I am repeatedly getting warnings of trojans being found (usually get the message as i start up pc) I think its affecting performance of my PC and ive been moving them to the chest on each warning but obviously would really like to stop this in the first place.
Malware found is Win32: Trojan gen {other}
C:\WINDOWS\st_1241525733.exe
usually get both in 2 consecutive warnings and usually when my computer is starting up.
Im afraid im not terribly clued in with computers so please bare with me.
Hijack this log coming right up…
C:\WINDOWS\system32\svchost.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neopets.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.skybroadband.com/ myonlineaccounts2.abbeynational.co.uk www.myonlineaccounts2.abbeynational.co.uk online.lloydstsb.co.uk www.online.lloydstsb.co.uk online-business.lloydstsb.co.uk www.online-business.lloydstsb.co.uk online-offshore.lloydstsb.com www.online-offshore.lloydstsb.com abbeyinternational.com www.abbeyinternational.com ibank.cahoot.com www.ibank.cahoot.com home.ybonline.co.uk www.home.ybonline.co.uk home.cbonline.co.uk www.home.cbonline.co.uk mybank.alliance-leicester.co.uk www.mybank.alliance-leicester.co.uk mybusinessbank.co.uk www.mybusinessbank.co.uk ibank.internationalbanking.barclays.com www.ibank.internationalbanking.barclays.com welcome27.co-operativebank.co.uk www.welcome27.co-operativebank.co.uk welcome23.smile.co.uk www.welcome23.smile.co.uk egg.com www.egg.com new.egg.com www.new.egg.com moneybookers.com www.moneybookers.com inscape.com www.inscape.com bankcardservices.co.uk www.bankcardservices.co.uk alliance-leicester.co.uk www.alliance-leicester.co.uk cahoot.com www.cahoot.com icicibank.co.uk www.icicibank.co.uk natwest.com www.natwest.com nwolb.com www.nwolb.com mbna.co.uk www.mbna.co.uk businesscreditcardsonline.co.uk www.businesscreditcardsonline.co.uk capitaloneonline.co.uk www.capitaloneonline.co.uk welcome26.co-operativebank.co.uk www.welcome26.co-operativebank.co.uk welcome22.smile.co.uk www.welcome22.smile.co.uk service.citicards.co.uk www.service.citicards.co.uk citibank.co.uk www.citibank.co.uk scotwest.co.uk www.scotwest.co.uk secure.scotwest.co.uk www.secure.scotwest.co.uk partnerandaffinitycards.co.uk www.partnerandaffinitycards.co.uk esavingsaccount.co.uk www.esavingsaccount.co.uk firstdirect.com www.firstdirect.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
And now to make matters worse, if im browsing the internet via google, if i press the back button, it does not go back to the google page…but redirects me to this site
http://www.pieceofcakesearch.com/search?q=html%20help%20making%20a%20scroll%20box http://www.easyfastfind.com
or http://www.pctools.com via a redir.php - all of which i have never visited before…
Im also now getting popup warnings of malicious sites.
Im worried its something my boyfriend has installed through downloading the applications for various betting sites. could kill him!
I suggest:
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use MBAM (or SUPERantispyware or even Spyware Terminator ) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
Test your machine with anti-rootkit applications . I suggest avast! antirootkit or Trend Micro RootkitBuster .
(skip… already done) Make a HijackThis log to post here or this analysis site . Or even submit the RunScanner log to to on-line analysis.
Disable System Restore and then reenable it again.
Immunize your system with SpywareBlaster .
Check if you have insecure applications with Secunia Software Inspector .
I also suggest you clean your HOSTS file using HostsMan to replace your own Hosts file.
And one final thing ive noticed…all those banks in my log! I dont bank with any of those sites, nor does my boyfriend…to my knowledge ive never used any of those websites before in my life…
really concerned something sinister is afoot… :-\
Thanks so much… ill get on to that immediately and get back with any findings…
And one final thing ive noticed…all those banks in my log! I dont bank with any of those sites, nor does my boyfriend…to my knowledge ive never used any of those websites before in my life…
really concerned something sinister is afoot… :-\
I suggest http://www.abelhadigital.com/2007/06/hostsman-3040-released.html
system
May 5, 2009, 12:58pm
10
Katm, you did not post the top of the HijackThis log so please post a complete log after you have done the recovery.
By the way, Windows Defender monitors the HOSTS file in real time and alerts right away if it is modified:http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
I update Windows Defender daily by the use of its portal:http://www.microsoft.com/security/portal
Ok so ive just scanned with DrWeb and it found the virus
pp06.exe - Win32.HLLW.Facebook.61 i selected to cure it.
Only the one ;D
This is one of the worst logs I,ve seen for a while. I’m not telling you to fix any entries, just pointing out a few things.
C:\windows\pp06.exe ( removed ) http://www.prevx.com/filenames/2775659298005311240-X1/PP06.EXE.html
C:\windows\ld08.exe http://www.prevx.com/filenames/2483703353894347123-X1/LD08.EXE.html
C:\WINDOWS\system32\SYS32DLL.exe http://www.bleepingcomputer.com/startups/sys32dll.exe-7580.html
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,C:\WINDO WS\system32\userinit32.exe, http://www.bleepingcomputer.com/startups/twext.exe-23983.html
C:\WINDOWS\system32\brastia.exe http://www.prevx.com/filenames/1775153101563708332-X1/BRASTIA.EXE.html
There are other bad entries, I think this one is responsible for your redirections R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
If this was my pc I would wipe it clean and reinstall windows
that bad is it…
brastia i noticed too which i googled and found it to be malicious… how come the others arent picked up in a scan? So far ive run DrWeb and its found two viruses…both the facebook ones…both i have selected to cure.
Ive also run a scan with Superantispyware and it has found 9 Adaware so far and 1 Trojan.Dropper/Win-NV
Windows defender didnt pull up anything.
Im a little unsure what to do wth Hostsman as its now found 72 bad or suspicious hosts…what do i do there now? Delete them?
Im half a mind to wipe and start again but unfortunately i have so much data on this machine and nowhere to store it :-S plus i dont want to backup some files if they are still infected so they will get transferred back when i restart fresh.
how do i stop this one?
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
Thanks to all so far for the advice and links, really apprechiate your time and knowledge
Ok …ive done steps 1-4 just run an avast anti-root kit scan and found no other malware/suspicious content.
It should be noted that prior to getting online after system reboot my proxy server was refusing to connect me online…i noticed that the proxy open was set as localhost 7171 (is this the same place i seem to be getting HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171 from?)
I have set it to auto detect for now and i have gained connection back…is there anything else i can do with regards to this or is auto-setting it ok?
New HiJackthis scan coming right up…
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.skybroadband.com/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Where is the top part of the HijackThis log?
The top part is the part starting with
Logfile of Trend Micro HijackThis v2.0.2
The rest of it i posted on the previous page?? ??? I copied and pasted everything from the notepad save log…is that right?
How bizarre…it didnt post??
Ok, sorry about that…here it is again…
C:\WINDOWS\System32\smss.exe
I was looking to see that you had SP3 installed.
By the way IE8 is better than IE7 and equal to if not better than Firefox.
