Discussion in 'malware problems & news' started by lsj0302, May 19, 2004.

Thread Status:
Not open for further replies.
  1. lsj0302

    lsj0302 Registered Member

    May 19, 2004
    SecThought.E has been invading me for about three weeks. It seems to be popping up in my daughter's temporary internet files. So I run AVG and it is moved to the Virus Vault and then it returns, usually in a file such as:
    C:\Documents and Settings\Rebecca\Local Settings\Temporary INternet Files\Content.IE5\1HXMJE90\install...exe. I have even turned off System Restore, removed the offending file using Explorer, run AVG and then turned on the System Restore again.

    Is it possible she may have downloaded a song using Kaza or Kaza Lite which has a virus attached to it? If so, how would I deal with that aspect of it?

    Any help? I am a desperate woman.

    Thank you so much.
  2. Passerby

    Passerby Guest

  3. Arin

    Arin Registered Member

    May 1, 2004
    that folder "Temporary Internet Files" contains the files that are downloaded to your computer when you surf the Net. sometimes opening a site might cause this download and trigger the alarm. its also possible that some malicious file is running in your memory which is trying to download another file. empty that "Temporary Internet Files" folder and look for a file named LOADER.EXE or STCLOADER.EXE in your memory. if it exists then remove it from the memory. search your computer for that file and delete it. open registry and delete the entry of this file from autostart.

    the same problem persists with other AVG users when the visit these sites.


    MP3 file is data files which doesn't contain any virus. but Kazaa or other P2P softwares are dangerous as they susually contain trojans. during file swapping an infected file can easily found its way in your computer.
    Last edited by a moderator: May 20, 2004
  4. Arin

    Arin Registered Member

    May 1, 2004
    oh by the way remember to apply the latest patches and service packs for your OS and use a good firewall. there are plenty of FREE firewalls like Kerio or Zonealarm or Sygate. i'll recommend Kerio but its your choice.
  5. snapdragin

    snapdragin Administrator

    Feb 16, 2002
    Southern Ont., Canada
  6. will

    will Guest

    I just got it today off of a sight. I was having problems with pop-ups with the sight. Ufortunately Zonealarm didn't stop it or alarm me.

    AVG found it but when I tried to remove it, I got the message that I couldn't.
  7. snapdragin

    snapdragin Administrator

    Feb 16, 2002
    Southern Ont., Canada
    Hi Will,

    Please follow the instructions and ALL steps over here:

    You will have to become a registered member first before you can post your hijackthis log in the adware/spyware/hijack cleaning forum.



    REALITY Guest

    One of the sites I see this coming from is hxxp: // www .shareconnector .com/, sad really...
    Last edited by a moderator: Jun 16, 2004
  9. Unkown29320

    Unkown29320 Guest

    This is not just a harmless triger, there's an file in your temporary internet files called 'install[1].exe', and that's a real Trojan Horse.. I got this Trojan Horse by visiting (An IRC Spy site)
  10. Whatever

    Whatever Guest

    I have done what he sayd, but it is still there
    and norton keeps complaining that the settings are changed by an unauthorize program.

    My Log is:
    Logfile of HijackThis v1.97.7
    Scan saved at 10:46:50, on 1-7-2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    C:\Program Files\Apache Group\Apache2\bin\Apache.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\DU Meter\DUMeter.exe
    C:\Program Files\NetLimiter\NetLimiter.exe
    C:\Program Files\Messenger Plus! 3\MsgPlus.exe
    C:\Program Files\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Common Files\Symantec Shared\NMain.exe
    C:\Program Files\Kazaa Lite Resurrection\kazaalite.kpp
    C:\Program Files\Shareaza\Shareaza.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\MYIE2\MyIE.exe
    C:\Program Files\Grisoft\AVG6\avgw.exe
    C:\Documents and Settings\Peter\Bureaublad\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page ={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page ={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
    N3 - Netscape 7: user_pref("browser.startup.homepage", ""); (C:\Documents and Settings\Peter\Application Data\Mozilla\Profiles\default\5q9tbdsu.slt\prefs.js)
    N3 - Netscape 7: user_pref("", "engine://"); (C:\Documents and Settings\Peter\Application Data\Mozilla\Profiles\default\5q9tbdsu.slt\prefs.js)
    O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll (disabled by BHODemon)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (disabled by BHODemon)
    O2 - BHO: (no name) - {33FA58F7-F3D7-76BC-B6A0-148F469C5C42} - (no file)
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll (disabled by BHODemon)
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll
    O3 - Toolbar: (no name) - {793561CD-CB1F-891F-CA7A-47B790779FFB} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
    O4 - HKLM\..\Run: [NetLimiter] C:\Program Files\NetLimiter\NetLimiter.exe /s
    O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
    O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
    O8 - Extra context menu item: Backward &Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
    O8 - Extra context menu item: Cac&hed Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
    O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Si&milar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) -
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
    O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) -
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
    O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A2E38CB7-50EB-47C0-8ADC-EABA23B3CAE6}: NameServer =
  11. snowbound

    snowbound Retired Moderator

    Feb 18, 2003
    The Big Smoke
    Hi Whatever :)

    Welcome to Wilders.

    Unfortunately u have posted your HijackThis log in the wrong forum.

    U must post it in the Hijack Cleaning forum, but before u do that, registration is necessary.

    More info here,

Thread Status:
Not open for further replies.