Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
05-Apr-2007, 12:07 PM
#1 | |||||
| Solved: Big Problem Spyware(adware.maxsearch) trojan, cant run hijackthis My sister has a laptop she uses for her homework. It is a pentium 3 running windows XP so its quite old and not that fast as the modern laptops. A few days ago she noticed that everytime she restarted her computer a popup always appears. I saw this popup and it is a self extracting winrar archive. It appears for about half a second and vanishes. It appears to extract tcinstall.exe onto her desktop everytime her laptop restarts into windows. Later, randomly sometimes a norton popup appears, 'A suspected security risk has been blocked' then it does a quick scan, scanning for the file...destop/tcinstall.exe. Then it removes it. This is the same file that got extracted to the destop. After removal, later, randomly again norton shows the same popup with the same security message. But this file is not there. I look on the desktop and this file is not there. After the quick scan is completed, It says that it detected the spyware adware.maxsearch. In the quarantine, there is also some infected backups of adware.lop and trojan.dropper. The trojan dropper being detected september last year. (dont know if this has anything to do with this). When I manually try to delete the tcinstall.exe on her desktop, it wont let me and it says access is denied. Make sure that the file is not in use and is not write protected. I decided to try and use hijackthis to get a log and post it online. She didnt have hijackthis on her computer so I tried to search for it on the internet and download it. However the wierd thing is that when i try search for 'hijackthis' the after a few seconds the browser closes itself  . So I transferred my hijackthis from my computer to hers and tried to run it. But when I run the hijackthis program it automatically closes itself. The furthest I went while using hijackthis was when I almost finished doing a system scan with a log. That never finished and it closed itself. Now I cant get as far as the main GUI appearing.So I thought that there maybe a bad service running for a startup so I tried running services.msc and msconfig in the start > run. Same thing happens. The services.msc closes itself after a few seconds and msconfig, the window doesnt show up .I tried also opening regedit on start > run but the same thing happens as well. This is very strange.  So Im thinking the internet explorer and/or firefox browser may have been hijacked. But I am unable to get a hijackthis log from her computer. Most of the online scanners wont load in internet explorer and it either displays a connection error, crashes or closes down. Sometimes IE doesn't even load. I have managed to run kaspersky online scanner which was scanning well however at one point it just shut the laptop down. I have included an attachment of the properties of the extracted tcinstall.exe. Hope its useful. Updated: Superantispyware - I have read a few posts about running superantispyware. So I ran it. The first thing that happened was that it immediately showed a popup about detecting a harmful file. See screenshot. This was the trojan.svhosts. So my sister's laptop is infected with this trojan  The superantispyware scan almost finished scanning c:/windows then the laptop suddenly shut down.I have finally made hijackthis work by booting the laptop into safe mode. The hijackthis log will be the next post. Please help Thanks Last edited by hen99; 05-Apr-2007 at 06:18 PM.. |
| |
05-Apr-2007, 11:33 PM
#9 | |||||
| OK.... After using superantispyware to scan the whole laptop for the third time, but this was during normal windows, it did not shut down. The scan finished   . The scan results are below:SUPERAntiSpyware Scan Log Generated 04/06/2007 at 03:16 AM Application Version : 3.6.1000 Core Rules Database Version : 3190 Trace Rules Database Version: 1200 Scan type : Custom Scan Total Scan Time : 03:13:31 Memory items scanned : 0 Memory threats detected : 0 Registry items scanned : 6837 Registry threats detected : 24 File items scanned : 81984 File threats detected : 8 Adware.Tracking Cookie C:\Documents and Settings\JESSICA LEE\Cookies\jessica_lee@adopt.euroclick[1].txt C:\Documents and Settings\Guest\Cookies\guest@ads.monster[1].txt C:\Documents and Settings\Guest\Cookies\guest@kanoodle[1].txt Trojan.Svchosts HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX#NextInstance HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000 HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#Service HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#Legacy HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#ConfigFlags HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#Class HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#ClassGUID HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000#DeviceDesc HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000\Control HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CLIENT_IP-IPX\0000\Control#ActiveService HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#Type HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#Start HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#ErrorControl HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#ImagePath HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#DisplayName HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX#ObjectName HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Security HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Security#Security HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Enum HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Enum#0 HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Enum#Count HKLM\SYSTEM\CurrentControlSet\Services\Client IP-IPX\Enum#NextInstance C:\WINDOWS\SYSTEM32\SVCHOSTS.EXE Trojan.Unknown Origin C:\DOCUMENTS AND SETTINGS\GUEST\LOCAL SETTINGS\TEMP\NSS3.TMP\SYSTEM.DLL Worm.Alcra Variant C:\WINDOWS\SYSTEM32\NETSTAT.COM C:\WINDOWS\SYSTEM32\TASKKILL.COM Trojan.Downloader-UnSVCHosts C:\WINDOWS\SYSTEM32\UNSVCHOSTS.EXE |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 08:17 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile