4 replies to this topic

[JayTee]

Dear Tom Coyote
While on the internet today I had a popup saying that I was dangerously vulnerable to the backtera malware virus, and should download an 'anti-virus' or 'anti-spyware' program. This appeared to be a Windows message, but I'm not entirely sure if it was genuine. It tried to link me to 'Win' Antivirus/spyware downloads which I did not click on.

I have AdAware SE Personal and Spybot, also AVG (Free edition) which I keep daily up to date with downloads and scans.

The only sign that there might be a virus on my computer is that I cannot download the latest update from AdAware - the system tells me there is an update of 22 May, but when I download it and press the 'finish' button I see it has not properly downloaded - or at least, that it still reads only the previous update of 17 May.

Scans are still going through without any spyware/malware/viruses coming up.

I notice there have been quite a few updates over the past few days, which could mean more frequent malware/virus activity, perhaps a Windows vulnerability?

Can't find 'backtera' mentioned on AVG.

This is my HJT log:-

Logfile of HijackThis v1.99.1
Scan saved at 18:58:08, on 23/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\John\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk...y.shtml?id=1769
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{018DC3CB-BAA1-4993-A156-CA41433FFD07}: NameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{245F25DE-DEB0-4B4B-B235-957FAB1CC1F7}: NameServer = 10.0.0.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{018DC3CB-BAA1-4993-A156-CA41433FFD07}: NameServer = 194.168.4.100 194.168.8.100
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe



Grateful for any advice you can give
Best wishes

JayTee, London

[Micah_6:8]

Your log is clean.

Good thing you didn't click that link.

The so called "backtera malware virus" is a ruse to get you to click the link... Then you really would be infected!!!

It's one of the oldest cons.. They infect your PC with something, then sell you a "cure".

About your Adaware, there's a link in this post that you can use to download the latest definitions manually.

You should do it this way:

1. Navigate to your Adaware folder (probably C:\Program Files\Lavasoft\Ad-Aware SE Personal)

2. In that folder, you'll find a file named defs.ref. That's the latest definitions file. <right-click> on the defs.ref file, and rename it to defs.old. This will give you a "backup" in case the rest of this doesn't work.

3. Go to that link I posted above, and download/unzip the file into the same folder you found the defs.ref file in.

That should do it.

If it won't download, or unzip properly, just rename defs.old back to defs.ref, and you haven't lost anything.

M68

[JayTee]

Dear M68 Many thanks for your helpful reply. There was some such suspicion in my mind about that popup, and I'm glad I didn't respond to it. In the meantime my 22/05 AdAware update has downloaded OK, but I'll keep your e-mail and link in case I do need to download manually at some point - and thankyou for the advice. All best wishes JayTee Prov 13:14 "The teaching of the wise is a fountain of life, so that one may avoid the snares of death"

[Micah_6:8]

Proverbs 27:17 As iron sharpens iron, so one man sharpens another. (New International Version)

[Micah_6:8]

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.