TrojanNameshifter

[arr418]

Please help...
I don't know all that much about computers and no one else seems to know what to do about this.
A certain member of my family picked up a nasty bug the other day by the name of " Trojan.Startup.NameShifter.BQ" and it seems to be ravaging my computer.
Microsoft Antispyware has been scanning all day and so far there are over 250,000 signatures attached to it. I'm at a loss.
Someone suggested that I restore my computer to an earlier date but today is the only available date.
Any ideas?
Like I said I don't know all that much about computers but I am excellent at following instructions. Any advice you can offer would be extremely appreciated.
Thanks in advance
Anne

 

[smbd]

May be you should try using another antivirus? Microsoft Antispyware isn’t the best choice. But, in my opinion, you will have to reinstall your OS in any case …

 

[cherber]

Download Hijackthis and extract it to its own folder on the c: drive. You can get the latest version here: Hijackthis!

Close all open browser windows, start the program and do a scan only. DO NOT tell hijackthis to fix anything yet. Click on "save log" and copy and paste the log into the thread. Then don't do anything until a mod or a distinguished member comes to help analyse the results.



**edit**
If you don't get a response and your post drops off the page, feel free to bump to get it back up.

 

[arr418]

Hey guys
thanks for your help. I finally got rid of my Trojan.Startup.Nameshifter problem thanks to Hijackthis. I am still having problems with files that are trying to add themselves to the startup registry. Microsoft Antispyware pops up every few minutes asking if I'd like to allow or block. I am blocking them until someone who knows better can tell me what to do with them. Any suggestions based on this summary. Thanks again
Annie

One last thing... Yahoo antispy keeps bringing up a CWS.Feads hijacker file that I've removed many times yet everytime I run the scan it is back again. Does anyone know what this is and how I should (if I should) get rid of it?

Logfile of HijackThis v1.99.1
Scan saved at 8:57:47 PM, on 7/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\mfcrc.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Nhksrv.exe
C:\WINDOWS\System32\PackethSvc.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Yahoo!\browser\YBrowser.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: Class - {B824C0E3-2D3F-4C0D-C74F-6A9E9873BE3B} - C:\WINDOWS\system32\iekl32.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mfcrc.exe] C:\WINDOWS\system32\mfcrc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [applo.exe] C:\WINDOWS\applo.exe
O4 - HKLM\..\RunOnce: [sdkkg.exe] C:\WINDOWS\system32\sdkkg.exe
O4 - HKLM\..\RunOnce: [crjn32.exe] C:\WINDOWS\crjn32.exe
O4 - HKLM\..\RunOnce: [addcs.exe] C:\WINDOWS\addcs.exe
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\Program Files\Yahoo!\Common\ylogin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM95\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: PRDIE - {CD9640E6-A36D-4EFF-B2E6-E4FE27728058} - C:\Program Files\Privacy Defender\prd.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\GameClient.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{08DCF5CB-CEE0-4552-B0EF-9EBDC0C189BE}: NameServer = 68.94.156.1 151.164.1.8
O23 - Service: Network Security Service (NSS) ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\applo.exe" /s (file missing)
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\System32\PackethSvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe