What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Stubborn Trojan Or Virus Hides Well

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I did some more research, found some info on worm.bagle.al, located and removed two files with names of the form winxp.exeopenopenopen &c from c:\windows\system32, Latest HJT log is below.

Is it possible there is a malware that spoofs NAV? I have been getting NAV messages that seem to be spurious, announcing presence of msjarun.exe, when NAV is not scanning, X for closing window is disabled as is Close option in taskbar popup. If one clicks OK on the message, afterwards there seem to be more problems, but today I started using Task Mgr to shutdown the dialog instead and have been making much better progress. When doing this, NAV icon in systray also goes away. I uninstalled NAV but I doubt NAV itself is the culprit.

Or maybe I've just been looking at this too long. You have been so incredibly helpful, and it has been a huge relief to have your help in working through this. Right now I am not observing any more evil symptoms. Is there anything I should be aware of or look for?

Thanks again for all your help.

Logfile of HijackThis v1.98.2
Scan saved at 4:10:30 PM, on 9/9/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
c:\hjt\heidi.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #17
This is a "leftover" from uninstalling Norton that needs fixed:

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

Other than that, the log looks real good. :thumbup:

Obviously you need some sort of virus protection. I'm not sure why your Norton wasn't working. But, almost every log I see that has a virus or worm in it aslso has some sort of AV program running.

You might look into installing AVG Free to replace your Norton.

I did some looking into all the virii I identified on your machine.

Here are the only files I could find that might have been downloaded by them thay you could search for:

b.jpg (location undertermined)

C:\WINDOWS\System32\MSCONFIG.DAT

Although, there may be other "bad files" on your machine. Some of the infections were capable of letting someone else on the net gain full control of your machine and download whatever they wanted.

Obviously, any system security was compromised. So any data you had on your machine (passwords, financial info, credit card numbers, etc.) has most likely been compromised.

Other than running the 3 virus scans I suggested earlier, I have a link to one more:

Bitdefender http://www.bitdefender.com/scan/licence.php

I've not heard on anyone with some of the other symptoms you have ("X" to close being disabled).

M68 :)
Post #18
Just a belated thank you! The computer in question seems to be clean - none of the tools reports a problem anymore and there are no more troublesome symptoms. Thanks for your help!
Post #19
Great!!!

I am glad we could be of assistance!!! :thumbup:

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.
(Personally I'm NOT recommending SP2 for XP at this time)

Post #20
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI