[jsalem]

Dear Admin. I have run Hijack This and Stinger but I cannot seem to delete the Exploit-DcomRpc.gen Trojan. Below, I have attached my Stinger and Hijack logs.

Any help you can provide is asppreciated. Thanks!

Stinger:

McAfee AVERT Stinger Version 2.4.3.0 built on Oct 29 2004

Copyright © 2004 Networks Associates Technology, Inc. All Rights Reserved.

Virus data file v1000 created on Oct 29 2004.

Ready to scan for 45 viruses, trojans and variants.

Scan initiated on Mon Nov 08 06:48:25 2004

C:\DOCUME~1\Owner\LOCALS~1\Temp\~2.tmp\~2.tmp

Found the Exploit-DcomRpc.gen trojan !!!

C:\DOCUME~1\Owner\LOCALS~1\Temp\~2.tmp\~2.tmp could not be repaired.

C:\DOCUME~1\Owner\LOCALS~1\Temp\~39.tmp\~39.tmp

Found the Exploit-DcomRpc.gen trojan !!!

C:\DOCUME~1\Owner\LOCALS~1\Temp\~39.tmp\~39.tmp could not be repaired.

C:\Documents and Settings\Owner\Local Settings\Temp\~2.tmp\~2.tmp

Found the Exploit-DcomRpc.gen trojan !!!

C:\Documents and Settings\Owner\Local Settings\Temp\~2.tmp\~2.tmp could not be repaired.

C:\Documents and Settings\Owner\Local Settings\Temp\~39.tmp\~39.tmp

Found the Exploit-DcomRpc.gen trojan !!!

C:\Documents and Settings\Owner\Local Settings\Temp\~39.tmp\~39.tmp could not be repaired.

Number of clean files: 3109

Number of Trojans: 4

Hijack this

Logfile of HijackThis v1.98.2
Scan saved at 6:45:05 AM, on 11/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\ISP50\MAXSPEED\propelac.exe
C:\Documents and Settings\Owner\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.peoplepc.com/search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://home.peoplepc.com/search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <local>
O2 - BHO: PeoplePC FixedBandBHO - {3DE88907-3E38-11D4-BEB2-CBE76C0598DD} - C:\Program Files\ISP50\bin\BandObject.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O4 - HKLM\..\Run: [Lexmark X83 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X83.exe
O4 - HKLM\..\Run: [Lexmark X83 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X83.exe
O4 - HKLM\..\Run: [PPCRunonce] C:\WINNT\System32\PPCRunOnce.exe
O4 - HKLM\..\Run: [Win32 USB2 Driver] smsc.exe
O4 - HKLM\..\Run: [Propel Accelerator] C:\Program Files\ISP50\MAXSPEED\propelac.exe
O4 - HKLM\..\Run: [[ON]QKKK\_MJO^LX] C:\WINNT\System32\pbxutdfrjuan.exe
O4 - HKLM\..\Run: [Sys29] C:\winnt\system32\winplv32.exe
O4 - HKLM\..\RunServices: [[ON]QKKK\_MJO^LX] C:\WINNT\System32\pbxutdfrjuan.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O8 - Extra context menu item: Refresh Pa&ge with Full Quality - C:\Program Files\ISP50\MAXSPEED\pac-page.html
O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\ISP50\MAXSPEED\pac-image.html

Thanks very much for your time! [email removed for your protection]

Edited by admin, 08 November 2004 - 10:18 AM.

[Advertisements]

Hi jsalem, welcome to Geeks to Go!

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[admin]

Hi jsalem, welcome to Geeks to Go!

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

Please reboot into safe mode - How do I boot into "Safe" mode?.
Be sure you're able to view hidden files, and remove the following files in bold (if found):

Please delete your temporary files. Double Click My Computer (WinXP: Navigate to Start --->My Computer)
You will see an icon representing your harddrive (most likely C: Drive) Right Click on the hard drive icon and click Properties at the
bottom of the fly out window. One the very first tab (General) you will see a button labeled "Disk Cleanup"...click that button.
Make sure the following are checked:
Downloaded Program Files
Temporary Internet Files and
Recycle Bin
Click OK and Disk Cleanup will delete those files for you.

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

[jsalem]

Thank you for your help...Will do!