trojan in my computer need help

[BeyondTheGrave]

i need some help. i know this is off topic but i have one of those trojan virus  in my computer and i cant get it out. i tryed spybot but it still cant get it out. i get these pop ups from my internet explorer but the thing is the program isnt running and when iam off line they still popup! i was wondering if anyone can help me. thanks.

"Dont be a fool for ur tool"

[Ash]

How many times have I told you that Trojan condoms aren't supposed to go into the floppy disk slot!

Hehe...jk.

Actually, to help you out we're gonna need a bit more information than what you've provided.

We need to know exactly what it's doing and the possible name of it.
You need to give more details for us to help.

[Ash]

Go here and download HijackThis:

http://www.spychecker.com/program/hijackthis.html

After you do a scan, copy and paste the ENTIRE scan results here so I can read it. (the results may be a long list)
 
It will look something like this:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.blazefind.com/search.php?search=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.blazefind.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchalot.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sharempeg.com/find/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchv.com/w/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.searchv.com/w/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchv.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchalot.com/search.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.searchv.com/w/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.searchv.com/w/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL



You must be VERY careful with HijackThis because it doesn't tell you what needs to be deleted like other programs do.
You have to know what to look for.
If you mess up and delete the wrong file you're screwed and could mess up your p.c. bad.

Once either I or someone else reads it who knows what we're looking for, we can tell you what item/s need to be checked and removed.

Again, make sure you paste ALL of the results here.

It doesn't sound like you have a Trojan....it sounds like you've got a really bad case of malware/spyware that Spybot S&D doesn't recognize.



Post Edited (05-09-04 16:43)

[BeyondTheGrave]

well my virus scan i got running the only thing it says is that i have a "trojan" and every time i try to move it to a quaratine file, delete or clean it, it always fails. the popups are contuinous and it says that its from my "mircosoft internet explorer" which i dont have running. even when iam not online i seem to get the pop ups even though it says "this page cant be found". and the popups are all stupid ads.

when i run my spybot i always get this "advertising.com"and is says "tracking cookie or cookie of tracking site". this one seems to always come back everytime i run spybot like its not getting fixed.

"Dont be a fool for ur tool"

[Ash]

Forget what your virus scan is saying....anything that delivers targeted pop-up ads even while IE isn't running is spyware.

Run HijackThis and I can probably guarantee it'll be there.

[BeyondTheGrave]

this is it ash:


C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTools\Updater\jre\bin\javaw.exe
C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
C:\Program Files\Creative\8xxx\bbui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\ClearSearch\Loader.exe
C:\Program Files\Common Files\slmss\slmss.exe
C:\WINDOWS\mwsvm.exe
C:\documents and settings\student\local settings\temp\58Sju.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\NCLAUNCH.EXe
C:\IBMTools\Updater\ucsmb.exe
C:\Program Files\America Online 9.0a\aoltray.exe
C:\WINDOWS\System32\dite.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\Program Files\America Online 9.0a\aolwbspd.exe
C:\Program Files\Intel\NCS\Sync\NetSvc.exe
C:\WINDOWS\System32\odbc32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\student\My Documents\My Pictures\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hkcu
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hkcu
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?new-hklm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekseek.com/quicksearch.asp?session=30F27414-DDAB-4053-904A-AF6A81380CA4&version_id=18
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by St. John's University
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://cpprod.stjohns.edu/cp/home/loginf"); (C:\Program Files\Netscape\Users\default\prefs.js)
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DefaultSearch.SeekSeek - {5074851C-F67A-488E-A9C9-C244573F4068} - C:\WINDOWS\ieasst.dll
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [UC_SMB] c:\ibmtools\updater\ucstart.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [QCTray] C:\PROGRA~1\ThinkPad\CONNEC~1\QCTray.exe
O4 - HKLM\..\Run: [bbui] C:\Program Files\Creative\8xxx\bbui.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\System32\stcloader.exe
O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe
O4 - HKLM\..\Run: [slmss] C:\Program Files\Common Files\slmss\slmss.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [Mwsvm] C:\WINDOWS\mwsvm.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [58Sju] C:\documents and settings\student\local settings\temp\58Sju.exe
O4 - HKLM\..\Run: [dite] C:\WINDOWS\System32\dite.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NCLaunch] C:\WINDOWS\NCLAUNCH.EXe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [odbc32] C:\WINDOWS\System32\odbc32.exe
O4 - Startup: Thumbs.db
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} - https://www-3.ibm.com/pc/support/access/sdccommon/download/tgctlins.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0EAF0F61-AAE2-4C91-8B8E-EC9EE45BD234}: NameServer = 205.188.146.146

[ulthar]

Or download Adaware from Lavasoft.  Sometimes with Adaware you will find things Spybot will miss.


One note, too.  With Windows computers, there are a LOT of shared files/code.  Windows is a very integrated system.  Soooo, you don't have to be actually running IE yourself for there to be an error or similar problem showing up as being in IE....something, somewhere is using a part of IE, which is very common in Windows systems.

After you get it cleaned up, get your necessary files backed up, etc, dump winders and switch to a real OS...Linux.  Man, I seem to be giving this comment almost daily on one board or another.  It's amazing how many headaches you will eliminate by doing this.

[Ash]

Checkmark and get rid of these:

O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekseek.com/quicksearch.asp?session=30F27414-DDAB-4053-904A-AF6A81380CA4&version_id=18
(seekseek is a browser hijacker)


O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL


O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL


O2 - BHO: DefaultSearch.SeekSeek - {5074851C-F67A-488E-A9C9-C244573F4068} - C:\WINDOWS\ieasst.dll


O2 - BHO: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll


O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
(I'm assuming Mybar is another browser Hijacker)


O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - C:\Program Files\QuickSearch\QuickSearchBar1_27.dll


O4 - HKLM\..\Run: [ClrSchLoader] C:\Program Files\ClearSearch\Loader.exe


O4 - HKLM\..\Run: [stcloader] C:\WINDOWS\System32\stcloader.exe


O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe


STC and Clrsearch are spyware...seekseek is a browser hijacker.
The Mybar and Quicksearch bars I believe are browser hijackers also...that is unless you PURPOSELY installed them.
If you've got a toolbar or 2 that just showed up out of the blue one day then they're Browser Hijackers.

I'm not sure about the TV Media one...you may want to have at least one other person who knows HijackThis to read the log....maybe they'll spot something I missed.

Make sure you restart your p.c. after you delete those checked entries.
Let us know if that fixed things up for you.



Post Edited (05-09-04 17:55)

[Ash]

I highly recommend you download and install SPYWAREBLASTER.

It runs in the background and prevents websites from installing spyware and browser hijackers onto your p.c.
It doesn't cost anything and they update the huge database all the time so you're always up to date.

Go here to read more info on it and download it:

http://www.javacoolsoftware.com/spywareblaster.html

Oh and if you do get it, make sure you download several new updates and make sure that "Protection is enabled" for everything!



Post Edited (05-09-04 18:03)

[BeyondTheGrave]

thanks ash for the help but iam still getting the pop ups not as muc h as before  but thier still coming. ill show the hijack to somelse and see if they could pinpoint some more stuff. thanks again for the help. if ur every in NYC and get in some trouble look up PO andrini :)

"Dont be a fool for ur tool"

[Mr_Vindictive]

Rich,

Email me.  I can get you a copy of PcCillin which will take it off for you.  For legal reasons though, I cannot post it here.

[JohnL]

If you go to the PC Protection forum on Freedomlist someone there might be able to help you. Several of the regular users are quite experienced at dealing with this kind of thing.

Another program you might be interested in is F-Prot which is an antivirus program. The DOS version is free for personal use and scans for all Windows viruses as well. The advantage to this is that if you boot in DOS mode (or from a DOS floppy), you can run it without Windows needing to be loaded. Since most viruses target Windows, if Windows isn't running, neither is the virus. My friend had a virus under XP and the removal tools weren't working for him, but the DOS version of F-Prot got it.

Of course, no antivirus program is 100% effective...



Post Edited (05-10-04 05:13)

[BeyondTheGrave]

finally i got it out. i downloaded ad-ware it got it out. i just like to thank everyone who took out time and helped me. thanks.

"Dont be a fool for ur tool"

[Jay]

After you get it cleaned up, get your necessary files backed up, etc, dump winders and switch to a real OS...Linux. Man, I seem to be giving this comment almost daily on one board or another. It's amazing how many headaches you will eliminate by doing this.

Amen.


Posting this through FireFox on Linux

[JohnL]

>After you get it cleaned up, get your necessary files backed up, etc, dump
>winders and switch to a real OS...Linux. Man, I seem to be giving this comment
>almost daily on one board or another. It's amazing how many headaches you
>will eliminate by doing this.

Of course then you have the problem of compatibility...