Please Help - big hit on my pc by MSTASKS2.exe & others. I run Windows XP Pro & have Norton Anti Virus/Internet Security installed. Since 16Jun04, whenever I boot up and logon to my user I get a black desktop [icons viewable] with a display saying warning you're in danger ..... SECURE YOURSELF RIGHT NOW .... Removal Instructions. Starting IE6 brings up 'about:blank' page. There is a process called MSTASKS2.exe running in my user and using all CPU. I end this task and then can open up all programs. Norton Anti Virus is alerting about object MSTASKS1.EXE,MSTASKS2.EXE, MSTASKS3.exe in c:\windows - all trojans but it cannot repair them. It also alerts about WINTIME.exe in c:\windows\system32 & SYSTEM.exe in c:\windows. All these are also in the windows/prefetch directory. Another symptom is that some software has been downloaded somehow - it showed as SEX in All Programs and pointed to "c:\program files\WebSiteViewer\123917.exe"/ac:123917 / sk: /lc/u\. There is a desktop icon for XXX which points to a casinoplazza web site. Anyway that's the story so I ran HijackThis v1.97.0.7, CWShredder 1.59 & SpybotSD 1.3 Final. Ran SpybotSD and allowed it to fix 49 problems it found - mostly tracking cookies but also 4 TIBS relating to WebSiteViewer & the desktop link SEX.Ink, and also 5 DSO Exploits. After this the WeSiteViewer and SEX link had gone. Ran CWShredder - found a CWSVariant - reboot [stll got MSTASKS2 problem], run CWSHredder again.. Then ran HijackThis and the resulting log is available on request. So the situation is have run SpybotSD, CWShredder & HijackThis and still got these MSTASKS2.exe running, I know there are also MSTASKS1 & 3 but they dont seem to run. My desktop is taken over by this black screen with the Warning dialogue, got this destop link to casinoplazza. Oh yes - starting IE6 brings up 'about:blank' page. PLEASE HELP/ADVISE ON HOW TO GET RID OF THESE PROBLEMS - not sure what is safe to remove from the items in the HijackThis log. Many Thanks.

Download 'Hijack This!'. Unzip, doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a reply. HijackThis!

Hi Tom41, Thanks for the reply - here is the log from HijackThis:- Logfile of HijackThis v1.97.7 Scan saved at 13:00:19, on 20/06/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Norton Internet Security\NISUM.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Norton Internet Security\ccPxySvc.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe C:\WINDOWS\System32\CTHELPER.exe C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\qttask.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe C:\PROGRA~1\BTOPEN~1\SMARTB~1\MotiveSB.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\program files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe C:\program files\WinZip\WZQKPICK.exe C:\Program Files\BTopenworld NetHelp\bin\mpbtn.exe C:\WINDOWS\System32\taskmgr.exe C:\Program Files\BTopenworld NetHelp\bin\mad.exe C:\PROGRA~1\Motive\ASSTCO~1\MOTIVE~1.exe C:\Program Files\BTopenworld NetHelp\bin\MotiveBrowser.exe C:\WINDOWS\System32\wuauclt.exe C:\program files\TextPad 4\TextPad.exe C:\downloads\hijackthis\hijackthis19jun04\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by BT Openworld R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = https://signup.e2binternet.com/cdsignup/ R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.exe O4 - HKLM\..\Run: [CTHelper] CTHELPER.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [RunNetHelp] C:\WINDOWS\RunMotive.exe O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe" O4 - HKLM\..\Run: [SideWinderTrayV4] C:\PROGRA~1\MI948F~1\GAMECO~1\Common\SWTrayV4.exe O4 - HKLM\..\Run: [FlashInstaller] E:\flashstart.exe E:\E:\E:\E:\E:\start.exe run O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTOPEN~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [WinTime] C:\WINDOWS\system32\wintime.exe O4 - HKLM\..\Run: [ist service uninstall] C:\WINDOWS\mstasks2.exe /u O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: BTopenworld NetHelp for Broadband.lnk = C:\program files\BTopenworld NetHelp\bin\matcli.exe O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.exe O4 - Global Startup: gwum.lnk = C:\program files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe O4 - Global Startup: Microsoft Office.lnk = C:\program files\Microsoft Office\Office10\OSA.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\program files\WinZip\WZQKPICK.exe O8 - Extra context menu item: &iSearch The Web - res://C:\WINDOWS\System32\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.evesham.com/ O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {1803B9EF-9905-4F34-AFC4-05D1BAB28801} (RegUserCfgUI Class) - http://download.yahoo.com/dl/installs/bt/yregucfg.cab O16 - DPF: {2048B51E-8D74-4762-82CE-B48CF545EEEA} (CAX Object) - http://accu.acculoader.com/download/dialer/eu_cax.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1429417886618669ce05/netzip/RdxIE601.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://www.smgradio.com/core/player/abasetup141.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{F06569D4-6A70-42B0-9AE6-7EC4D8BE1FE3}: NameServer = 194.72.9.34 194.72.9.38

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by BT Openworld R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = https://signup.e2binternet.com/cdsignup/ Leave only one, which is your home page. R3 - URLSearchHook: (no name) - {1C78AB3F-A857-482e-80C0-3A1E5238A565} - (no file) Fix. O4 - HKLM\..\Run: [RunNetHelp] C:\WINDOWS\RunMotive.exe Suspicious...I would rename that file for a couple of Windows sessions, and see, if it brings any errors. If not, fix it. O4 - HKLM\..\Run: [FlashInstaller] E:\flashstart.exe E:\E:\E:\E:\E:\start.exe run Suspicious...same as above O4 - HKLM\..\Run: [WinTime] C:\WINDOWS\system32\wintime.exe Possible virus: Downloader-KY See, if you have this registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "WinTime" = C:\WINDOWS\system32\wintime.exe O4 - HKLM\..\Run: [ist service uninstall] C:\WINDOWS\mstasks2.exe /u Fix!!! O14 - IERESET.INF: START_PAGE_URL=http://www.evesham.com/ If this is your ISP, fine, if not, fix it. ____________ My web page: http://www.smartercomputing.com/

Hi, I think you might need to try to used ur antivirus softwaret to do a full scan on your PC. below is the link on how to remove this trojan . http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_BANKER.AF&VSect=T regard fizilla

I ran Hijackthis here is the log. Any help with this one is appreciated!!! Logfile of HijackThis v1.97.7 Scan saved at 8:09:49 PM, on 6/21/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Support.com\bin\tgcmd.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\WINDOWS\SM1BG.exe C:\WINDOWS\System32\msrexe.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\RUNDLL32.exe C:\WINDOWS\System32\ctfmon.exe C:\Program Files\CConnect\CConnect.exe C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\mike\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://adblock.linkz.com/abho/bandsearch.abs R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://linkz.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\secure.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\secure.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://adblock.linkz.com/abho/bandsearch.abs R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Cox High Speed Internet R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\secure.html O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {54EC170F-6EB1-47C6-9C4D-EB0BE20CE45E} - C:\WINDOWS\Downloaded Program Files\APHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.exe C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [System Service] C:\WINDOWS\System32\msrexe.exe O4 - HKLM\..\Run: [ist service uninstall] C:\WINDOWS\mstasks2.exe /u O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.exe C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: CorrectConnect.lnk = C:\Program Files\CConnect\CConnect.exe O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: AdBlock (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra 'Tools' menuitem: AdBlock Configuration (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.cox.net O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/PopularScreenSaversInitialSetup1.0.0.8.cab O16 - DPF: {4620BC29-8B8E-4F4E-9D92-1DB6633D6793} (SurferNETWORK Plugin) - http://rd1.surfernetwork.com/surferplugin.ocx O16 - DPF: {93829908-07C2-44A2-95DB-F78F201A9B48} (AdBlock APInstaller Class) - http://adblock.linkz.com/APHelper.dll O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37955.6483333333 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

mrearl, Here is a link that helped me with the same problem.... http://www.computercops.net/postlite53250-mstasks2+exe.html Good luck!