Win32.Trats:Totally clueless

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Naz048, Feb 24, 2008.

  1. Naz048

    Naz048 Private E-2

    Hopefully someone can help me. My son was using the computer and it got infected, he does not remember what exactly he was doing at the time. Symantec Antivirus Corp. Edition warned that it was infected with Win32.Trats, but it could not remove it only quarantine. I was also getting a rundll error loading C:/windows/system32/bjlpinkm.dll access denied and C:/windows/system32/jkkjh.exe is not a valid win32 application. Also I could only get internet access via one profile on the computer (my son who started this) which is an administrator account.
    I ran the malware removal procedures and I removed five adware programs you had in your list via the add/remove programs. Also Symantec Antivirus would not let me remove 72 threats in quarantine saying that they were being used by another process. After running SpyBot I started getting the error message C:/windows/system32/autoexec.nt The system file is not suitable for running ms-dos and microsoft window applications. I attempted the fix recommended when running gtools and it did not fix the problem. I now at a loss.
    I tried to find the SASlog.txt file but I cannot find it. I will run SuperAntiSpyware again and then attach it. Sorry.
     

    Attached Files:

  2. Naz048

    Naz048 Private E-2

    Here is the log from superantispyware that I could not find. Please help me.
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We have a lot to do so:
    We need to use a new tool.

    * Download and save to RenV.exe from following link to Desktop (must be on the Desktop).
    * Now Copy the bold text in the below code box to notepad. Save it as Log.txt to your desktop. (It must be on your Desktop).

    Code:
    C:\Program Files\Agyq\Gfbby .exe
    C:\Program Files\AIM\aim .exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
    C:\Program Files\Messenger\msmsgs .exe
    C:\WINDOWS\system32\ctfmon .exe
    C:\WINDOWS\system32\hkcmd .exe
    C:\WINDOWS\system32\igfxtray .exe
    
    * Now using your mouse, drag Log.txt onto RenV.exe
    * When finished, RenV.exe will produce a new log names Log.txt on your Desktop I will ask for this log later.

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 11"
    J2SE Runtime Environment 5.0 Update 4"
    J2SE Runtime Environment 5.0 Update 6"
    Java 2 Runtime Environment, SE v1.4.2_06"
    Search Assistant Adssite

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment.


    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog46, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Check the 'Input script manually' box.
    * Click on the magnifying glass icon.
    * Copy everything in the Quote box below, and paste it in the box that opens:

    * Now click the 'Done' button.
    * Click on the traffic light icon and OK the prompt.
    * You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt

    After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.
    Then attach the new logs:

    * Log.tx from running RenV
    * c:\avenger.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds