Trogans & Pop Ups

Please help somehow I have nasty trogans that I can not get rid of. My anti virus says it removes them but they keep coming back. This has caused my computer to be very slow and locking up.

Below is a copy of my hijack this log

• Edit by bjgarrick: Unrequested, Inline HJT log removed!

 

Welcome to MajorGeeks.com, please follow our standard cleaning procedures:

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

Downloading, Installing, and Running HijackThis

• Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

• CounterSpy
• AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
• Bitdefender - from step 6
• Panda Scan - from step 6
• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

 

I did all off the clean up procedures as indictated. Panda did not have a report for me to attach.

I am still getting pop up ads to install programs.

Please advise.
Thank you

 

More logs

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.


Please look in Add/Remove Programs for the following and uninstall them if found:

Viewpoint Media Player

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

O2 - BHO: (no name) - {10181BAD-8669-8BED-1E16-F98DBF25D498} - (no file)
O2 - BHO: (no name) - {1FB63E52-4D6E-48C1-A08F-F630FE50F337} - (no file)
O2 - BHO: (no name) - {40191AA9-D76C-8EBB-4F16-F98DBF25D2C3} - (no file)
O2 - BHO: (no name) - {607B9575-B6A1-4410-AAEF-F1E6D6252F28} - (no file)
O2 - BHO: (no name) - {938A8A03-A938-4019-B764-03FF8D167D79} - C:\WINDOWS\system32\ulsgoopr.dll
O2 - BHO: (no name) - {A4B7FA14-6E07-4911-93EA-969372D9497B} - (no file)
O2 - BHO: (no name) - {AEB05BDE-43A5-43F0-80AA-373239557ED4} - (no file)
O2 - BHO: (no name) - {BEA96393-381F-4A87-BD6D-6AEF402FE910} - (no file)
O2 - BHO: (no name) - {F09FE395-54AF-49B1-86E2-F3811D6EAC43} - (no file)

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: nnnmnoo - nnnmnoo.dll (file missing)
O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing)

O21 - SSODL: SysRegClass - {356B3A99-01D7-512D-113C-EBA850C10473} - (no file)

Again, make sure ALL browser windows are closed when you click FIX.

Next, please follow these instructions closely. Enter the below very carely!

Click Start -> Select Run -> Type cmd /k and press enter. Type the below in

sc delete RemoteAccesslanmanserver PRESS ENTER

sc delete SENSccEvtMgr PRESS ENTER


Next, run CCleaner to clean up cookies and temp files.


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

After you complete the above, proceed with the rest of this fix...

Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

After you complete the above reboot once more and then scan with HijackThis and attach the new log along with the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

I followed the procedures, and have included the log of hijack this, unfortunately I did not save the log of the avenger and was not sure if you wanted me to do it again so I could have a log, sorry, that is what I get for not reading the whole thing before I did the process.

I did have a trojan come up right before I did this.

 

Avenger log

 

Reboot a few times and attach a fresh HJT log.