Avast has detected “VBS:Agent-IL” a couple of times trying to access mshta.exe
The trojan seems to be located in the following path every time - C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\xxxxxxxxxx\ and is in a file called “jhkhj[1].htm”
There are sometimes multiple copies of this file in this cache.
After Avast has detected this in the background I have run a full scan and restarted to do a boot scan where Avast removes jhkhj.htm.
When I have rebooted and run in normal Windows for a while this trojan reappears however. I have also tried booting into safe mode and manually deleted all files in this cache which has the same result.
I do not use Internet Explorer (but have v8 installed). I use Firefox v3.6.13 and Avast Pro v5.1.889.
I have also scanned with Malwarebytes which does not pick the trojan up.
I have also noticed that I cannot do file searches in File Explorer or print in Outlook Express v6.
Ran the above (which cleared 2+ Gb of temp files) and also downloaded and run Super Anti Spyware (which found Trojan Agent:Gen-Nullo).
Been working on laptop for around an hour and Avast has background scanned jhkhj[1].htm in C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\MXRBOCE5 trying to access mshta.exe again.
I’ve noticed since I’ve rebooted 3 other cache folders have been created with nothing in.
I’ve run hijackthis and attached a new log before I reboot.
To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( OTL.Txt and Extras.Txt.)
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
For the restore do you get a blank calendar ?
When you try to get windows updates what error do you get ?
I saw no indication of a password stealer - but it is always prudent after an infection to do the following
One or more of the identified infections is a backdoor Trojan and a key logger.
If this computer is ever used for on-line banking, I suggest you do the following immediately:
Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.
From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.
Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.
For the restore I click on Start Menu > Help and Support and an hourglass briefly shows but then nothing. Tried in Safe Mode as well but it appears something has disabled it.
For Windows Updates when I click on Start Menu > Windows Update it loads IE8 to the following address http://windowsupdate.microsoft.com/ and I get a white screen and nothing more. I can browse the rest of the Microsoft site apart from that page. I’ve reinstalled IE8 and checked all the ActiveX controls but nothings working. I’d just use Firefox or Chrome but they just bring up a page saying I need to use IE5+.
I do have Automatic Updates turned on and the system does update itself but I wanted to check through the traditional interface that I was all up to date. Plus its irritating and worrying when things don’t work.
Fixed Outlook Problem by installing Thunderbird : (its a much better program than it was last time I used it)
Enable hidden and system files in Explorer if you haven’t done so already. To do this, open Control Panel | Folder Options | View, and in Advanced Settings under Hidden Files and Folders, select “Show hidden files and folders,” Below that, uncheck “Hide protected operating system files.” (You will probably want to restore this option later.)
From Start | Run, type %SystemRoot%\inf and press Enter.
Find the file named sr.inf. Right click on it and select Install.
You may be prompted for your Windows installation media, or a directory on your hard drive that has the \i386 folder. If you installed Service Pack 2 (as opposed to installing a version of Windows XP with SP2 preinstalled), use the folder %SystemRoot%\ServicePackFiles\i386 .
Let me know how that goes - it should take no more than 10 minutes
Not uninstalled and reinstalled SP3 yet but I’ve fixed the problems with System Restore and Windows Update via IE8 with the following link where I reregistered Jscript.dll
(its a much better program than it was last time I used it)