Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Help! MSN Messenger Virus[RESOLVED]

Started by kanmm , Apr 18 2005 08:56 PM

  • This topic is locked This topic is locked

#1
kanmm
Posted 18 April 2005 - 08:56 PM

kanmm

    New Member

  • Member
  • Pip
  • 3 posts
I recently accepted and ran something that came across MSN Messenger. It typed in for the person i was talking to "check this out" (or something to that effect) and i ran it. As soon as i did, it opened all the people on my MSN list and sent them the same file with a message from me saying "check this out." I checked taskmanager and there was a "project1.exe" running. I ended it and restarted my computer. Upon restart I got the messages "Cannot find 'C:\Program'", "Could not load or run 'C:\Program' specified in registry", "Cannot find 'C:\files\msn7\msn.exe' (I think it was 'C:\')" and "Could not load or run \files\msn7\msn.exe'" I did an AVG scan, Microsoft Antispyware scan, and Spybot S&D scan, with nothing other than a few tracking cookies showing up. I downloaded Hijackthis and Hijackthis analyzer and this is the log. Please help, I don't have a clue what to do (I'm not that computer literate). Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 8:54:51 PM, on 4/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE
C:\WINDOWS\system32\winshvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\winshvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Nic\Desktop\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mytelus.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://mytelus.com/
F3 - REG:win.ini: load=C:\Program Files\msn7\msn.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Camera Detector] C:\PROGRA~1\ACDSYS~1\DEVDET~1\DEVDET~1.EXE -autorun
O4 - HKLM\..\Run: [Windows Sz Host] winshvc.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [Windows Sz Host] winshvc.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Windows Sz Host] winshvc.exe
O4 - HKCU\..\RunServices: [Windows Sz Host] winshvc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Euchre - http://download.game...nts/y/et1_x.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1111810597484
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  • 0

Advertisements

#2
woody1977
Posted 18 April 2005 - 09:30 PM

woody1977

    Member

  • Member
  • PipPipPip
  • 146 posts
Edited by Geek U Moderator

Edited by ScHwErV, 24 April 2005 - 09:15 AM.

  • 0

#3
somelodic
Posted 20 April 2005 - 02:24 PM

somelodic

    New Member

  • Member
  • Pip
  • 1 posts
hey i'm having the EXACT same problem. I ran my virus scans and adware scans and it found nothing. But everytime i restart these 4 messages come up saying "cannot find c:/program, remove it from registry". and i can't get rid of it. I really don't want to go through reformatting my comp so i'm trying to find out what virus it is so i tried W32.Kelvir.D removal tool cuz someone told me thats what the virus was called but that didn't work either.

so i'm kinda stuck and need help desperatly.
  • 0

#4
kanmm
Posted 20 April 2005 - 08:26 PM

kanmm

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
If you want to post help in the Malware Removal forum here at GTG, you need to be a staff member. Click here to join Geek U.

ScHwErV :tazz:

Edited by Geek U Moderator

Edited by ScHwErV, 24 April 2005 - 09:13 AM.

  • 0

#5
thesteveman
Posted 24 April 2005 - 07:22 AM

thesteveman

    New Member

  • Member
  • Pip
  • 1 posts
Hey, I got hit by this MSN garbage today... *hits self for stupidly clicking that link*

I got rid of the files using hijackthis, but I'm curious about something:

Are there any registry keys that need to be deleted or fixed as a result of this? Does hijackthis do that stuff too? EDIT--- Duh... The items I just removed with hijackthis are indeed registry keys. I knew that.

Thanks...

Steve

Edited by thesteveman, 24 April 2005 - 07:34 AM.

  • 0

#6
ScHwErV
Posted 24 April 2005 - 09:20 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
kanmm

Is your issue resolved now or do you still need assistance.

If you need help, please post a new HJT log.

To everyone else, do not post your logs or ask for help in someone elses thread. Start your own thread.

ScHwErV :tazz:
  • 0

#7
kanmm
Posted 24 April 2005 - 07:41 PM

kanmm

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Yes my problem is fixed, thank you. Unfortunately, for those with the same problem they can no longer follow the quick and easy steps I did, as the moderator has since deleted the fix I posted (which were given to me by a qualified security team member). I can understand why, but it might be a good idea to post the fix as this appears to be a common problem. ****Note: I had to also run cleanup.exe to rid the final remenants of this SdBot.gen virus. Thanks again.
  • 0

#8
ScHwErV
Posted 25 April 2005 - 07:58 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If your the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP