Hi! New here & looking for advice - avast shows an infection of Win32:Trojano-213, located in C:\WINNT\UnstaSA2. I have read the advice at the top of this forum
My system is win2k, sp4, with all updates. Sygate firewall, all updates applied. I found the file and ran avast specifically on that file - avast again reports the trojan. This file’s properties page has nothing on it except a version #, file name, and creation date of may 25,2004.
Here is my HiJackThis file:
Logfile of HijackThis v1.97.2
Running processes:
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dllhttp://office.microsoft.com/templates/ieawsdc.cab http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://www.pcpitstop.com/internet/pcpConnCheck.cab http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab http://download.yahoo.com/dl/installs/yinst0401.cab http://office.microsoft.com/officeupdate/content/opuc.cab http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38074.6488541667 http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab http://www.commandondemand.com/eval/cod/cabs/cssweb.cab http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab http://pcpitstop.com/antivirus/PitPav.cab
Hello-
this seems to be bad…
O2 - BHO: (no name) - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O4 - HKLM..\Run: [Gtablet] C:\WINNT\system32\gtablet.exe
→ Is this stuff known/wanted ?
I didn’t find anything about “UnstaSA2” via google, which is not an indication that it’s useful/needed…
→ you might want to send in the file tovirus@avast.com and ask for analysis…
system
July 4, 2004, 11:10pm
4
madmax - I don’t believe that the sound card is a yamaha - it is embedded in MB, & named VIA AC’97 Audio Controller (WDM).
whocares -
the gtablet.exe is a drawing tablet, hardware; so that is ok
Viewpoint is a search bar from yahoo.com (only shows up in i.e., which I only use when I have to, as in windows update)
When I typed “UnstaSA2” in google, my computer shut down! I assume that happened because I have the file?? maybe not??
As far as software, here is a list of startup programs:
System Information report written at: 07/04/2004 07:05:10 PM
Program Command
system
July 5, 2004, 12:02am
5
Found more into about the file:
http://www.a2zhelp.com/products/pcspy/
Looks like spyware to me
system
July 5, 2004, 12:38am
6
Sandra-
@echo off
-max
madmax, thank you! I took your advice and deleted the file with no problems. Did not want to delete a file that was important to the os, so thanks again for helping me to work thru this.
I am rescanning with avast, just to make sure.
system
July 20, 2004, 10:25am
8
Hi All,http://www.a2zhelp.com .http://www.a2zhelp.com/removeapp.asp
Secondly, this is for Sandra2613 and other who mentioned about PC Spy,
Regards
system
July 20, 2004, 11:16pm
9
Thank you for your response to my problem. Hope you have good luck in tracking down the person(s) responsible.
Sandra
system
July 21, 2004, 4:08am
10
Help I have the Win32:Trojano-123 virus in my C:\temp files. I don’t what to do and am not computer smart. I have tried to clean, delete, repair but it says it is unable to this. I have already tried going into disk clean up but it still remains. What should I do?
system
July 21, 2004, 5:22am
11
Hi Cindy,
welcome on board…
please read the link “VirusRemoval” below, and then come back with more info:
exact location/folder/name of trojan file
maybe results of onlinescanners
Hijackthis-Log
What happens if you move/delete the file after booting in safeMode, or via a boot-time scan with avast ?
system
July 31, 2004, 9:53pm
12
Okay, i have something of the same problem here… I keep getting, atleast once a day this stupid trojano-213 virus, something to the extent that cindy does… where it puts a temp folder in my c drive… i usually delete it, then restart with a boot scan… I have installed a firewall, thinking that might help stop the problem, but the virus just keeps on coming back…
ache
July 31, 2004, 10:05pm
13
Giving more details like what windows version and what Avast version would be very nice
Good luck, and post any problems you encounter here.
system
July 31, 2004, 10:39pm
14
info from hijack this program…
Logfile of HijackThis v1.98.0
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=2484 http://searchcentral.cc/index.php?v=4&aff=2484 http://www.onestepfilms.net/ http://public.windupdates.com/get_file.php?bt=ie&p=5515fe605c52658b09a2d8f8784291e01d242c98fad134389acefa3cb0f9ce15fea9eafe13e208c45d4551a46272ed56a280b8c6901fb4898fecf364b6d6:28e9b69987bf58e8942c5c6546c7d1fb http://www.mt-download.com/MediaTicketsInstaller.cab
system
July 31, 2004, 10:40pm
15
and there is that webrebates thing there that i can never figure out where it came from as well…
ache
July 31, 2004, 10:47pm
16
As I thought. Many harmfull things there. Copy/paste the log here and remove all harmfull things, after that, run HJT again and use the anlayzer that you can download from the site in my signature and remove everything it reports to be removed. Let me (us) know when you have done so and what the remaing problems are.
system
August 1, 2004, 12:10am
17
i did it a couple times, and this is what comes up now
Logfile of HijackThis v1.98.0
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=2484 http://searchcentral.cc/index.php?v=4&aff=2484 http://www.onestepfilms.net/
system
August 1, 2004, 12:39am
18
Try using PestScan,I have a link to it on my site
system
August 1, 2004, 2:27pm
19
I have been actively deleting this same virus about every other day (it was about 3 times a day). As soon as I go into the web it pops up with the virus. I delete it but I don’t know if it is really gone. I have been on the web for removal tools and it has worked but it just keeps coming back. It was worse before but since I have deleted temp files before going on the web it seems not to hit me as much. I now have it happening on my email as well. Sometimes worms, sometimes trojan. It is a big pain! >:(
system
August 1, 2004, 11:12pm
20
Okay, im still getting this damned virus, and all these scanners tell me i have spyware even though i have two spyware programs… this is just getting out of hand…
and have run adadware, spybot, trendmicro, kaspersky, symantec - none report the infection.
That way we can give better/more specific help. In the mean time click on the linl in my signature. And read how pro’s deal with infected systems. Big mouth, me? Perhaps, but after working with comps for over 24 years and being the owner of two companies (both comp related) I believe I am in title to say so ;D