What the Tech logo
Welcome! Register for a free account (or login) > How does it work?
  1. Quickly register. It will only take 60 seconds.
  2. Start a new topic. Ask your question. Wait for an email reply.
  3. Is your system infected? Begin reading the malware removal guide.
register button
Closed TopicStart new topic
> Persistent Trojan, Problems to determine the Trojan
Momoka
post Apr 3 2006, 06:16 PM
Post #1


New Member
*

Group: New Member
Posts: 8
Joined: 3-April 06
Member No.: 52,851
Operating System: Windows XP professional



Hi Guys,

I have a problem, and a very hiding one as well.

Everytime when my clock changes from 11:59pm to 12:00am(so midnight), my InternetExplorer will go up, and try to open up something, a page or a file. The IE will not open a full window; the only thing visible(at least bevore)is a minimized window. I could only read part of the address it was try to reach(since it was minimized), it started with "Res://mshtml.dll ". The IE tries that only for a brief second, and closes right away ... too fast as you could open that window and read the full address bar(it even closes bevore you can klick it). It trys this for a few times, then stopping.
Now, after i installed a new IE(i changed my registry, so that windows thinks i not have a IE installed)i will not even see the minimized window, all i hear is like there wants a window be opened but blocked or closed right away.
I did serval McAfee scans, a DOS McAfee scan, Spybot checks and so on ... without any success. I cann't seem to make out what is on my system.

Here my Hijackthis log:
-----------------------------------------------------------------------------------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 1:17:42 AM, on 4/5/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\CTHELPER.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\DiskeeperLite\DKService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\System32\oobe\csrss.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
D:\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,23/mcgdmgr.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{6D80D988-4459-4B9A-B4F2-4B10384ADE79}: NameServer = 195.50.140.252 195.50.140.114
O21 - SSODL: Windows Update - {459FA2B2-E4C2-13D4-CA84-03501F45B839} - C:\WINDOWS\System32\oobe\csrss.exe
O21 - SSODL: Battery Monitor - {459352B2-D4CE-13D4-2D78-03501003EF20} - shlapiw32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\DiskeeperLite\DKService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
-----------------------------------------------------------------------------------------------------------------------------

I hope that someone can tell me what this thing is, that bothers me. I not want to reinstall everything anew(i did install my system completely new, since i got a new motherboard, graphic card and soundcard 2 weeks ago, and last week this problem started), and find out that i get that little bugger again ASAP once i go online.
Go to the top of the page
 
+Quote Post
 
Start new topic
Replies
Momoka
post Apr 6 2006, 03:11 PM
Post #2


New Member
*

Group: New Member
Posts: 8
Joined: 3-April 06
Member No.: 52,851
Operating System: Windows XP professional



Hi Susan,

First of all ... these programs are nice, but i cann't afford to buy them all sad.gif. Sadly they not have a version that you not need to pay for. Spybot Search and Destroy is on my PC long time, thats a good proggy ^^. For the Windows updates, i not like the SP2, becouse it eats up my system performance like candy. I had it once on my system, and all of a sudden it ran 30% slower(maybe even 40%).

For the two files, what does it mean that theyre "very generic trojans"? I know that a Trojan is a software that spys and sends information out into the web, somethimes downloading things to the infected PC. But what does "generic" mean? Would you please explain that to me?

Again, thanks for all you've done for me ^^
Go to the top of the page
 
+Quote Post



Closed TopicStart new topic

 


RSS Time is now: 18th March 2010 - 09:40 AM
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy