system
February 1, 2006, 4:35pm
1
Hi, my trusty avast software found 3 viruses. (i wasnt even on the internet and i hadnt downloaded anything) i clicked delete so it deleted it. It then popped up again with the same virus (cant remember the name) so i clicked delete again. This time it said that it couldnt find the file to be deleted (presumably because it got fid of it before). Also today 3 MORE viruses appeared from no-where, again i hadnt been on the internet or anything. These viruses are called:
win32:trojan-gen {other}
win32:trojan-2873
win32:tsupdate-j
My internet homepage has also set itself to “findthewebsiteyouneed.com ”
Can anyone help me?
DavidR
February 1, 2006, 7:42pm
2
What is your OS ?
Browser hijacks aren’t detected by avast.
If you haven’t already got this software (freeware), download, install, update and run it.
Ad-Aware Spybot Search and Destroy Spywareblaster
system
February 3, 2006, 7:33am
3
Hi squall2 and welcome. How about posting a HijackThis log so we can get a look at what’s going on there.
Click here to download HJTsetup.exe : http://www.thespykiller.co.uk/files/HJTSetup.exe
Double click on the HJTsetup.exe icon on your desktop.C:\Program Files\Hijack This .Do a system scan and save a log file button. It will scan and then ask you to save the log.DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
system
February 4, 2006, 10:13am
4
ok thanks, here is what it came up with. (i deleted the viruses from the chest for now but im sure the same ones will come up next system re-start. they seem to be in the temp internet files even when i deleted everything in there) If you want a log when i have re-started (when the viruses will prob pop up again) just say the word.
Logfile of HijackThis v1.99.1
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com http://searchbar.findthewebsiteyouneed.com http://searchbar.findthewebsiteyouneed.com http://www.google.co.uk/ http://searchbar.findthewebsiteyouneed.com http://searchbar.findthewebsiteyouneed.com http://localhost:9100/proxy.pac
system
February 4, 2006, 10:13am
5
here is the other half of them!!!
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dllhttp://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab http://musicmix.messenger.msn.com/Medialogic.CAB http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
No active firewall was found on your system or the firewall you use is unknownhttp://www.spywareguide.com/product_show.php?id=26 http://hjt.networktechs.com/parse.php and received this
system
February 4, 2006, 11:05am
7
so shall i delete the “O10 - Hijacked Internet access by WebHancer
and now im greeted my numerous pop ups when i go on the internet, some are betting things… and some are something like “find your perfect partner etc”
do you think using a previous system restore point will help?
system
February 4, 2006, 11:40am
8
anyway, the “webhancer” thing cant be found on my add/remove programme list and when i run hijack this, it doesnt list it anymore?? it goes down to 09 then jumps to 011 (010 was the webhancer)
but when i search with windows for it, it finds it in c:\program Files and i cant get rid of it. sigh this is starting to realy annoy me
system
February 4, 2006, 2:27pm
9
Thanks very much to everyone who helped. It seems to have gone now. Thanks about my firewall, something must have turned it off! Thanks again!
system
February 5, 2006, 10:36am
11
looks like i spoke too soon, i think it has come back. my homepage is “findthewebsite you need” again
Have you tried to reset your winsock lsp there is a programme on the net that will do this for you. Also run all your antispyware in safe mode, protect your winsock and start page with either winpatrol or ms antispy . Go to this page http://www.cexx.org/lspfix.htm
DavidR
February 5, 2006, 1:41pm
13
Do you have entries like this in your HJT log ?
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http :// searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http :// searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http :// searchbar.findthewebsiteyouneed.com
If so fix them. For you to continually to get hit like this there must be a flaw in your security.
For an on-line analysis - HiJackThis Log file - On-line Analysis HiJackThis Log file - On-line Analysis 2 tomcoyote.org/hjt
system
February 5, 2006, 4:02pm
14
You also need to shutdown Windows Messenger. This is not needed by most users and was meant mostly for multiple users such as corporations and IT’s. Malware has learned how to send you all grades of “goodies” through this mostly un-needed service. Do not confuse this with MSN Messenger as it is not the same program. Click the link below for instructions to stop this service. The link includes instructions for all Windows versions.
http://www.pchell.com/support/ipmessaging.shtml
Welcome to the forums!
system
February 5, 2006, 5:10pm
15
it says that “messenger” is already stopped and disabled even though i personally know its not??!! I ran the start-up delete thing but im not sure which file wont budge. (i think it may have gone now). Just then my avast said it found another trojan. Can you delete your temp internet files folder?
system
February 5, 2006, 5:15pm
16
Do you have entries like this in your HJT log ?
Yes, thanks, i had 3 like that so i got rid of them just then tnx.
DavidR
February 5, 2006, 6:24pm
17
If it is stopped and the service indicated stopped and disabled, then it is and what you are seeing isn’t windows messenger but something (malware) trying to look like it.
system
February 5, 2006, 8:42pm
18
There appears to be numerous suspicious items in your
HJT log ( C:\winsysbans5.exe, gimmygames, etc ) AND
since doc_esb has NOT made a 2nd post AND you appear
to have Spybot S & D, I would encourage you to ask their
Experts for help at : http://forums.spybot.info . There has
been a recent "security alert" about Winamp and unless
you have the latest version ( 5.13 ), it should be removed
and that 5.13 version installed .
system
February 6, 2006, 7:11pm
19
here is my new HJT log:
C:\WINDOWS\System32\smss.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
system
February 6, 2006, 7:21pm
20
this is a pic of my messenger disabled even though i can still use it!? If it is malware, how do i get rid?
well i would give you a pic but i have 2 take a screen shot and i dont know how to show it on here…
