooook i got ewido and ran a scan and it found all this stuff:
Name: Risk: recommended action:
Downloader.small.bwy high Quarentine
dialer.generic high Quarentine
downloader.INService high Quarentine
Trojan.Dialer.pz high Quarentine
Trojan.Pakes High Quarentine
Adware.DeaktopSpyAgent Med Quarentine
Adware.WebSearch Med Quarentine
Adware.TrustCleaner Med Quarentine
TrackingCookie.2o7 med delete
TrackingCookie.Yieldmanager med delete
TrackingCookie.Adbrite med delete
TrackingCookie.Euroclick med delete
TrackingCookie.Pointroll med delete
TrackingCookie.Burstnet med delete
TrackingCookie.Com med delete
TrackingCookie.Questionmarket med delete
TrackingCookie.Adjuggler med delete
TrackingCookie.Reliablestats med delete
TrackingCookie.Tacoda med delete
TrackingCookie.Trafficmp med delete
TrackingCookie.Tribalfusion med delete
TrackingCookie.Burstbeacon med delete
TrackingCookie.Myaffiliateprogram med delete
TrackingCookie.Adserver med delete
TrackingCookie.Zedo med delete
Adware.Apropos med Quarentine
Adware.Aws med Quarentine
shud i take the recommended actions even though the files will just be quarentined? or shud i have it delete them? or sumthin else?
edit: hmm gthat didnt come out formatted like i wanted but i think u can figure it out
"Religion is the opium of the masses" - Karl Marx
This message has been edited since posting. Last time this message was edited on 3. August 2006 @ 19:26
|
|
david66
Senior Member
|
4. August 2006 @ 06:08 |
Link to this message
|
|
I would delete them
|
Senior Member
|
4. August 2006 @ 11:48 |
Link to this message
|
|
Delete them if you can, otherwise quarantine. Quarantining a file from a program like that, locks the file from being accessed by encrypting it. You don't to worry about launching the virus again.
This message has been edited since posting. Last time this message was edited on 4. August 2006 @ 11:49
|
Member
|
4. August 2006 @ 15:10 |
Link to this message
|
|
ok it was able to delete all of them so it shud be fixed right? :D
"Religion is the opium of the masses" - Karl Marx
|
Senior Member
|
5. August 2006 @ 05:04 |
Link to this message
|
Post a HjT log in the Spyware And Virus forums to be safe :)
|
Member
|
5. August 2006 @ 06:33 |
Link to this message
|
|
ok ill do that a lil later
"Religion is the opium of the masses" - Karl Marx
|
Member
|
6. August 2006 @ 11:27 |
Link to this message
|
ok the prolbem is definitely not fixed because it just happened 2x to me. It seems to happen whenever i open a maximized IE window. It works fine if i keep the window @ restore or minimize but as soon as i hit maximize on a new IE window explorer decides to restart and i lose all my non essential tray icons, which is really annoying. You said to post a HjT so here it is:
Logfile of HijackThis v1.99.1
Scan saved at 12:27:23 PM, on 8/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\BELKIN USB Wireless Monitor\WLService.exe
C:\Program Files\BELKIN USB Wireless Monitor\WLanCfgG.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_02\bin\jucheck.exe
C:\Program Files\Common Files\AOL\1127013306\ee\AOLSoftware.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\BELKIN USB Wireless Monitor\InfoMyCa.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exe
C:\Program Files\eFax Messenger Plus\HotTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\eFax Messenger Plus\Dllcmd32.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HotDocs 6\hdfill6.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\common files\aol\1127013306\ee\aim6.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Martha\Desktop\Bryce\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.yahoo.com/config/login?.partner=sbc&.done=http://sbc...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [5smQ34S] msrtfp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127013306\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Getca] C:\Program Files\BELKIN USB Wireless Monitor\InfoMyCa.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: eFax Tray Menu.lnk = C:\Program Files\eFax Messenger Plus\HotTray.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Live Menu.lnk = C:\Program Files\eFax Messenger Plus\Dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Microsoft Outlook.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {0D706C01-1B2C-11D1-9566-00C04FC9DF81} (MmaFill Control) - http://courts.countyofventura.org/JCF-Web/filler/mmafill.cab
O16 - DPF: {11A25865-7179-4A9E-BCEA-456F497871EA} - http://www.xspouse.com/XspouseDemo/XspouseDemo.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugi...
