system
October 7, 2004, 1:28am
1
hello:
I’ve been unable to remove JS:TrojDnldr-1 [Trj] despite repeated attempts. Everytime I start the computer many IE windows would automatically open. Avast would give virus warning of JS:TrojDnldr-1 [Trj], but is unable to repair or move to chest because it ‘can not access the file’. Deleting it does not help, because the virus comes back when I restart the computer. I disabled system restore, scanned with Spybot and Adaware, to no avail. The following is the hijackthis log…I really hope one of you experts out there can help me out with this…thank you!!
system
October 7, 2004, 1:28am
2
Logfile of HijackThis v1.98.2
Running processes:
R3 - Default URLSearchHook is missinghttp://www.google.ca/ ”); (C:\Documents and Settings\Jeff\Application Data\Mozilla\Profiles\default\qagvdv86.slt\prefs.js)http://public.windupdates.com/get_file.php?bt=ie&p=154b113bf9603f46c731d769ed14a3bf2ae0a757064ee9bd5449e0fdd44e86d07944db10fe19f321ee033a2b9400d793bd2bfc09b6fd8079524c2d257aed07c9:008ad1ceed4ba741c45e80016782b89b http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,64/mcinsctl.cab http://207.188.7.150/1436a16ccc5adbd58d03/netzip/RdxIE601.cab http://www.parallelgraphics.com/bin/cortvrml.cab http://69.56.176.75/webplugin.cab http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,11/mcgdmgr.cab
system
October 7, 2004, 1:30am
3
by the way I’m using windows XP and netscape for browser.
Eddy
October 7, 2004, 8:05am
4
Click on the link in my signature and follow all steps on that page.
Let us know if that solved the problem.
system
October 7, 2004, 2:26pm
5
format c: /flattening the system and setting it up PROPERLY would be probably faster
→ read the “BACKDOOR” section in the link below “VirusRemoval”
system
October 7, 2004, 4:06pm
6
Hello. Thanks for your replies. Does this mean my computer is affected by a backdoor? If yes, is it active?
Is reformatting my C drive my only option left?
system
October 7, 2004, 4:08pm
7
here’s the new log after doing all the things I described above
Logfile of HijackThis v1.98.2
Running processes:
R3 - Default URLSearchHook is missinghttp://www.google.ca/ ”); (C:\Documents and Settings\Jeff\Application Data\Mozilla\Profiles\default\qagvdv86.slt\prefs.js)http://public.windupdates.com/get_file.php?bt=ie&p=154b113bf9603f46c731d769ed14a3bf2ae0a757064ee9bd5449e0fdd44e86d07944db10fe19f321ee033a2b9400d793bd2bfc09b6fd8079524c2d257aed07c9:008ad1ceed4ba741c45e80016782b89b http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,64/mcinsctl.cab http://207.188.7.150/1436a16ccc5adbd58d03/netzip/RdxIE601.cab http://www.parallelgraphics.com/bin/cortvrml.cab http://69.56.176.75/webplugin.cab http://www.mt-download.com/MediaTicketsInstaller.cab http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,11/mcgdmgr.cab
Eddy
October 7, 2004, 4:18pm
8
Have a look HERE and fix everything that is reported as bad.
Log created on : 10-07-2004 18:43:54
You are using the latest version of HijackThis.http://windowsupdate.microsoft.com and install ALL security patches/updates.
\windows\system32\sysentry.exehttp://www.google.ca/ ”); (c:\documents and settings\jeff\application data\mozilla\profiles\default\qagvdv86.slt\prefs.js)http://public.windupdates.com/get_file.php?bt=ie&p=154b113bf9603f46c731d769ed14a3bf2ae0a757064ee9bd5449e0fdd44e86d07944db10fe19f321ee033a2b9400d793bd2bfc09b6fd8079524c2d257aed07c9:008ad1ceed4ba741c45e80016782b89b http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/quicktimeinstaller.exe mcafee.com operating system class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,64/mcinsctl.cab http://207.188.7.150/1436a16ccc5adbd58d03/netzip/rdxie601.cab http://www.parallelgraphics.com/bin/cortvrml.cab http://69.56.176.75/webplugin.cab http://www.mt-download.com/mediaticketsinstaller.cab http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,11/mcgdmgr.cab
\documents and settings\jeff\application data\rrsa.exe
o4 - hklm..\run: [tkbellexe] c:\program files\common files\real\update_ob\evntsvc.exe -osboot
system
October 7, 2004, 4:29pm
9
[quoteJ
it is the only sensible option, if you value the security of your system/data
see for yourself → Hijackthis-Analysis:http://hijackthis.de/logfiles/4c0397ab137ed0e373606129306ff83f.html
several of the red nasties are active Backdoor-Worms !!
if you don’t want to/can’t format:
fix everything with hijackthis that’s marked RED in the above analysis,
and also the F1-entry
BEFORE fixing, kill any of the processes/files corresponding to the red-entries
after fixing, schedule a boot-time scan & reboot immediately
but keep in mind that only a format & PROPER re-install of WIN
system
October 7, 2004, 9:36pm
10
Thank you both so much for your help!! I wish the world has more altruistic individuals like you than the authors of the malware that make ppl’s life miserable. >:(
The windows have seem to stopped popping up. I will definitely reformat my drive in the near future. Are there any specific things I should look out for when I reformat (I’ve never done it before)
Again thank you so much
Eddy
October 7, 2004, 10:05pm
11
Before formatting have the following ready:
Have a full installation cd of Windows (or a recovery cd)
Make sure you have a firewall and av software on cd so you can install them before going online.
Make sure you have all drivers. (mobo, soundcard, videocard, modem, network card, etc.)
Backup data you want to keep before formatting.
Have info on your network/dial up settings ready.
After formatting and installing the above, immediatly visit Windows Update and get/install ALL security patches.
Microsoft had released totally free update cd’s with many patches/updates. They stopped supplying it, but maybe someone there has one you can borrow. Will safe you a lot of download time.
