hi
avast found these 3 trojans and are in my chest, but i dont know what to do beacuse i saw webdrivers-i wanted to delete but decided to wait for advise and these other 3 file, which i think i should delete-
kernel32.dll
winsock.dll
wsock32.dll
these are the trojans-
Win32:Adware-gen [Adw]
DLL Win32:Spyware-gen [trj]
Win32:Adware-gen [Adw]
FileID: 0000000005 Original file name: C:\WINDOWS\WT\WTUPDATES\WTWEBDRIVER\FILES\3.3.1.001\NPWTHOST.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp133062928.tmp\5.DLL
FileID: 0000000004 Original file name: C:\WINDOWS\WT\WEBDRIVER\WTMULTI.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp133062928.tmp\4.DLL
FileID: 0000000006 Original file name: C:\WINDOWS\WT\WTUPDATES\WTWEBDRIVER\FILES\3.3.1.001\WTMULTI.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp133062928.tmp\6.DLL
i have hijack this, should i post the log- i think it is wildtangent-
Virus has been detected!
File Name: WTMULTI.DLL
FileID: 4
Virus Description: Win32:Adware-gen [Adw]
Virus has been detected!
File Name: NPWTHOST.DLL
FileID: 5
Virus Description: Win32:Spyware-gen [trj]
Virus has been detected!
File Name: WTMULTI.DLL
FileID: 6
Virus Description: Win32:Adware-gen [Adw]
i got this by scanning the files in the chest
Move files to temporary folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp
FileID: 0000000005 Original file name: C:\WINDOWS\WT\WTUPDATES\WTWEBDRIVER\FILES\3.3.1.001\NPWTHOST.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\5.DLL
FileID: 0000000004 Original file name: C:\WINDOWS\WT\WEBDRIVER\WTMULTI.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\4.DLL
FileID: 0000000006 Original file name: C:\WINDOWS\WT\WTUPDATES\WTWEBDRIVER\FILES\3.3.1.001\WTMULTI.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\6.DLL
Scan files in the temporary folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\4.DLL Win32:Adware-gen [Adw]
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\5.DLL Win32:Spyware-gen [trj]
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp75284279.tmp\6.DLL Win32:Adware-gen [Adw]
avast found these 3 trojans and are in my chest, but i dont know what to do beacuse i saw webdrivers-i wanted to delete but decided to wait for advise and these other 3 file, which i think i should delete-
kernel32.dll
winsock.dll
wsock32.dll
These are backups of legitimate system files- you should see they are in a separate section- and they should not be confused with any malware detected and moved to the chest: they can be left where they are indefinitely.
first
Do Whatever Frank says
just leave those system files alone in the chest for a while as they are backups
what to do with the three baddies? and possible Wild Tangent
so go ahead and post that HJT
just read the instructions closely and do not FIX anything till you hear from Frank or better
if you have an old version of HJT get the latest etc.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:07:06, on 7/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Nothing obvious in the log, but your Sun Java application needs updating.
Scan for out-of-date and insecure software using Secunia Software Inspector and update any vulnerable software: this will help to prevent future infections.
ok avast found 2 more ny itself i was infected with antispycheck and found it now in superantispyware and removed it before with smithfraud fix or something
Virus has been detected!
File Name: A0087349.DLL
FileID: 7
Virus Description: Win32:Adware-gen [Adw]
Virus has been detected!
File Name: A0087411.EXE
FileID: 8
Virus Description: Win32:Adware-gen [Adw]
Move files to temporary folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp
FileID: 0000000007 Original file name: C:\SYSTEM VOLUME INFORMATION_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP290\A0087349.DLL New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp\7.DLL
FileID: 0000000008 Original file name: C:\SYSTEM VOLUME INFORMATION_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP292\A0087411.EXE New folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp\8.EXE
Scan files in the temporary folder: C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp\7.DLL Win32:Adware-gen [Adw]
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp\8.EXE\nsis.hdr – no virus –
C:\DOCUME~1\JESSIE~1\LOCALS~1\Temp_avast4_\unp169004264.tmp\8.EXE Win32:Adware-gen [Adw]
also, some extra info
i have Superantispyware and it found antispycheck-(managed to delete)
Rogue.AntiSpyCheck
C:\SYSTEM VOLUME INFORMATION_RESTORE{21D7D692-4662-421F-93B0-877BC3820711}\RP290\A0087349.DLL
and was wondering if i should delete or not
i appreciate the help
tks
Deleting IE may cause problem you do not want since Windows Explorer also uses some of the same components. Instead, upgrade to IE7 since it is more secure than IE6 even if IE is not your defailt browser. IE is not my default browser neither since I primarily use Opera 9.51 as my default browser.
After following Frank’s suggestions, run HJT again and fix the below entries if they are still present. These entries have no file associations and are therefore not needed.
[b]O3 - Toolbar: (no name) - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) [/b]
i downloaded ie7, cant i just delete the one i found from superanti…and the other 2 in the avast virus chest or do i have to delete all of my system restores, let me know what u think i should do
If you restore an infected point, you’ll have the infection again.
If you don’t need the restore points (i.e., your computer is working now), better deleting them and create a new, clean, one.
i might it isnt working right now i have the trojans in the virus chest and aybe more and is it safe to delete the 2 restore trojans(mentioned before) in avast chest and the one found in superanti…
Files into Chest are safe to be kept there. No rush to delete them.
To be sure you’re clean, I suggest:
(if you want) Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
ok 1)ill delete temp files from internet options
2)scan w avast-and archievefiles-thorogh in safe mode
then delete all system restores w/o creating one if im right
3)use superanti and malware anti-malware and send items to quarantine not delete them
4)test w anti roots provided
5)make a ht log after completing all this
6)immunize w links prvided
i alreadu used secunia
is this right
