Results 1 to 2 of 2

Thread: secThought.E trojan

  1. #1
    Junior Member
    Join Date
    Apr 2004

    secThought.E trojan

    I got a few questions.

    Secthought.E is Trojan (go figure) that I have run into and needs some help getting rid of.

    okay here is my questions

    1. what does it do
    2 where does it hid at in the computer

    thats it for now

    thanks much


  2. #2
    Senior Member
    Join Date
    Feb 2002
    I don't see alot of info on the E variant.. but I would hope it's simliar enough to the previous variants.. it's adware/spyware..

    if you do a google search on "SecondThought" you'll come up with some info..


    Trojan.Win32.SecondThought.c has two component parts.

    The first is written in Visual C++ and compressed using UPX. The compressed size is 24288 bytes, and the decompressed size - 48864 bytes.

    When installing the Trojan downloads a file from http://www.2n****, saves it as stcloader.exe in the Windows system directory and registers the files as a key to enable auto-run in the system registry:
    Once installed, the Trojan launches stcloader.exe
    The second component part (stcloader.exe) is written in Visual C++ and compressed using UPX. The compressed size is 27648 bytes, and the decompressed size is 66048 bytes.

    Stcloader.exe secretly installs itself in Program Files and registers itself in the system registry.
    Stcloader.exe creates Second Thought.lnk on the Desktop with a link to itself, and Eliminate Pop-Ups with a link to**** This causes advertising to be shown while the Internet is being used. The program collects information on which sites and resources interest the user, and sends this information to the creator of the virus. It also adds a Search tool bar to the browser.

    Adware.SecondThought is an adware program that downloads and displays advertisements.

    The files are detected as Adware.SecondThought.

    This adware program must be manually installed.

    File names: install011.exe

    When Adware.SecondThought is executed, it performs the following actions:

    Downloads the file, Stcloader.exe, from

    Creates the file, %System%\Stcloader.exe.

    Note: %System% is a variable. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

    Adds the value:


    to the registry key:


    so that Adware.SecondThought runs when you start Windows.
    there's a thread at spywareinfo that someone has.. your e variant..
    maybe you could look at that hijackthis log and run hijackthis for yourself
    and compare..

    for the most part 'tho.. if you run your anitvirus (is it AVG ?) and adaware and spybot (search and destroy) in safe mode.. you should be able to clean it out..

    good luck

    edit : oops I forgot to give you the link to the thread at SWI.. now that I've edited this post, the link will probably not be an active one so copy/paste into a new browser window..

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts