MidnightDiamond Posted June 17, 2004 Report Share Posted June 17, 2004 Hi, I'm having probs here, i'm new to all this, so I don't know what the hell to do. I had Trojan Horse Downloader.Perfiler.B C:\system Volumeon my PC, so I 'disabled system restore and run a full scan with AVG, rebooted my PC, and enabled system restore'...but now I have another problem, it says 'Error loading C:\windows\system32\MSA64CHK.dll' 'The specified module could not be found', ...everytime I reboot my PC, any help on how to stop this would be much appreciated.Thanks Joanne :) Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 17, 2004 Report Share Posted June 17, 2004 Hello and welcome to Windows ForumI think you may have more of a problem than just a Trojan see hereI suggest you have a look at the instructions here and post a hijack log for us to have a look at for you. Quote Link to comment Share on other sites More sharing options...
Guest ellas Posted June 17, 2004 Report Share Posted June 17, 2004 looks like Netsky D worm. Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 17, 2004 Report Share Posted June 17, 2004 In that case an online virus scan would be a good idea... there is a link in the security forums for an online virus scan, just have a look at the top of the page Quote Link to comment Share on other sites More sharing options...
MidnightDiamond Posted June 17, 2004 Author Report Share Posted June 17, 2004 Logfile of HijackThis v1.97.7Scan saved at 19:32:00, on 17/06/2004Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG6\avgserv.exeC:\PROGRA~1\Grisoft\AVG6\avgcc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\Documents and Settings\Joanne\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exeO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUPO4 - HKCU\..\Run: [DownloadMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:DownloadMP3:tO4 - HKCU\..\Run: [MP3Collection] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3Collection:tO9 - Extra button: MP3Collection (HKLM)O9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{5DD54989-5787-471C-90E9-D4ACA25B9354}: NameServer = 193.38.113.3 194.117.157.4 Quote Link to comment Share on other sites More sharing options...
expertec Posted June 17, 2004 Report Share Posted June 17, 2004 Oops sorry, missed that.First thing to do is put Hijackthis in it's own folder, then scan and tick these:O4 - HKCU\..\Run: [DownloadMP3] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:DownloadMP3:tO4 - HKCU\..\Run: [MP3Collection] rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:MP3Collection:tO9 - Extra button: MP3Collection (HKLM)O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} (Matrix Class) - http://acceso.masminutos.com/laaplicacion.cabClose all other windows and click "Fix Checked".Then reboot and post a new log. Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 17, 2004 Report Share Posted June 17, 2004 Double post, expertec got there before me!! :( Quote Link to comment Share on other sites More sharing options...
MidnightDiamond Posted June 17, 2004 Author Report Share Posted June 17, 2004 Logfile of HijackThis v1.97.7Scan saved at 19:58:10, on 17/06/2004Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\Grisoft\AVG6\avgserv.exeC:\PROGRA~1\Grisoft\AVG6\avgcc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\MSN Messenger\msnmsgr.exeC:\Documents and Settings\Joanne\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exeO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUPO9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{5DD54989-5787-471C-90E9-D4ACA25B9354}: NameServer = 193.38.113.3 194.117.157.4 Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 17, 2004 Report Share Posted June 17, 2004 That looks fine now! :) Quote Link to comment Share on other sites More sharing options...
MidnightDiamond Posted June 17, 2004 Author Report Share Posted June 17, 2004 Thankyou very much :) Quote Link to comment Share on other sites More sharing options...
Andy-2004 Posted June 17, 2004 Report Share Posted June 17, 2004 C:\Documents and Settings\Joanne\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe :unsure: Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.