trojan removal help

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by v2ladimyr, Mar 12, 2009.

  1. v2ladimyr

    v2ladimyr Private E-2

    I'm about at my wits end with this laptop. Been working on this virus removal for around 12 hours, need some help and advice. Logs attached.
     

    Attached Files:

  2. v2ladimyr

    v2ladimyr Private E-2

    last log file
     

    Attached Files:

  3. v2ladimyr

    v2ladimyr Private E-2

    More aggravating at this point than any virus I've run into. Getting a blaster style shutdown message that i've got to abort with shutdown -a, hitting it with an sfc /scannow right now, but I am not hopeful that this will resolve anything... The system is XPSP2, so I cant see it having the dcom vulnerability, I also dont see any of the items that are usually associated with the blaster worm. The machine is generating massive amounts of spam email, which norton AV stops resulting in symantec hosted mail popups filling the screen if I let it get online. (if I turn off email auto protect in norton, the spam messages stop, of course.)


    I ran Smitfraudfix, SDfix, and Kaspersky virus removal tool, attached a picture of what the kaspersky tool found. I'm thoroughly annoyed and leaving it turned off till monday, hopefully someone is able to lend a hand by then.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    First I need to see the first logs from SUPERAntiSpyware and Malwarebytes. We asked you to only run them once and attach the logs. Please attach the below two files which are the first logs.


    C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\SUPERAntiSpyware Scan Log - 03-11-2009 - 15-09-34.log
    C:\Documents and Settings\Administrator\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-2009-03-12 (07-51-48).txt



    Now you are way out of date with your version of SUPERAntiSpyware.
    • Please uninstall your current version (this is necessary).
    • Then download this SUPERAntiSpyware
    • Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.
    • After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.
    • Now run a new full scan of your system. And attach this new log.
    Now make sure you have fixed what Malwarebytes found. The previous log you attach said you took no action.

    Make sure you attach the above 3 logs before moving on to the next steps below where there will be two more logs to attach.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Mar 16, 2009
  5. v2ladimyr

    v2ladimyr Private E-2

    Ran the suggested fixes, disabled norton av, superantispyware found and removed an additional rootkit, disabled norton, ran combofix using the script you provided, it removed files. I had the same behavior afterwards, with symantec hosted mail spam messages.


    Thank you for the help, I am going to wipe the machine.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds