system
October 25, 2004, 12:06pm
1
Hello all,
I have a fairly common problem. My computer is infected with Trojano-213. Despite attempts to get rid of it it appears daily. I have recently run the following programs (all are upto date with the latest patches/downloads:
a-squared
Subsequent to this I have run Hijackthis. The log follows and is also attached. My OS is Win 2000 Prof with all SPs and updates.
Any help will be greatly appreciated as I have already spent hours trying to sort this out.
Thanks in advance.
Duckula
Logfile of HijackThis v1.97.7
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php http://google.icq.com http://www.curtin.edu.au/ http://www.naupoint.com/toolbar/ie.html sitefinder.verisign.com OpenOffice.org 1.1.lnk = C:\Program Files\OpenOffice.org1.1\program\quickstart.exehttp://messenger.zone.msn.com/binary/msgrchkr.cab http://public.windupdates.com/get_file.php?bt=ie&p=dd8db6eae7b3654038237d0b84b1b7592a7c740cb737386283389eb86c385c56bc11960de953afc8b0f8ea2e3d3e128ba9221d51f15727809397a79e20e8b65ea7:ca217fc8f18ffa8896bcf1e0be69801e http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab http://naupoint.com/toolbar/installer/iEBINST2.cab http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37838.3843287037 http://www.microsoft.com/security/controls/GDI/0/GDIChk.CAB http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
DavidR
October 25, 2004, 1:23pm
2
Hi, welcome to the forums.
It would be helpful to know the following:User’s FAQ
Your hijackthis is not the latest version.
A visit to Eddy’s HiJackThis Info and Analysis page, HiJackThis log file analyzer
There you can get the latest version of hijackthis plus his analysis tool which will help you with what to fix, etc.
This thread should also help General Advice & Tools for virus/trojan/malware removal
system
October 25, 2004, 2:17pm
3
Thanks for the response.
Since my initial post I have got the lastest version of hijackthis and gone to hijackthis.de and used the analyser. All identified nasty stuff has been fixed using hijack this. Time will tell if the trojan will show up again tomorrow. It seems to reincarnate itself every 24 hours or so. Should it return, then I’ll try this forum again. Meanwhile I think I have learned some useful things from this forum regarding sorting out this kind of problem.
Duckula
Eddy
October 25, 2004, 2:32pm
4
This is what my HJT log analyzer is reporting:
You are using a old version of Hijackthis, please update.
r0 - hklm\software\microsoft\internet explorer\search,searchassistant = http://www.naupoint.com/toolbar/ie.html sitefinder.verisign.com http://messenger.zone.msn.com/binary/msgrchkr.cab http://public.windupdates.com/get_file.php?bt=ie&p=dd8db6eae7b3654038237d0b84b1b7592a7c740cb737386283389eb86c385c56bc11960de953afc8b0f8ea2e3d3e128ba9221d51f15727809397a79e20e8b65ea7:ca217fc8f18ffa8896bcf1e0be69801e http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab http://messenger.zone.msn.com/binary/minesweeper.cab31267.cab http://naupoint.com/toolbar/installer/iebinst2.cab http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab http://messenger.zone.msn.com/binary/messengerstatsclient.cab http://v4.windowsupdate.microsoft.com/cab/x86/unicode/iuctl.cab?37838.3843287037 http://www.microsoft.com/security/controls/gdi/0/gdichk.cab http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://ax.phobos.apple.com.edgesuite.net/detection/itdetector.cab http://tools.ebayimg.com/eps/activex/epscontrol_v1-0-3-0.cab
o4 - hklm..\run: [createcd50] “c:\program files\common files\adaptec shared\createcd\createcd50.exe” -ropenoffice.org 1.1.lnk = c:\program files\openoffice.org1.1\program\quickstart.exe
Also analyze your log HERE and fix everything that is reported as bad/nasty, reboot and create new log. And please use the latest version of HijackThis.
system
October 28, 2004, 10:36am
5
Hi
I am still struggling with Win32:Trojan0-213[trj]. The file identifiesd by avast is C:/Temp/Installer2.exe. This file returns daily at about the same time in the evenign!
My most recent action was to start in safe mode and delete all temp files. I wasn’t sure if this included files in folders such as AU_Temp and others similarly named. I am guessing that any file in such a folder is not entirely necessary. I also switched on so I could see and delete invisible files. I have done my best to follow all of the general instructions I have found on this site.
Here is my latest Hijackthis file - which according to hijackthis.de is returning almost exclusively ‘safe’ items.
Any further suggestions would be welcomed. This thing seems difficult to beat.
