Author Topic: can't get rid of virus  (Read 2853 times)

0 Members and 1 Guest are viewing this topic.

matt123

  • Guest
can't get rid of virus
« on: October 11, 2004, 07:55:24 PM »
hey,
I've got  the following Win32:Trojan-gen and can't seem to get rid of it, any ideas? I've attached a copy of the hijackthis log

thanks

Logfile of HijackThis v1.97.7
Scan saved at 17:48:33, on 11/10/2004
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ICQ\ICQNet.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\pc\My Documents\HijackThis.exe

N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\pc\Application Data\Mozilla\Profiles\default\bu8f78es.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: (no name) - {815A82AE-CDEF-11D8-BA48-A6D245798277} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe
O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe
O4 - HKLM\..\Run: [RemoveCpl] RemoveCpl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\Avast4\ashmaisv.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=8fd11b82b249444e619d774ba9df4bce36ebdb3c59b3e6c3a0495e4a241884a238737a6ff104ae03760f3f2262212ed6870056533ce2bfd617cb78228c122da4:54aa0b63e31b1645b7e39f97dd64b521
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/protect/wsa/shared/CAB/x86/msSecAdv.cab?1095701312602
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31081
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:can't get rid of virus
« Reply #1 on: October 11, 2004, 08:15:14 PM »
The log file shows nothing. What file is reported as infected and what is its location?
Also immediatly visit windows update and get/install ALL security patches/updates. both your windows and IE are not up to date.

I also see no firewall. Unless you have a router/firewall, I suggest you get one.

Also please use the latest version of HJT.

With HJT you can fix these things:
o3 - toolbar: (no name) - {815a82ae-cdef-11d8-ba48-a6d245798277} - (no file)
o16 - dpf: {15ad4789-cdb4-47e1-a9da-992ee8e6bad6} - http://public.windupdates.com/get_file.php?bt=ie&p=8fd11b82b249444e619d774ba9df4bce36ebdb3c59b3e6c3a0495e4a241884a238737a6ff104ae03760f3f2262212ed6870056533ce2bfd617cb78228c122da4:54aa0b63e31b1645b7e39f97dd64b521
o16 - dpf: {19e28afc-eae3-4ce5-ac83-2407b42f57c9} (mssecurityadvisor class) - http://protect.microsoft.com/security/protect/wsa/shared/cab/x86/mssecadv.cab?1095701312602
o16 - dpf: {33564d57-0000-0010-8000-00aa00389b71} - http://download.microsoft.com/download/f/6/e/f6e491a6-77e1-4e20-9f5f-94901338c922/wmv9vcm.cab
o16 - dpf: {d27cdb6e-ae6d-11cf-96b8-444553540000} (shockwave flash object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

« Last Edit: October 11, 2004, 08:16:50 PM by Eddy »