O16 - DPF: {A8739816-022C-11D6-A85D-00C04F9AEAFB} (Web Camera Server Control) - http://204.102.114.12/wg_webeye.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{08F84EAB-A802-49FE-ABFC-823B28C6E686}: NameServer = 192.168.1.1,192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{5EB1DEE1-5D42-41BC-9E90-8C58885CEBFD}: NameServer = 192.168.0.1,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{08F84EAB-A802-49FE-ABFC-823B28C6E686}: NameServer = 192.168.1.1,192.168.0.1
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Belkin 54Mbps Wireless USB Network Service (Belkin 54Mbps Wireless USB) - Unknown owner - C:\Program Files\BELKIN USB Wireless Monitor\WLService.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
"Religion is the opium of the masses" - Karl Marx
|
Senior Member
|
7. August 2006 @ 00:09 |
Link to this message
|
|
Wow.
A couple things I seen at a quick glance. You've got way too many unneeded services and programs running at startup, but those suggestions can be made later.
This I find suspicious right off the bat simply because a search revealed no information about the file.
O4 - HKLM\..\Run: [5smQ34S] msrtfp.exe
This file might be prevented from running by going into your registry and deleting this entry. Go to start, run, type in regedit. Go to HKEY_Local_Machine\Software\Microsoft\Windows\Currentversion\Run and delete the entry on the right hand side called msrtfp.exe. Once you have that file disabled, restart the computer. You can also try your shot using online AV scanners from Panda* or TrendMicro. However, if I may...I'd highly recommend trying NOD32 as your main anti-virus program. You'll have to fully remove Symantec (Norton) before using another AV.
Now, as far as your startup entries are concerned, removing these from starting up with the system won't prevent them from running normally when you need them, but it will greatly improve system startup time and all around performance.
Go to start, run, and type in msconfig.
Uncheck (if listed):
realsched.exe - an update program
jusched.exe - java update program
NMBgMonitor.exe - system monitor
msrtfp.exe - unknown
qttask.exe - quicktime update program
HPWuSchd2.exe - hewlett packard update program
NeroCheck.exe - nero's drive monitor program
nwiz.exe - nvidia monitor program should you install a new graphics card
Adobe Gamma Loader.exe - adobe gamma adjustment program
BigFix.exe - a tool used to download support information from hardware manufacturers and software vendors
hpqtra08.exe - printer monitor program
hpqthb08.exe - printer program
OSA9.EXE - Microsoft office
bagent.exe - quicken update program
MSN Messenger can be prevented by going to Tools, Options, General and unchecking "Automatically run messenger when I log on to Windows".
After reboot, run your scans again.
* - Panda no longer removes the virus, but it will give you a text file of the report from any virus it finds. That info we can use to determine the correct course of action.
This message has been edited since posting. Last time this message was edited on 7. August 2006 @ 00:10
|
|
Advertisement
|
|
|
Member
|
7. August 2006 @ 11:54 |
Link to this message
|
|
wow thx for all the info. I knew that that file seemed suspicious because i had tried searching it before aand didnt find anything but i was worried it might mess up the comp if i removed it from the registry so i was hesitating. Ill also remove a lot of those things from startup because i definitely dont need them running. About switching AV programs thats gonna be pretty impossible as its not my comp and my mother can be well... lets just say shes not the brightest bulb in the box. She got upset when i downloaded Ewido to her computer because she thought it might be a virus -_- so i dont think im gonna be able to convince her to get a new AV program that shes never heard of before.
edit: i was in msconfig at the startup tab and there seems to be a blank entry that refers to HKLM..../RUN but i dont know what it is as the name spot is blank. This seems suspicious to me so i thougght i sud put it here :) btw i havent restarted my comp since deleteing that registry entry yet.
"Religion is the opium of the masses" - Karl Marx
This message has been edited since posting. Last time this message was edited on 7. August 2006 @ 12:00
|
