1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

New Msblast Varient

Discussion in 'Virus & Other Malware Removal' started by MSBLASTed, Sep 9, 2004.

Thread Status:
Not open for further replies.
  1. MSBLASTed

    MSBLASTed Thread Starter

    Joined:
    Sep 9, 2004
    Messages:
    1
    Looks like the LovSan author broke up with san... and wrote a new ms blast virus...
    This one (Sometimes) shrinks the taskbar and makes it so that tasks dont appear in the taskbar. You cant control copy, drag and drop icons and you can't surf the web with IE. Im typing this through Mozilla Firefox which is luckily not embedded in windows xp.

    It's got completely different registry keys, so the normal virus scanners and MSBLST removers cant remove it... and I here is a Picture:

    [​IMG]

    i will post my hijac this log thorugh another comp. H/o

    Logfile of HijackThis v1.98.2
    Scan saved at 4:52:30 PM, on 9/9/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Cyb2k.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\vet32.exe
    C:\Documents and Settings\Saul D\Desktop\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.emachines.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 169.254.0.1:80
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [VetTray] C:\PROGRA~1\CA\ETRUST~1\ETRUST~1\VetTray.exe
    O4 - HKLM\..\Run: [C2K] C:\WINDOWS\Cyb2k.exe
    O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\SpyHunter\SpyHunter.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D7ACDB12-9DD3-49EE-AA94-4EF81335CC53}: NameServer = 169.254.0.1
     
  2. WhitPhil

    WhitPhil Gone but never forgotten Trusted Advisor

    Joined:
    Oct 4, 2000
    Messages:
    8,684
    First, uninstall HJT from the desktop and install it into a "real" folder, otherwise you will have backups all over your desktop.

    Then, run it again and select and delete the following and see if that resolves the problem?

    If not, post back a new log.

    As well, Click here to download getservice.zip and unzip it to your desktop. Open the Getservice folder and click on the getservices.bat file. A notepad will open up with a long list of Services. Please save that notepad file and attach it to your next reply to this thread. It will be easier to attach it rather than copy and paste because it will be too long to paste in one post.

    You also say "It's got completely different registry keys"
    What are you seeing?

    O17 - HKLM\System\CCS\Services\Tcpip\..\{D7ACDB12-9DD3-49EE-AA94-4EF81335CC53}: NameServer = 169.254.0.1
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/272173

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice