Downloder-TD

bjgarrick · Apr 5, 2005

goldcountryrose said:

It didn't give me any of the choices you talked about. When I clicked finish, here is what I got.

A box with a folder in the upper left corner, says HJT. Then, below that, in blue, A box titled, "File and Folder Tasks" some choices such as, Make a new folder, publish this folder to the web and share this folder. below that is another blue box titled "Other Places" that has choices such as Presario C, my docs, shared docs, my computer, my shared places.

In the big white area to the right of the blue stuff, I see the Icon for Hijack This, a detonator and dinamite.

That's it.
Click to expand...

Okay! That should be the folder you want open. Double click the icon for HJT (Detonator and Dynamite Icon) as this will run HJT.

Now you should see the option I mentioned.

goldcountryrose · Apr 5, 2005

well, I have a log. I have notepad and v1.99.1, which one do I use?

bjgarrick · Apr 5, 2005

goldcountryrose said:

well, I have a log. I have notepad and v1.99.1, which one do I use?
Click to expand...

Okay! Now attach that log to your next post.

goldcountryrose · Apr 5, 2005

WAAAAAAAA, I found "go advanced" and clicked it and it keeps dinging me saying I need to click some kind if icon, please help me quick before aol shuts me down again.

bjgarrick · Apr 5, 2005

goldcountryrose said:

WAAAAAAAA, I found "go advanced" and clicked it and it keeps dinging me saying I need to click some kind if icon, please help me quick before aol shuts me down again.
Click to expand...

When you try to attach the log to your post, just click the button "Manage Attachments".

I dont understand your problem?

goldcountryrose · Apr 5, 2005

That choice is not obvious, sorry. I did at least have the good sense to copy and paste the notepad log to word, so it won't get lost. The HijackThis v1.9... is not able to be copied, when I tried it put check marks in boxes so I unchecked them.

Tell me again, exactly, when I click reply, how do I attatch the notepad log I have.

bjgarrick · Apr 5, 2005

goldcountryrose said:

That choice is not obvious, sorry. I did at least have the good sense to copy and paste the notepad log to word, so it won't get lost. The HijackThis v1.9... is not able to be copied, when I tried it put check marks in boxes so I unchecked them.

Tell me again, exactly, when I click reply, how do I attatch the notepad log I have.
Click to expand...

At the bottom of this box where you type your post you will see a button. It will say "Manage Attachments" click this button. It will open a window like the attached image. Click BROWSE and choose the location from where the log is located.

goldcountryrose · Apr 5, 2005

I'm sorry, I don't see that at all. I don't know how to do a screen cap, so I can't show you, but all I have at the bottom is post reply, then there is the go advantage.

bjgarrick · Apr 5, 2005

goldcountryrose said:

I'm sorry, I don't see that at all. I don't know how to do a screen cap, so I can't show you, but all I have at the bottom is post reply, then there is the go advantage.
Click to expand...

Scroll down some, its under Additional Options. Its below the "Submit Reply" button.

I see what your doing now, your not clicking "Post Reply" your doing "Quick Reply.

Click on POST REPLY on the top left to post and you will see what im talking about.

goldcountryrose · Apr 5, 2005

Oh, I see, it only appears once you click reply to post, ok I think I see it, will try.

Didn't work, here is what it said HJT.zip:
File Too Large. Limit for this filetype is 97.7 KB. Your file is 207.9 KB.

goldcountryrose · Apr 5, 2005

Since I saved it in word, can't I just copy and paste here or in PM?

bjgarrick · Apr 5, 2005

goldcountryrose said:

Oh, I see, it only appears once you click reply to post, ok I think I see it, will try.

Didn't work, here is what it said HJT.zip:
File Too Large. Limit for this filetype is 97.7 KB. Your file is 207.9 KB.
Click to expand...

Is it a Word Document or Notepad Document? It needs to be a notepad file.

goldcountryrose · Apr 5, 2005

Boy, OH Boy, did I choose the right Icon for me, am beating head against keyboard...OVER AND OVER.

goldcountryrose · Apr 5, 2005

Right now, I still have it minimized as, "hijackthis - notepad"

And I saved it in word, just in case AOL took a dump again.

bjgarrick · Apr 5, 2005

goldcountryrose said:

Right now, I still have it minimized as, "hijackthis - notepad"

And I saved it in word, just in case AOL took a dump again.
Click to expand...

Its needs to be saved from notepad. So, save the log from notepad and attach that log.

goldcountryrose · Apr 5, 2005

I don't understand. do you want me to send the notepad thing? I thought I read somewhere a few pgs back that I needed to close the notepad thing.

bjgarrick · Apr 5, 2005

goldcountryrose said:

I don't understand. do you want me to send the notepad thing? I thought I read somewhere a few pgs back that I needed to close the notepad thing.
Click to expand...

Just copy the log you have and paste it in a post. I will have it converted into an attachment for you.

goldcountryrose · Apr 5, 2005

GAWD, thought you'd never ask...LOL

Ok, here it is.

Edit by chaslang: Inline log attached

goldcountryrose · Apr 5, 2005

Oh my heck, I don't know how anyone can make sense of that.

I'm not having any trouble, I just don't understand why the downloader-TP keeps getting detected and deleted by my McAfee virus protection.

goldcountryrose · Apr 5, 2005

Well, and that I keep getting booted from AOL and they aren't doing it. I think that is a phone line problem, but if it has something to do with something else, I'd sure like to fix it.

bjgarrick · Apr 5, 2005

Please look in Add or Remove Programs for the following and Uninstall them if found:

Media Access

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...ario&pf=desktop

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:

Go into C:\Program Files and delete the folder named Media Access.

NEXT:
Run CCleaner
(Click the link to download, and run the first scan only)

FINAL STEP

Reset Web Settings & Default Security Settings:

To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After doing all of the above, you will be ok!

Let me know if you have any problems!

Its 3:14am, I have to get some sleep now, I will check back in a few hours!

Good Luck!

goldcountryrose · Apr 5, 2005

BJ, Thank you so much for your infinate patience. I have copied and pasted your instructions into word and will do it tomorrow. It is late here also.

goldcountryrose · Apr 5, 2005

BTW, I knew those HK... U... things were bad. I had no Idea I had them.

bjgarrick · Apr 5, 2005

goldcountryrose said:

BJ, Thank you so much for your infinate patience. I have copied and pasted your instructions into word and will do it tomorrow. It is late here also.
Click to expand...

Your Welcome!

I will be awaiting results!

Good Luck!

goldcountryrose · Apr 5, 2005

Hello, BJ. I did all of the stuff you told me to do and did a new log. I still can't figure out how to attach it. Do you want me to send it in a pm or post here?

goldcountryrose · Apr 5, 2005

The only thing that I didn't see was this..."and select Delete all Offline content too". Other than that, I was able to do everything exactly as you told me to do.

bjgarrick · Apr 5, 2005

goldcountryrose said:

The only thing that I didn't see was this..."and select Delete all Offline content too". Other than that, I was able to do everything exactly as you told me to do.
Click to expand...

Okay! Just paste the log like you did the last time. How are things running now?

goldcountryrose · Apr 5, 2005

Here it is. Things were running fine all along. I was just concerned because McAfee kept detecting and deleting the downloader-TD everytime I signed on. It hasn't done it yet today.

Logfile of HijackThis v1.99.1
Scan saved at 2:17:01 PM, on 4/5/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\gearsec.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\System32\hkcmd.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMPAQ~2\Presario\XPHNARS4EN\plugin\bin\pchbutton.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\America Online 9.0c\aoltray.exe
C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
C:\Program Files\InterMute\PopSubtract\PopSub.exe
C:\Program Files\InterMute\SpamSubtract\SpamSub.exe
C:\Program Files\Microsoft Works\wkswp.exe
c:\Program Files\Microsoft Works\MSWorks.exe
c:\Program Files\Microsoft Works\wkgdcach.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.majorgeeks.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\temp\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\COMPAQ~2\Presario\XPHNARS4EN\plugin\bin\pchbutton.exe
O4 - Startup: IMStart.lnk = C:\Program Files\InterMute\IMStart.exe
O4 - Startup: SpamSubtract.lnk = C:\Program Files\InterMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0c\aoltray.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\1940576\Program\BackWeb-1940576.exe
O4 - Global Startup: PopSubtract.lnk = C:\Program Files\InterMute\PopSubtract\PopSub.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\spysub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Networks Associates Technology, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

bjgarrick · Apr 5, 2005

Run HJT again and have it fix this entry. Other than this your clean!

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab

Are you having any problems right now?

goldcountryrose · Apr 5, 2005

No problems at all. Thank you very much for all of your help and patience. I will go get rid of that now.

bjgarrick · Apr 5, 2005

goldcountryrose said:

No problems at all. Thank you very much for all of your help and patience. I will go get rid of that now.
Click to expand...

Great!

Im glad to hear everything is running fine.

Your Welcome!

You should see this article on How to Protect yourself from malware!

goldcountryrose · Apr 5, 2005

OK, 016....all gone. Thanks Again.

bjgarrick · Apr 5, 2005

goldcountryrose said:

OK, 016....all gone. Thanks Again.
Click to expand...

Your Welcome

Log in or Sign up

Downloder-TD

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

Attached Files:

untitled.JPG

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

Attached Files:

hjt1.txt

goldcountryrose Private E-2

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert

goldcountryrose Private E-2

bjgarrick MajorGeeks Admin - Malware Expert