[CJSquibb]

I have a friend who has reported that she "picked up a Trojan". She runs McAfee Security Center v9.15 on a Dell Dimension E521 desktop PC with an Athlon 64 X2 dual core processor and Windows XP Home edition ver 2002 SP 3.

I tried to run the Kaspersky online scanner, but evidently that is not available "at the moment". Panda online would not run. My next choice was the BitDefender online scanner. I had a bit of trouble getting it to update virus definitions, but eventually was able to run it and it gave me the message 'Trojan.Heur.TP.cm4@byY1abm found in c:\Windows\System32\msls50.dll'. It was unable to disinfect or delete this file.

Can I safely delete this DLL file manually? I have since scanned the file using McAfee and also using the single file scan option on the Kaspersky site, but both say this file is clean.

Or do I need to take a leap and do the whole HJT thing, which will be a new experience for me!

[Elvandil]

If they couldn't delete it, you probably can't either.

In any case, dll's cannot cause any problems unless they are executable. The presence of a dll usualy means that the main app is elsewhere and deleting it is pointless since it will just be recreated.

In other words, it is probably just the tip of the iceberg and you should do the whole log in Malware.

[CJSquibb]

Thanks, though worrying...

I'll probably have to take this up seriously on the Malware Removal forum in a day or two when I can take time to concentrate.

[flavallee]

Download and save Trend Micro HijackThis 2.0.3, close all open windows first and then install it in its default location, then run a scan with it - which will take less than 30 seconds, then save the resulting log in Notepad, then return here and copy-and-paste the entire log here. After that's done, click "Report" and request your thread be moved to the malware section. Once it's been moved, a gold shield malware expert will have your log already available to view and examine.

Do you have "hands on" access to that computer, or are you having to deal with the problem over the phone with your friend?

-----------------------------------------------------------------

[CJSquibb]

At the moment I have downloaded Windows Defender and am running a scan with it, but we've both got things on tonight so have had to leave it going. I was also advised to scan with a 30-day free trial version of Kaspersky Internet Security (which is the protection program I use at home). Maybe one of those will find and/or fix it...

However, in the likely event that after that we'll still be in this position, I will have hands on access, as she's a neighbour, but won't be able to devote time to the problem till Wednesday now (it's Monday night here). I wouldn't fancy anything this complicated over the phone, it's bad enough trying to explain email attachments to my dad, LOL!

I have downloaded HijackThis 2.0.3 and will take it in on a USB stick and install it there then. It's a beta version - I hope it'll work OK! I'll take my own laptop in too, in case I need to use it for posting.

So it'll be a day or two before I can get back, and I just hope there will be advisors online in the UK's morning!

Thanks

[Elvandil]

There can be a problem trying to eliminate an infestation after it has already taken hold. It can prevent anti-virus from installing or running properly so that it remains undetected. The HJT log will help, as would an "offline" scan when Windows is not running.

Some programs, most notably Spybot S&D, have prepared for that eventuality. It contains files with randomly-generated names and unusual executable endings, like scr, so that it can still execute but cannot be attacked by malware since the random names can't be planned for. It is not the best tool in the shed, but it does have that advantage. If installed to an uninfected computer and then updated, you can also copy the entire Program Files folder to a USB stick and run it from there by clicking on sdmain.exe.

[CJSquibb]

Excellent - I'll give Spybot a go too, then. I presume copying the whole of Program Files is so it has all its randomly named bits?

[Elvandil]

Just all the Spybot folder in Program Files, not all of Program Files.

It is luckily one program that will run without any other supporting files. You can't do that with most and have them work.

When you run it on another machine, it will think it is a new installation and you will have to "Next" through the preliminary questions until you get to the page with the "Start the program" button on it.

[CJSquibb]

Lovely - this is very helpful thanks! I should be able to try that tomorrow as I will have a little time although I do have some other commitments. So that's probably as far as we can take it tonight. Many thanks for your help (so far! ;-) ).

[CJSquibb]

Thanks for your advice yesterday.

Today, I installed the 30-day trial of Kaspersky Internet Security, ran a scan and it was clean. Followed your instructions on Spybot: installed it on my home mechine, copied its folder from my Program Files to a USB stick, then ran it from that on my friend's computer. First pass, half a dozen tracking cookies, did a Fix, then second pass clean.

Then I installed HJT. It gave error messages on scanning - I attach a screenshot of the first - but then gave this log:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 17:45:43, on 09/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=6061123
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.search.yahoo.com/search?fr=mcafee&p=%s
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-418146424-531501346-2728560686-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-21-418146424-531501346-2728560686-500\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\klo ehk.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 8847 bytes

[CJSquibb]

Well, I managed to submit the HJT log, but am having trouble with your next instruction:
QUOTE
After that's done, click "Report" and request your thread be moved to the malware section.
END QUOTE (don't know how to do that properly either, LOL!

Can't see anywhere to click "Report"...

I'll have to sign off now anyway, but at least have this clear.

I have seen no sign myself of a trojan - apart from yesterday's BitDefender scan - but my friend was alerted by her bank's fraud department who trapped a false "bill payment" for £1500.

I will be able to spend proper time with this tomorrow. (it's 6p.m. here now).

Many thanks

[CJSquibb]

Dur, just found it. Please move this thread to the Malware forum.

Many thanks.

[flavallee]

The startup entries in bold type in Start - Run - MSCONFIG - OK - Startup(tab) can be unchecked to prevent them from auto-loading during startup and running in the background. Some of them don't need to auto-load and run at all and some of them can be manually started when needed.

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-21-418146424-531501346-2728560686-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')

O4 - HKUS\S-1-5-21-418146424-531501346-2728560686-500\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Administrator')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

If you want to research the startup list yourself, this site will assist you.

[CJSquibb]

Sorry, I'm very new to this. Do you want me to remove the bold entries from startup in MSConfig and then redo the HJT log? Or just get rid of them and everything else is OK?

[flavallee]

I got called away before I finished my last reply to include the services list.

Do the following in the order listed:

Go into Start - Run - MSCONFIG - OK - Startup(tab), then uncheck all entries except for:

AVP or avp.exe

ctfmon.exe or ctfmon.exe

DLA or DLACTRLW.EXE

HP Digital Imaging Monitor or hpqtra08.exe

(Note: .exe may not be present in the file name)

After you're done, click Apply - OK - Exit Without Restart.

Go into Start - Run - SERVICES.MSC - OK, then expand the window to see the list clearly.

Double-click on(or right-click on and then click Properties on):

Google Update Service (gupdate) (gupdate) - Google Inc.

Google Software Updater (gusvc) - Google

NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation

If "Startup Type" is set on Automatic, change it to Manual and then click Apply - OK. You have to do one entry at a time.

After you're done, close the window and restart your computer.

When the small "System Configuration Utility" window appears, ignore the message. Put a checkmark in that window and then click OK.

Start HijackThis and run a scan, save the log and then post it here.

Run your computer for awhile and confirm that everything is still working alright. You should notice a shorter startup time and some improvement in overall performance, but don't expect a drastic change.

-------------------------------------------------------------------