What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Win32 Trojan

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
I've also now found a folder in C:\ titled submit. I did not create this. It contained the files that killbox was supposed to have deleted. Someone please help…
Post #17 last edited
This may sound strange but I am not lying. I've noticed since this is how I found about the trojan earlier but every time Adaware scans Avast pop ups and says it has detected the trojan. So now I have 3 in quarentine. They each have differant names though. They are: C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C30538125\152A4 C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C1853265\6C5B3 C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C17709484\9D752 This may seem a little out there but does it sound like i'm dealing with a hacker? The trojans behavior is a little to strange dont you think?
Post #18
A fourth Win32:Trojan-gen. {other} has been found in my temp. internet files. I found this on my own (I wasnt scanning with Adaware). All the trojans filenames are wildapp.dll by the way.
Post #19
Here's my latest log. Its been awhile since the previous one:

Logfile of HijackThis v1.99.1
Scan saved at 7:24:05 AM, on 7/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\System32\igfxtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
Post #20 last edited
I'm sorry for not posting sooner.

We were gone all yesterday afternoon, and after we did get home we had thunderstroms rumbling thru until after midnight. I don't use the PC during electrical storms.

These files:

C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C30538125\152A4
C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C1853265\6C5B3
C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C17709484\9D752

Are produced by Adaware so they qren't a threat. Does Adaware find items each time you scan?

The C:\submit file isn't a threat either since it's from Killbox.

The log doesn't show any parsites.

Does the trojan "wildapp.dll" continually reappear after deletions, or is the problem that you can't remove it?
Post #21 last edited
Thanks again for your help Micah. Actually those are done away with thanks to BitDefender and Trend Micro. I still dont know why certain files are being moved around and i'm going to look into this but for the time being i'm sitting pretty secure. I'm going to make an effort into doing more online scans in the future. Speaking of online scans, I went to Panda Scan and while it was downloading some of the Active X controls, Avast indentified one of them as a trojan. Honestly I dont know what to think of Avast at this point (I might just go back to AVG). Have you heard of it doing this to anyone else? As for Adaware yes everytime it scans the pop up alert comes up and says it found a trojan. Actually the same trojan. And they do re-appear as it looks right now. Any idea? Also, I booted into safe mode and scanned with Adaware and Avast didnt pop up. I was going to try and remove the things from the virus chest but I wasnt able to access it in safe mode. I've heard so many great things about Avast but this is strange behavior. Identifying adware as trojans? And only when Adaware is scanning? Sounds almost comical to me. What do you think?
Post #22

I went to Panda Scan and while it was downloading some of the Active X controls, Avast indentified one of them as a trojan.


Has to be a "false positive". The Panda scan is entirely safe (as you are already fully aware of).

Adaware yes everytime it scans the pop up alert comes up and says it found a trojan. Actually the same trojan


What trojan (file name(s) please)?
Post #23 last edited
Win32:Trojan-gen.{other} I have 4 of them now. Also, I shut down my computer last night and when I got up I booted it up and as the computer was loading I got a little pop up saying something like generic Win32 backweb is unable to connect. By luck I noticed I hadnt turned my modem on :P or else I probably wouldnt have noticed it was running. When I did the online scan it did detect some spyware (SPYW FPTLBAR.100) and got rid of it. I checked my processes (before the online scans though) and couldnt find anything bad. What do you think? Oh, one more thing, the online scans also found some lop.com adware if that can be of any help. It deleted them all.
Post #24
:oops:

What I meant was that I wanted the "full path names" of the "infected" files that keep appearing. I apologize for not being clearer.

I don't see any infections or malware in the log file.

Do you have Adaware and Spybot configured like this?

Configure Adaware

Configure Spybot
Post #25
C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C30538125\152A4 C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C1853265\6C5B3 C:\DOCUME~1\Owner\LOCALS~1\Temp\AAWTMP\C17709484\9D752 C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\6XL272TS\WildApp[1].cab I've since deleted my temporary internet files (they were really racking up). Avast detected the fourth one. Adaware and Spybot still dont detect anything (i'm going to click on the links and configure them right now though). I'll scan again afterwards and post back. See what you can come up with…
Post #26
You should just be able to delete all those files with windows explorer. You may not be able to delete the last one if you have IE open. I'm going to be gone this afternoon and evening as well, so I may not get to look at your next post or reply until tomorrow. :)
Post #27
Well it looks fine now. I really didnt have to change anything with Adaware and Spybot's configuration. I do have good news though, the Avast pop up didnt go off and both programs didnt find anything so it looks like i'm in the clear. I'm going to go ahead delete those "trojans" from quarentine and pray they dont come back. Thanks for everything Micah and if anything comes up i'll post again in the forum. Hope the storms dont get ya down as we're expecting some too here in Michigan. Either way i'm just going to kick back and have a cold beer. God bless….
Post #28
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI