Trojan/Spyware Problem
 
  Tweaks.com
 Home    Members    Calendar    Who's On        Main Site
 




Trojan/Spyware ProblemExpand / Collapse
Author
Message
Posted 7/17/2003 6:31 PM
New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 1/3/2005 8:11 PM
Posts: 26, Visits: 1

I had what appears to be a trojan on my system.  After launching IE, suddenly my wallpaper was changed along with my startup page, and various other things.  After doing a full scan of my system, a couple of Trojans were found, along with some Spyware.


The problem is though even after removing them,  I can't change the Wallpaper on my Desktop because there is a tab missing on the Display Properties Window.


Any idea how I can fix this?


Also, the IE Titlebar text has been changed.


Any help appreciated.  Thanks.

Post #251
Posted 7/17/2003 6:31 PM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

Hi Spaceboy,


If you haven't already, please get Spybot S&D to clear out most of the spyware.
Short tutorial and download link here:
http://tomcoyote.org/SPYBOT/
After installing, first press Online, and search for, put a check mark at, and install all updates.
Next, close all Internet Explorer windows, hit 'Check for Problems', and have SpyBot fix everything it labels in red.



When you've done all that, go to
http://www.tomcoyote.org/hjt/
and download 'Hijack This!'.
Unzip, double-click HijackThis.exe, and hit "Scan".


When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log somewhere, load it in Notepad, and copy its contents here.


Most of what it lists will be harmless or even required, so do NOT fix anything yet.
Someone here will be happy to help you analyze the results.


Also , if I remember correctly, the NView/nvidia helper has a setting for this. If you have a Nvidia card, check it.



Cheers

Post #24068
Posted 7/17/2003 6:31 PM
New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 1/3/2005 8:11 PM
Posts: 26, Visits: 1

Logfile of HijackThis v1.95.1
Scan saved at 01:14:32, on 18/07/2003
Platform: Unknown Windows (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 (6.00.3790.0000)


Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Sygate\SPF\Smc.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\nvsvc32.exe
C:\Program Files\GeCAD\RAV8 Desktop\ravmon.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\GSICON.EXE
C:\WINNT\system32\dsl*gent.exe
C:\Program Files\GeCAD\RAV8 Desktop\ravtray8.exe
C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
C:\Program Files\SpamEater Pro 4\SpamEaterPro.exe
C:\Program Files\Pyrenean\eDexter\eDexter.exe
C:\Program Files\High Mountain Software\SpamEater Pro\Sep.exe
C:\Program Files\Trillian\Trillian.exe
C:\WINNT\Temp\Rar$EX00.834\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [GSICONEXE] GSICON.EXE
O4 - HKLM\..\Run: [Dsl*gENTEXE] dsl*gent.exe USB
O4 - HKLM\..\Run: [RAV8Tray] C:\Program Files\GeCAD\RAV8 Desktop\ravtray8.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\Smc.exe -startgui
O4 - HKCU\..\Run: [Popup Ad Filter] C:\Program Files\Meaya\Popup Ad Filter\PopFilter.exe
O4 - HKCU\..\Run: [SpamEaterPro] "C:\Program Files\SpamEater Pro 4\SpamEaterPro.exe"
O4 - Startup: ravmon.exe.lnk = C:\Program Files\GeCAD\RAV8 Desktop\ravmon.exe
O4 - Startup: Shortcut to eDexter.exe.lnk = C:\Program Files\Pyrenean\eDexter\eDexter.exe
O4 - Startup: Shortcut to Sep.exe.lnk = C:\Program Files\High Mountain Software\SpamEater Pro\Sep.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\Trillian.exe
O8 - Extra context menu item: Download &All using Mass Downloader - C:\Program Files\Mass Downloader\Add_All.htm
O8 - Extra context menu item: Download using &Mass Downloader - C:\Program Files\Mass Downloader\Add_Url.htm
O9 - Extra button: Mass Downloader (HKLM)
O9 - Extra 'Tools' menuitem: &Mass Downloader (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: HiDownload (HKLM)
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {28F00B0F-DC4E-11D3-ABEC-005004A44EEB} (Register Class) - http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.30/Hiwire.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E5E24CEA-3A2E-4EA4-9623-F1588E105CFE}: NameServer = 195.112.4.4 195.112.4.7

Post #24069
Posted 7/17/2003 6:31 PM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

A couple things Spaceboy.


 I can see a couple things in the HT log that could be causing problems with IE, but I would like to wait until Pieter can have a look. 


As far as the display tab missing , Click Start, Run and enter REGEDIT  Go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Look in the right pane for a value called NoDispBackgroundPage   If it
exists, it should read 0 (zero).  If not, double click it and change it to
0.  If it doesn't exist, right click in a blank area of the right pane and
select New, DWord value.   Name it NoDispBackgroundPage and leave it set at
0.

You may need to add the same value and setting to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System

as well. (from Doug Knox, MS-MVP Windows XP)


OR:


Restore the Desktop and Screensaver Tabs (Line 128)
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedits:  Save the REG File to your hard disk. Double click it
and answer yes to the import prompt. REG files can be viewed in Notepad by
right clicking on the file and selecting Edit.


Please back up your registry first.


 



Cheers

Post #24070
Posted 7/17/2003 6:31 PM
New Member

New MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew MemberNew Member

Group: Forum Members
Last Login: 1/3/2005 8:11 PM
Posts: 26, Visits: 1
Cheers.  That suggestion worked perfectly.  I've also managed to fix the IE problem after some searching.
Post #24071
Posted 7/17/2003 6:31 PM


Senior Forum Advisor

Senior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum AdvisorSenior Forum Advisor

Group: Senior Advisor
Last Login: 12/4/2005 12:31 AM
Posts: 4,743, Visits: 5

That's good news. 


I had already sent a PM to Metallica, he may drop by early Friday morning.



Cheers

Post #24072
Posted 7/17/2003 6:31 PM


Forum Security Advisor

Forum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security AdvisorForum Security Advisor

Group: Advisor
Last Login: 8/14/2007 12:45 PM
Posts: 263, Visits: 4
Check the following items in HijackThis.

Close all windows except HijackThis and click Fix checked:



R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =



I assume this is something you set yourself?

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/softAdmin.htm



Other than that your log looks fine.



Regards,



Pieter


Madly in anger with spyware



Post #24073
« Prev Topic | Next Topic »


Reading This TopicExpand / Collapse

All times are GMT -6:00, Time now is 10:33pm

Powered By InstantForum.NET v4.1.4 © 2008
Execution: 0.094. 12 queries. Compression Enabled.