I found this random file in my program files not two hours ago. I'm pretty sure it's malicious. Ran the HjT scan. Here it is:
Logfile of HijackThis v1.99.1
Scan saved at 3:32:09 AM, on 6/24/2006
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)
I've been running online scanners all night, and nothing seems to have picked it up. Should I just remove it using the add/remove program option? Thanks for the help.
Look in your control panels add/remove programs for PuritySCAN By OIN, OuterInfo, OIN or similar , click on it and click remove.
Reboot and delete this folder if found:
C:\Program Files\PurityScan
Select "Delete on Reboot".
Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:
C:\WINNT\System32\chkdsk.dll Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
Logfile of HijackThis v1.99.1
Scan saved at 4:54:17 PM, on 6/24/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
[*]]Close all other Applications] Select language click Ok [*]Click I Agree [*]Click next [*]Click Install [*]Click Finish [*]Wait Ewido will open main screen automatically.
[*]Wait again a few minutes and Ewido Should Auto update itself. If it doesn't click update at top of screen.
[*]]This in very important to get updates [*]When updating has finished. Close Ewido.
If you have an "always on" connection to the internet, physically disconnect that connection until you are finished with Safe Mode and have rebooted back into normal mode.
[list]
[*]Next, please reboot your computer in Safe Mode by doing the following:
[*] Restart your computer
[*] After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
[*] Instead of Windows loading as normal, a menu should appear use arrow up to highlight
[*] Select the first option, to run Windows in Safe Mode hit enter.
[*]For additional help in booting into Safe Mode, see the following site: http://www.pchell.com/support/safemode.shtml
You MUST manage to get into Safe Mode for the fix to work.
Make sure to close all open windows/programs/folders. Have nothing else open while ewido performs its scan! [*]Open Ewido [*]Click on scanner top of Ewido sceen
[*]Click on Settings [*]Under How to Act click on Recommended Action choose Quarantine [*]Under How to scan all boxes should be selected
[*]Under Possibly unwanted software all boxes should be selected
[*]On right side under Reports: click on[color=blue] Automatically generate report after every scan.[/color]
[*]Under What to scan select scan every file [*]Click On scan Tab
[*]Click on Complete system scan [*]Let the program scan the machine It can take awhile give it time.
[*]When scan has finished At bottom of screen click Apply all Actions [*]Click Save report [*]Click Save Report as (Save as window's screen should pop up.)
[*]Click desktop [*]Click Save [*]Exit ewido Reboot back to normal mode
Logfile of HijackThis v1.99.1
Scan saved at 3:38:15 AM, on 6/25/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP4 (5.00.2920.0000)
C:\WINNT\system32\sуmbols\iexplore.exe -> Adware.ClickSpring : No action taken.
C:\!KillBox\chkdsk.dll -> Adware.PurityScan : No action taken.
HKLM\SOFTWARE\Clickspring -> Adware.PurityScan : No action taken.
C:\WINNT\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.Downloader.Win32.PopCap.b : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Tesseract\Cookies\tesseract@cnn.122.2o7[2].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@ads.addynamix[1].txt -> TrackingCookie.Addynamix : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@z1.adserver[1].txt -> TrackingCookie.Adserver : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@advertising[2].txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@burstnet[1].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@www.burstnet[2].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Tesseract\Cookies\tesseract@burstnet[2].txt -> TrackingCookie.Burstnet : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@cz4.clickzs[2].txt -> TrackingCookie.Clickzs : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@com[1].txt -> TrackingCookie.Com : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@as-us.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@media.fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@hypertracker[1].txt -> TrackingCookie.Hypertracker : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@ilead.itrack[1].txt -> TrackingCookie.Itrack : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@sales.liveperson[1].txt -> TrackingCookie.Liveperson : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@ads.pointroll[2].txt -> TrackingCookie.Pointroll : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@edge.ru4[1].txt -> TrackingCookie.Ru4 : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@specificpop[1].txt -> TrackingCookie.Specificpop : No action taken.
C:\Documents and Settings\Administrator\Cookies\administrator@starware[2].txt -> TrackingCookie.Starware : No action taken.
C:\Documents and Settings\Tesseract\Cookies\tesseract@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Tesseract\Cookies\tesseract@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.
C:\Documents and Settings\Dionna\Cookies\dionna@zedo[2].txt -> TrackingCookie.Zedo : No action taken.
You'll have to rescan with ewido :)
"No action taken" for all -> nothing removed. Make sure that you let ewido remove everything it finds.
In other words, go to scanner -> settings
How to act? -> recommended actions -> select delete
Then re-scan using instructions I already gave you.
Send a fresh HjT log.
is this still thread still alive? because i just got this thing today >< i googled it and it got me here, i downloaded the HjT so i'll run it and copy the log on here, if this is still alive >< ...