Duckula
Logfile of HijackThis v1.98.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php http://google.icq.com http://www.curtin.edu.au/ OpenOffice.org 1.1.lnk = C:\Program Files\OpenOffice.org1.1\program\quickstart.exehttp://messenger.zone.msn.com/binary/msgrchkr.cab http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
Eddy
October 28, 2004, 11:05am
6
Not much harmfull detected, except for DAP which is ADWARE!
o4 - hklm..\run: [downloadaccelerator] c:\progra~1\dap\dap.exe /startuphttp://messenger.zone.msn.com/binary/msgrchkr.cab http://messenger.zone.msn.com/binary/minesweeper.cab31267.cab http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab http://messenger.zone.msn.com/binary/messengerstatsclient.cab http://ax.phobos.apple.com.edgesuite.net/detection/itdetector.cab http://tools.ebayimg.com/eps/activex/epscontrol_v1-0-3-0.cab
o4 - hklm..\run: [createcd50] “c:\program files\common files\adaptec shared\createcd\createcd50.exe” -ropenoffice.org 1.1.lnk = c:\program files\openoffice.org1.1\program\quickstart.exe
system
October 30, 2004, 3:52am
7
Hi Everyone
Just a note to say I have ridded my machine of the trojan. Thanks to Eddy and his suggestions. Here are the things I did that seemed to result in eventual success:
Run Avast at boot up.www.hijackthis.de )
So far the trojan has not shown up again (it was doing so every 24 hours). I have also ran the following programs on my system:
Adaware
It feels great to have a clean machine - so all of you out there fighting to get rid of various annoyances - take heart that it can be done (I spent a good 4-5 hours before getting rid of this trojan). And again big kudos to Eddy.
duckula
system
November 10, 2004, 3:36am
8
Hi,
I’m not very good with computers, every 24 hours or so im gettingWin32:Trojano-213 [Trj]
Also please can you tell me what this Virus can do… Like what damage it causes… Thanks
DavidR
November 10, 2004, 1:05pm
9
Have you not tried to follow the information contained in this thread (my first post, etc.)?
Please Help us to Help you In order to help fully we need more information…User’s FAQ
system
November 10, 2004, 1:14pm
10
This is an ADWARE, which changes your IE Search-behaviour:
->INFO<-
& work through above advice
P.S.:
Currently, BlazeFind has uninstall instructions at:
http://blazefind.com/?section=help
(See steps 7 and 8).
system
January 14, 2005, 9:11am
11
First of All Here is my SysInfo:
Windows 2000 Pro SP4 with IE 6.0.2800.1106
I have Avast! v4.5 running all access scanners and automaticly updating daily
Also SpyBot S&D v1.3 Latest detection Update of 1-6-2005
Hyjak Logfile
Logfile of HijackThis v1.99.0
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\program files\partypoker\IEExtension.dllPartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\program files\partypoker\IEExtension.dllhttp://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab https://java.sun.com/products/plugin/autodl/jinstall-1_4-windows-i586.cab http://a19.g.akamai.net/7/19/7125/1435/ftp.coupons.com/v3123/cpbrkpie.cab
Hyjak Logfile End
Can’t seem to make heads or tails of removing this virus? The name of the file it was found in was: Key2.txt - Deleting this does not seem to work - it comes right back?? Below is my most recent warnings? Can anyone help??? My computer seems to be bogging down awfull…
1/14/2005 3:00:22 AM Administrator 1220 Sign of “Win32:Trojano-213 [Trj]” has been found in “C:\WINNT\Key2.txt” file.
system
January 14, 2005, 12:28pm
12
No software firewall detected. If you are not using a
search bar = http://my.netzero.net/s/search?r=minisearch http://my.netzero.net/s/search?r=minisearch
files\nzsearch\searchenh1.dll
missing)
files\bingonova lobby\osix.exe (file missing)
c:\program files\bingonova lobby\osix.exe (file missing)partypoker.com - {b7fe5d70-9aa2-40f1-9c6b-12a255f085e1} - c:\program
files\partypoker\ieextension.dllpartypoker.com - {b7fe5d70-9aa2-40f1-9c6b-12a255f085e1} -
c:\program files\partypoker\ieextension.dll
c:\winnt\web\related.htm
c:\winnt\web\related.htm
http://dl.filekicker.com/send/file/128985-nzil/phpsetup.cab
https://java.sun.com/products/plugin/autodl/jinstall-1_4-windows-i586.cab
http://a19.g.akamai.net/7/19/7125/1435/ftp.coupons.com/v3123/cpbrkpie.cab
o4 - hklm..\run: [sunjavaupdatesched] c:\program files\java\j2re1.4.2_06\bin\jusched.exe
Edit:
DavidR
January 14, 2005, 12:37pm
13
Have you not tried working through the information and suggestions above.
The links in my previous post are in blue and are general for the removal of trojans/malware. Did you visit Eddy’s site? there is a wealth of information there.
For an on-line scan of your Hijackthis log file try here http://hijackthis.de/index.php
