Anyone know what msaccrt.exe is?

Discussion in 'Malware Help (A Specialist Will Reply)' started by flasunshine, May 19, 2005.

  1. flasunshine

    flasunshine Private E-2

    I have this file message popup when I log into the computer. Does anyone know what msaccrt.exe is and why it's trying to load? If it's spyware, I'll do the steps to get rid of it...if it's not, I'll jump to the other boards and see if I can figure out what it is! Thanks.
     
    flasunshine, May 19, 2005
    #1
  2. elbiatcho1

    elbiatcho1 Specialist

    Get rid of it, possibly virii, maybe AIM related (msn searched for filename).
     
    elbiatcho1, May 19, 2005
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As far as I know it is a baddie. You should follow the steps below so we can check it out:

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

    Make sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

    After doing ALL of the above you still have a problem:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    chaslang, May 20, 2005
    #3
  4. flasunshine

    flasunshine Private E-2

    I've done all the "read me" stuff. Here's my log! Thanks in advance for your help.

    I didn't have any trouble running the spyware removal items. I found some trojan virus' when I ran the virus check (can someone tell me how they slip through when I live update every week and run a full scan every Sunday morning?). Everything worked as usual.
     

    Attached Files:

    flasunshine, May 20, 2005
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There are thousands of malware items that no detection programs can find. They simply cannot keep up with the constantly evolving and self mutating crap that is out there. That is why you see so much manual cleaning going on in these threads. Running the cleanup procedures does help fix loads of problems but there is just as much stuff that it does not fix. You could literally run every single AV program, online scanner, spyware removal tool that exists and you still would have to do manual removal steps for thousands of other components of malware that would not be detected.


    Is the below URL valid? If not, have HJT fix this line.
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotsheet.com/


    You should have HJT fix the below WildTangent entry.
    O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

    Then boot into safe mode and use Windows Explorer to delete the below folder:
    C:\Program Files\WildTangent


    Other than that you log is clean. Are you having any other problems?
     
    chaslang, May 21, 2005
    #5
  6. flasunshine

    flasunshine Private E-2

    Thanks Chas...The msaccrt thing doesn't come up when I log in, which was my major pain in the rear. The hotsheet line is valid...I use that as my homepage. (It's a nice page with a LOT of links on it to everything under the sun, if anyone's interested!!).

    I'll take care of that wild tangent thing, which is another thing I keep trying remove from the add/delete programs list.

    Again...THANK GOD FOR YOU GEEKS! I know just enough and not enough about my computer to really screw it up! You keep me from doing that!! Thanks again!
     
    flasunshine, May 21, 2005
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, May 21, 2005
    #7
  8. JAFO

    JAFO Private E-2

    After having found msaccrt.exe popping up everytime I logged into xp, I googled it and found myself here. I followed the instructions at: http://forums.majorgeeks.com/showthread.php?t=35407 (although one link: Symantec Security Check - http://security.norton.com/sscv6/default.asp?langid=ie&venid=sym is inoperational) and performed all of the requested functions, and downloaded all the software. Thanks by the way for that - I found several trojans on both my computers.

    Apparently the file has been removed, BUT how can I stop the message from popping up everytime I log in to xp (home). Back in the days of 3.1, I could shell to DOS and edit the config.sys file and all would be kosher, but now I've let my computing skills go to the dogs and I'm clueless as to how to get rid of the message.

    Any suggestions would be most appreciative!

    JAFO
    (For explanation of my user name, see Blue Thunder)
     
    JAFO, Jul 4, 2005
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Instead of posting in a thread that did not belong to you, it would have been better if you had started your own thread. That is the standard expected process. I'm moving you to your own thread. You originally posted here: http://forums.majorgeeks.com/showthread.php?t=63214

    Please follow the steps below exactly:


    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     
    chaslang, Jul 6, 2005
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds