Trojan virus, ran all scans

eliluca06 · Aug 29, 2008

I had a very annoying virus this week. It showed as Ultimate antispyware program, but would have about 40+ pop ups show on my screen at a time that were very hard to get rid of. It would also disable links on webpages when it popped up. When I ran my Trend Micros it said if had found a Trojan but was unable to do anything for it. I have completed the Read and Run Me directions and attached the logs. For your information my system specs are as follows:
Microsoft Windows XP Media Center Edition Version 2002
HP Pavillion
AMD Athlon 64x2 Dual
Core Processor 3800
2.00 Ghz, 1.00 GB of RAM

eliluca06 · Aug 29, 2008

This is the Malwarebytes log attached.

Thank you in advance for you help.

Eliluca06

TimW · Aug 30, 2008

Your logs are clean.....are you having any issues at present?

In the meantime:
Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[-HKEY_CURRENT_USER\Software\Kazaa]
[-HKEY_LOCAL_MACHINE\SOFTWARE\knight]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"HideLegacyLogonScripts"=-
"HideLogoffScripts"=-
"RunLogonScriptSync"=-
"RunStartupScriptSync"=-
"HideStartupScripts"=-
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

eliluca06 · Aug 31, 2008

TimW,

Thank you for checking my logs. I am glad to hear they are clean. I did try to save the reg info to the desktop only in the 'type' area but I do not have a choice for 'all files.' Which seems strange. Is there a different file type that will do essentially the same thing?

Thank you for you help,
Eliluca06

TimW · Aug 31, 2008

You copied to notepad? What file types do you have to save it as?

eliluca06 · Aug 31, 2008

TimW,

Ahhh, notepad. That makes more sense. lol. It was successful this time. Thanks again for your help.

Eliluca06

TimW · Aug 31, 2008

LOL

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we used Pocket Killbox during your cleanup, do the below

* Run Pocket Killbox and select File, Cleanup, Delete All Backups

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combo-fix folder from combofix.

If we had you run Avenger, you can delete all files related to Avenger now.

If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Log in or Sign up

Trojan virus, ran all scans

eliluca06 Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

SASlog.txt

eliluca06 Private E-2

Attached Files:

mbam-log-08-29-2008 (11-15-01).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

eliluca06 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

eliluca06 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Trojan virus, ran all scans

eliluca06 Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

SASlog.txt

eliluca06 Private E-2

Attached Files:

mbam-log-08-29-2008 (11-15-01).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

eliluca06 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

eliluca06 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches