wolf3
Topic Starter
I just ran Webroot Spysweeper and it identified " Trojan Horse: NSIS Media Extension"
FYI
Spyware / Malware / Virus Removal
Webroot Spysweeper identified NSIS
6 min read
Micah_6:8
Where is it being found?
wolf3
spy sweeper's log says; HKLM\software\nsis\media\(4 subtraces) (ID=1571094)
Micah_6:8
Please download/unzip this:
Registry Search by Bobbi Flekman
on regsearch.exe, and search for this:
nsis
It may take a while to run, so be patient. When finished, the search results will appear in your text editor,
Paste the contents of the search results into your next post.
Registry Search by Bobbi Flekman
on regsearch.exe, and search for this:
nsis
It may take a while to run, so be patient. When finished, the search results will appear in your text editor,
Paste the contents of the search results into your next post.
wolf3
REGEDIT4
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0
; Results at 8/14/2006 12:34:03 PM for strings:
; 'nsis'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Panose]
; Contents of value:
;
"Transistor"=hex:00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5BACC17E-BDF7-405B-BC68-ECB506395118}"="NSIS Media Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
"DisplayName"="NSIS Media Extension"
"UninstallString"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe"
"DisplayIcon"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Transistor Regular (TrueType)"="C:\\Program Files\\Common Files\\Broderbund\\Core Fonts\\TRANSIST.TTF"
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
"InstDir"="C:\\Program Files\\Common Files\\NSIS\\"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="nsis media"
"001"="nsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\NSIS"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU]
"a"="C:\\Documents and Settings\\Carl Larsen\\My Documents\\hijackthis2runnsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\Program Files\\Common Files\\NSIS\\ns70.dll"
; End Of The Log…
Micah_6:8
Spysweeper can inhibit registry changes, so you may need to disable it for these changes to be made.
Copy and paste the contents of the quote box below into notepad.
Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.
Then, locate fixme.reg on your desktop and it.
You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".
Reboot.
Give Spysweeper another run.
Copy and paste the contents of the quote box below into notepad.
Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\NSIS]
Then, locate fixme.reg on your desktop and it.
You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".
Reboot.
Give Spysweeper another run.
wolf3
I did what you said and ran spy sweeper, here is the log
1:02 PM: | Start of Session, Monday, August 14, 2006 |
1:02 PM: Spy Sweeper for MSN started
1:02 PM: Sweep initiated using definitions version 739
1:02 PM: Starting Memory Sweep
1:06 PM: Memory Sweep Complete, Elapsed Time: 00:03:47
1:06 PM: Starting Registry Sweep
1:06 PM: Found Trojan Horse: nsis media extension
1:06 PM: HKLM\software\nsis\media\ (4 subtraces) (ID = 1571094)
1:06 PM: Registry Sweep Complete, Elapsed Time:00:00:14
1:06 PM: Starting Cookie Sweep
1:06 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00
1:06 PM: Starting File Sweep
1:10 PM: uninst.exe (ID = 329369)
1:33 PM: File Sweep Complete, Elapsed Time: 00:26:32
1:33 PM: Full Sweep has completed. Elapsed time 00:30:36
1:33 PM: Traces Found: 6
1:33 PM: Quarantining All Traces: nsis media extension
same as always , it quarantines that one file , but it keeps coming back.
what should I do with that "fixme"? Do I have to undo what you had me do before?
Micah_6:8
Run the registry search again (same as before), and post the results again.
Be sure all the boxes are checked under "Search".
wolf3
REGEDIT4
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0
; Results at 8/14/2006 3:03:57 PM for strings:
; 'nsis'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Panose]
; Contents of value:
;
"Transistor"=hex:00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5BACC17E-BDF7-405B-BC68-ECB506395118}"="NSIS Media Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
"DisplayName"="NSIS Media Extension"
"UninstallString"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe"
"DisplayIcon"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Transistor Regular (TrueType)"="C:\\Program Files\\Common Files\\Broderbund\\Core Fonts\\TRANSIST.TTF"
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
"InstDir"="C:\\Program Files\\Common Files\\NSIS\\"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="nsis media"
"001"="nsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\NSIS\\Media"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU]
"a"="C:\\Documents and Settings\\Carl Larsen\\My Documents\\hijackthis2runnsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\Program Files\\Common Files\\NSIS\\ns70.dll"
; End Of The Log…
Micah_6:8
the fixme.reg file again, and allow it to be merged.
Then do the regsearch once more and post the results.
These should disappear if it worked:
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
"InstDir"="C:\\Program Files\\Common Files\\NSIS\\"
Is this folder still present on your machine
C:\Program Files\Common Files\NSIS
Then do the regsearch once more and post the results.
These should disappear if it worked:
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
[HKEY_LOCAL_MACHINE\SOFTWARE\NSIS\Media]
"InstDir"="C:\\Program Files\\Common Files\\NSIS\\"
Is this folder still present on your machine
C:\Program Files\Common Files\NSIS
wolf3
REGEDIT4
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0
; Results at 8/15/2006 8:13:11 AM for strings:
; 'nsis'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Panose]
; Contents of value:
;
"Transistor"=hex:00,00,00,00,00,00,00,00,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5BACC17E-BDF7-405B-BC68-ECB506395118}"="NSIS Media Extension"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NSISMedia]
"DisplayName"="NSIS Media Extension"
"UninstallString"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe"
"DisplayIcon"="C:\\Program Files\\Common Files\\NSIS\\uninst.exe,0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
"Transistor Regular (TrueType)"="C:\\Program Files\\Common Files\\Broderbund\\Core Fonts\\TRANSIST.TTF"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Search Assistant\ACMru\5603]
"002"="nsis media"
"003"="nsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit]
"LastKey"="My Computer\\HKEY_LOCAL_MACHINE\\SOFTWARE\\NSIS\\Media"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU]
"a"="C:\\Documents and Settings\\Carl Larsen\\My Documents\\hijackthis2runnsis"
[HKEY_USERS\S-1-5-21-2000478354-261903793-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dll]
"a"="C:\\Program Files\\Common Files\\NSIS\\ns70.dll"
; End Of The Log…
wolf3
I looked for common files\nsis and there was 8 NSxx.dll there and uninst.
A McAfee window came up and said" PUP Found" it then deleted the 8 dlls. It did not ID "uninst"
I ran a full scan and McAfee found nothing else.
I rebooted and one dll was back.
Micah_6:8
Delete this folder:
C:\Program Files\Common Files\NSIS
Reboot.
Check to be sure it's still gone.
Is Spysweeper satisfied at this point?
C:\Program Files\Common Files\NSIS
Reboot.
Check to be sure it's still gone.
Is Spysweeper satisfied at this point?
wolf3
I have tried that , delete the folder , reboot , its right back. Spysweeper always finds just the one file.
Micah_6:8
What's the name of the file?
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI