Subscribe to How-To Geek

Welcome to the How-To Geek Forums

We encourage you to register on our forums and post any questions you might have. The How-To Geeks monitor this forum and will respond to your question quickly.

How-To Geek Forums » Windows Vista

trojan attack

(14 posts)
  • Started 1 year ago by nithinram
  • Latest reply from jd2066
  • Topic Viewed 648 times

nithinram
nithinram
Posts: 68

I have windows vista ultimate.When i started my computer a dialogue box appeared saying you arer infected by an unknown trojan.click ok to download an antyspyware program.when i clicked ok i was taken to a site and i ran an online virus scan which detected trojanspm/lx.Previously i had ran windows defender and asquared free and both detected an infection each which was removed.But the dialogue box is appearing again.Please help me.Sorry i double posted in hurry

Posted 1 year ago #
Top
 
Lighthouse
Lighthouse
Posts: 5573

We need more information on which trojan it was.
Have a look in ASquared report/log

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

category:
trojan downloader
description:
this program has potentially unwanted behaviour
resources
process:
pid2096
regkey
hklm\software\microsoft\windows\currentversion\uninstall\securebrowsing
uninstall
hklm\software\microsoft\windows\currentversion\uninstall\securebrowsing
file
C:\programfiles\netproject\sbun.exe

Posted 1 year ago #
Top
 
Appletom
Appletom
Posts: 117

trojanspm/lx is one of those viruses that tries to trick you into buying bogus anti-virus software. Remember, your anti-virus software will take care of any viruses you get - it's not a good idea to click "OK" on a dialog box telling you to 'click here' to get rid of a virus or spyware. Once you do that, the "online virus check" you ran most likely did more damage than good.

A Google search for trojanspm/lx will bring up a number of links to detailed information for removing.

Posted 1 year ago #
Top
 
Lighthouse
Lighthouse
Posts: 5573

Thanks Appletom. I missed that bit

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

guys i scanned my pc with avg and it detected the trojan.but the message kept on displaying and explorer.exe was not working.when i looked today the screen was gray with windows is not genuine sign in the bottom.My vista is oem version.but i dont have a recovery partition.instead i have xp.my vista is genuine and i have validated it a no of times.please help.

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

someone please help me

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

Logfile of HijackThis v1.99.1
Scan saved at 5:24:58 PM, on 3/21/2008
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\Explorer.EXE
E:\setup files\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: e404 helper - {0D574C9F-71F9-4F3C-BA6D-CF9C0E1E3EE8} - C:\Program Files\Helper\1205843832.dll (file missing)
O2 - BHO: (no name) - {1F831238-6E25-4B14-8DD2-F89CAA093089} - C:\Windows\system32\xxyvv.dll (file missing)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: QuickTalk 2.1 - {CF26FAC0-7D4E-46D8-AE64-B277B11443AC} - C:\Windows\System32\iesearch.dll
O2 - BHO: Windows Media Player - {D5A7151F-58D0-4AC8-9329-BEDD59625679} - C:\Windows\wmpdxm.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\jkkij.dll,#1
O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{FF8E13FE-48E0-48D8-848E-E25AD72FF25C}: NameServer = 218.248.240.23,218.248.240.135
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: igfxcui - C:\Windows\SYSTEM32\igfxdev.dll
O23 - Service: a-squared Free Service (a2free) - Unknown owner - E:\program files\a-squared Free\a2service.exe (file missing)

here is the log file of hijack this.

Posted 1 year ago #
Top
 
jd2066
Justin
Posts: 3792

If your install somehow got unactivated you can try reactivating it by going to Control Panel\System and Maintenance\System and clicking the activate link at the bottom.

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

PC is in reduced functionality mode .But i acnt even start web browser or anything

Posted 1 year ago #
Top
 
jd2066
Justin
Posts: 3792

Is there an Activate Online or by phone (Or similar) button on the main dialog you can click?

Posted 1 year ago #
Top
 
nithinram
nithinram
Posts: 68

no.my screen is 100% blank.

Posted 1 year ago #
Top
 
whs
whs
Posts: 10348

I would do a repair/reinstall. Whith a mess like yours, that's probably the easiest way out: http://vistaultimate.windowsre.....tartup.htm

Posted 1 year ago #
Top
 
jd2066
Justin
Posts: 3792

So you don't have a Window like the one at http://www.tweakvista.com/Article39153.aspx?
If so that is not reduced functionally mode. You have a different problem.
Not sure what though.

Posted 1 year ago #
Top
 

RSS feed for this topic

Reply

You must log in to post.

Our Friends
Getting Started


About How-To Geek
What Is That Process?
svchost.exe
jusched.exe
dwm.exe
ctfmon.exe
wmpnetwk.exe
mDNSResponder.exe
wmpnscfg.exe
rundll32.exe
wfcrun32.exe
Ipoint.exe
Itype.exe
Wfica32.exe
Mobsync.exe
conhost.exe
Dpupdchk.exe Adobe_Updater.exe

Copyright © 2006-2009 HowToGeek.com. All Rights Reserved.