Possible Trojan Executing Via Mshta

One of our networked PCs (NEC Powermate running XP) looks like it has a trojan that I can't identify or delete. The PC is running BitDefender antivirus, which detected something repeatedly executing mshta. A javascript message would flash up briefly. Using IE6, it appears that logins have been disabled e.g. the PC user can't access his Yahoo account - he just gets a message that the login has not been recognised. (Netscape browsers are not affected - of course!) I downloaded and installed HTAstop Program from nsclean, and then ran a virus check but BitDefender is still not finding anything. On restarting the PC, HTAstop prevents the malicious script executing and pops it up in notepad instead. The script reads as follows:
TG!  ¶’ò?²Ï# ª _þX
! Ò­cöëÏ°ã ª ? 

ÿÿÿÿ@  ¾"µÈó\Î­å ª Dw=   †  I  Á<Ž¶ëmЍö ª _þX c €

# m e a n i n g l e s s s h i t i h a d t o p u t h e r e  ÿ ÿ ÿ h ÿÿÿ# crap=" Can anyone help? Thanks Cas

Click here to download eScan's mwav application. Double-click it to run it, select all local drives, scan all files, press 'scan' and when it is completed, anything found will be displayed in the lower pane. Highlight it, CTRL C and paste it in your next reply.

Dear Daemon Ouch - the mwav app returned quite a list. I've sorted and numbered them into relevant groups below. ———————————————————————————– 1 - 9 all look relevant to this particular problem 1. File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta infected by "Trojan-Downloader.VBS.Psyme.at" Virus. Action Taken: No Action Taken. 2. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\D80FT141\writehta[1].txt infected by "Trojan-Downloader.VBS.Phel.a" Virus. Action Taken: No Action Taken. 3. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\ONT3A6BP\indexx[1].htm infected by "Exploit.VBS.Phel.a" Virus. Action Taken: No Action Taken. 4. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\UFE7MVHY\f00bar393[1].txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. 5. File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta infected by "Trojan-Downloader.VBS.Psyme.at" Virus. Action Taken: No Action Taken. 6. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\D80FT141\writehta[1].txt infected by "Trojan-Downloader.VBS.Phel.a" Virus. Action Taken: No Action Taken. 7. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\ONT3A6BP\indexx[1].htm infected by "Exploit.VBS.Phel.a" Virus. Action Taken: No Action Taken. 8. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\UFE7MVHY\f00bar393[1].txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. 9. File C:\RECYCLER\S-1-5-21-2008090692-776625034-1264475144-1004\Dc1.txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. ———————————————————————————- 10 - 12: not sure what these are 10. File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken. 11. File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken. 12. File C:\WINDOWS\system\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken. ———————————————————————————- 13 - 21 the user tells me that these are emails that were infected but have been cleaned up - am just adding them in case they look relevant to you. 13. \Trash infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. 14. \Junk infected by "Exploit.IFrame.FileDownload" Virus. Action Taken: No Action Taken. 15. \Inbox.sbd\correspondance infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. 16. \Inbox infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. 17. \Junk infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. 18. \Trash infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. 19. \Junk infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. 20. \Inbox infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. 21. \Trash infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. Many thanks for your help. Shall I just buy the MWAV app? Cas

Could you provide another mwavscan - unsorted (makes it easier for me to parse). Thanks

Sorry :) File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta infected by "Trojan-Downloader.VBS.Psyme.at" Virus. Action Taken: No Action Taken. File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\D80FT141\writehta[1].txt infected by "Trojan-Downloader.VBS.Phel.a" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\ONT3A6BP\indexx[1].htm infected by "Exploit.VBS.Phel.a" Virus. Action Taken: No Action Taken. File C:\DOCUME~1\joe\LOCALS~1\TEMPOR~1\Content.IE5\UFE7MVHY\f00bar393[1].txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta infected by "Trojan-Downloader.VBS.Psyme.at" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\mailbag.futuraoffice-1.com\Trash infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\mailbag.futuraoffice.com\Junk infected by "Exploit.IFrame.FileDownload" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\pop.clara-1.net\Inbox.sbd\correspondance infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\pop.clara-2.net\Inbox infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\pop.clara-2.net\Junk infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\pop.clara-2.net\Trash infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\pop.clara.net\Junk infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\smtp.bulldogdsl.com\Inbox infected by "I-Worm.NetSky.q" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Application Data\Mozilla\Profiles\default\a5mpwe6s.slt\Mail\smtp.bulldogdsl.com\Trash infected by "Trojan-Spy.HTML.Citifraud.ay" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\D80FT141\writehta[1].txt infected by "Trojan-Downloader.VBS.Phel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\ONT3A6BP\indexx[1].htm infected by "Exploit.VBS.Phel.a" Virus. Action Taken: No Action Taken. File C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\UFE7MVHY\f00bar393[1].txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. File C:\RECYCLER\S-1-5-21-2008090692-776625034-1264475144-1004\Dc1.txt infected by "TrojanDownloader.JS.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken. File C:\WINDOWS\system\RESTORE.INS tagged as not-a-virus:NetTool.PsKill. No Action Taken.

Click here to download Pocket Killbox by Option^Explicit. Extract it from the zip file to your desktop.

Start Killbox, copy and paste each of the following lines into the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each. Keep track of any files it tells you either could not be found or could not be deleted, as you'll need those later:

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta
C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\D80FT141\writehta[1].txt
C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\ONT3A6BP\indexx[1].htm
C:\Documents and Settings\joe\Local Settings\Temporary Internet Files\Content.IE5\UFE7MVHY\f00bar393[1].txt

For the files that it either couldn't find or couldn't delete, in the killbox again this time, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer NO until after you've pasted the last file name, at which time you should answer Yes.

Reboot if it doesn't do so automatically. Empty your Recycle bin and delete the inefected emails if they are still on your system.

Let me know how it is now.

Perfect. He says he's acquired a few more viruses in the meantime, but has cleaned these up using the same method. Many thanks for all your help, that's very much appreciated. We'll certainly make a contribution to the site. Have a good weekend Cas

You're welcome - glad to help

To help keep you clean follow the recommendations in Tony's article here:

So how did I get infected in the first place?



As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.