pc loaded with viruses and trojans

well, before my son left for Africa he downloaded something that has totally messed up my pc. i've followed the instructions for malware removal. however i couldn't run networking in safemode for some reason unknown to me.
here are my files. my be in two posts.
ericbk

 

pc loaded with viruses and trojans part 2

here;s the rest of the logs.

 

Re: pc loaded with viruses and trojans part 2

Hi Eric!

You didn't rename HijackThis as per the tutorial. Please go back to the READ & RUN ME FIRST and rename it to analyse.exe and do a fresh log.

You're still missing some logs. Is log.txt one of these? Please post the ones that are missing!

Counterspy
Newfiles
Runkeys

If you have any questions about them, please refer to the READ & RUN ME FIRST

abri

 

i forgotto upload runkeys and new files .. here they are. it seems that i ran avg and can't seem to find the log file. i can't remember if it did ask to save a file. but it did find burnfree trojan and deleted it. if u want me to rescan i will with avg free.

 

sorry here arethe files. i got lost doing this reply. sorry if i uploaded twice
eric
i ran avg free and can't find the log instead of counter spy. if u want i can rerun avg or download counter spy and run.

 

thanks for pointing out that i neglected to upload the files. i have done so and have read and had printed out the read and run me first instructions. i guess i should download counter spy but should i disable avg free first?

 

I think the avg will be fine. Wait with the Counterspy.
abri

 

finally i did the counterspy scan and here is the file. it found something interesting i think?
thanks for sticking with me. thanks for any help u can give me.
ERic

 

Please run this RogueRemover Free.

After you run the above, run ComboFix below..

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

After you have completed ALL of the above, please attach the following logs and abri will assist you further.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• ComboFix Log

 

i ran rogueremover and it said it found zero and didn't produce a log as i could tell.
i have the logs for counterfix.txt and the others that u needed.
however there is now an icon on my desktop called XPprofiles.exe that was never there before this nightmare and windows was trying to reinstall one of my applications an image editing program photosuite that i purchased and now i'm thinking its time to reformat. Darn .. i hope u can help .. it's now taking about 15 min to boot up
the manage accounts says i've uploaded most of these files before and i have and it doesn't as far as i can see want to upload counterspy.txt.
heaven help me .. who knew sons could be such a nuisance
thanks for any help
Ericbk

 

Let us know if you would like to continue because if you're going to format it would be a waste of our time to continue helping you in removing malware.

I hate to hear you're comtemplating formatting however it's up to you. If you want to continue in cleaning your system then attach a fresh ShowNew, GetRunKey and HijackThis logs and we will take a look at them.

 

here are the files if i can upload. yesterday the site wouldn't let me upload files that had previously been uploaded. i await your knowledgable reply with help.
thanks for your help

 

Hi Eric,
I'm pretty sure the xpprofiles has to do with a fix for some gaming problems. That doesn't exclude it being adware. I'm working on your logs and will get back to you as soon as I can. Please be patient. While you're waiting, please elaborate on "messed up your pc" and an approximate date when you first noticed the problems. It hellps us to know some of the symptoms.
Thanks!
abri

 

no gaming software loaded on my pc and don't play online.
thanks for taking the time to look at my logs
ERicbk

 

i apologize for the delay in my reply .. unavoidable.
here are the files u asked for .. i trust your site.
now it seems i can only upload 3 files so i'll send another reply with getrun

 

here's the latest runkeys.txt file. that's it for me. i await your reply in the morning ... thanks

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 3:

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 4: Begin here after rebooting from Step 3!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 5:

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 6:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

here are the files. with avenger u had a few *'s that i had to delete to run the script.
i don't know what atf-cleaner.exe is and there was not a link to download .. so i couldn't run it.
will attach runkeys.txt to another reply .. sorry only 3 uploads
Ericbk

 

here's the runkey file. my pc seems to be loading app more quickly now ..haven't tried reboot .. won't until i find atf cleaner and run it.
what about my passwords while i was in midst of trouble? should i start changing them as they might have been compromised?
thanks again for all your patient help.
Ericbk

 

Hi Eric!
the link must have been dead. See if you can get it this time.
abri

Now Run The AVENGER by double-clicking on it.
* Check the 'Input script manually' box.
* Click on the magnifying glass icon.
* Copy everything in the Quote box below, and paste it in the box that opens:

Now click the 'Done' button.
* Click on the traffic light icon and OK the prompt.
* You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt


Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

 

thanks for sending atf . it worked and i cleared all. i did get avenger to work previously in the already uploaded file of today from this a.m.. i just had to delete two * one from the beginning and one from the end
but here it is again. i hope now i've a clean machine. should i reboot and see if it still takes 18 - 20 minutes to fully load?

 

Hi Eric!

The main reason for changing your passwords was if you had a keylogger. I don't think you had a keylogger. There's more about this in the link below called How to protect yourself from malware.


1) First, if you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


2) Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below folders which may be left behind by the uninstall:
C:\Documents and Settings\Eric\Application Data\Sunbelt Software
C:\Documents and Settings\All Users\Application Data\Sunbelt Software
C:\Program Files\Sunbelt Software

3) Run CCleaner Please use this tool often in its default setting as per our instructions. It will keep your computer running a lot smoother!


4) And some last clean-up steps.

5) Some last notes:

Is it faster now? You have a lot on your computer! I'm not sure you need it all on there at startup. Also, you're using SpyEraser, Spyware Doctor and Avg Antispyware. If Spyware Doctor is the trial version, that would be one to uninstall. I would keep one of these. Also keep Spyware S&D and run it every so often, but you don't need all three of these others.

abri

 

did what u asked .. thanks. i have a folder/dir called found.000 in C/. should it be there? it has a subfolder. dir0000.chk is that checkdisK? the pc is running a lot faster now. can i reset startup to custom? how can i thank all of you for not allowing me to have the headache of reformatting and reinstalling? can i backup to cd files?
Eric:wave

 

You thanked us by not reformatting when we were halfway through setting up the fixes!

If you're talking about msconfig, it's best to always run your computer in normal. msconfig is a diagnostic tool which allows you, for one thing, to see what effect can be achieved by turning off different things at start-up. This often helps to narrow down a problem. It can also help to identify programs which are slowing down your startup. If you decide you don't want things to run at startup, it's best to remove them from the startup menu and leave the computer in normal startup mode.

The Found.000 folders contain chkdsk files. Here's a good article on what they are and what you can decide to do about them if you want to. TheLangaList They don't hurt anything, but the explanation in this article is more complete. Langa is very readable.

After you've completed everything and set a new restore point, please read through
How to Protect yourself from malware!
.
After that I would back up data, do a defrag and possibly run a registry cleaner, but I recommend asking for advice about this last one in the software forum. I'm conservative and try not to fix things that aren't broken.

abri

 

thanks again. i still have the icon xpprofiles.exe on my desktop. should i do anything with it or leave it alone? it now takes about 3.5 minutes to boot and use an application.
many thanks.
Eric

 

3.5 minutes is better than 15-20, but it's still slow. See if you can get some of the stuff out of your start menu and do a defrag. Don't forget to set a clean restore point as per the instructions before you work further on your computer.

I don't think you need XPprofiles, but I will turn you over to Bj or Chas for a better answer. It has to do with ntlworld.

abri

 

pc was running slow despite the fact that i cleaned up and reduced start ups on task bar. ran spyware doc and found Trojan_pws.transpy. didn't set restore point until after working with photos cs2 yesterday ..darn. i forgot.
do i have to start from scratch to see if system is infected again?
Ericbk:eek

 

Hi Eric!!

Try this first:

Download and run this...

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply and

Note:
Do not mouseclick combofix's window while it is running. That may cause it to stall.

Are you running both antivirus and firewall? And, did you install Spyware Blaster?

Thanks!
abri

 

will do what u asked no problem i'd rather have a clean machine. what happened was when i started Pshop cs2 i accidantly clicked on allow ps cs2 to access internet. then when i went to file>open a dialogue box opened to open MyNetwork. the hdd light was going crazy so i shut down ps cs2
any way i'll run the scans.i

 

here are the files. sorry for delay but bitdefender takes quite awhile to run as u know.
had a trojan ..bank fraud. would that track keystrokes from bank account?
also i am running anitvirus ..avg and did not download spy blaster as i have an account with spy doctor. i have a firewall zone alarm is my firewall that i use.
Eric

 

well, it seems that the prodigal son downloaded ps cs2 not in a proper way ..skull and crossbones way. so i uninstalled it but i'm pretty sure i didn't ask the uninstall to delete the authentication file. that may be where the problem is. so do i risk reinstalling and then uninstall all of it or leave it based on the following... ran spyware doctor after nothing caught. ran search and destroy nothing caught. ran bitdefender lots of stuff 17 i think all in old profile of thunder bird ..can i follow path and delete those profiles? they're all old email addresses and from isp's that i don't use.
any suggestions? or have i exceeded my questions and attention?
Ericbk
here's the new bitdefender file.

 

Very late here....
Will get back to you tomorrow.
With Thunderbird, if you don't want to look for the infected e-mails in the Bit log, you can just empty out the folders into the trash, then delete everything from the trash and run CCleaner or ATF Cleaner to get them out of the computer. I don't know what will happen if you simply delete the profiles folder, whether it'll come back empty or not come back at all. I don't think the address list was infected.

I'll get back to you tomorrow.
abri

 

Hi Eric!

Don't reinstall it. If it was a cracked version, they sometimes leave a keygen behind, but I don't see one in your logs. I think it's enough that you uninstalled it.


Please do the following:


1) Please go to Jotti and upload the following file and have it scanned. Tell us what they find. Your IE duplicated itself into the dll section of windows, and we aren't sure why. It doesn't look like the program was changed in any way, but we wanted to make sure.)

- C:\Program Files\Internet Explorer\


2) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

3) Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


4) After you have completed ALL of the above in the correct order, please attach the following logs.

• Report from Jotti
• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

abri

 

thanks Abri .. well, i neglected to tell u yesterday, Friday that when i went to a/r programs there was a toolbar i didn't load dealio toolbar. when i removed it and clicked finish ie opened and went to there site .. should i worry or run more scans. sorry to be such a pest but i've never had so much trouble.
Ericbk

 

Hi Eric!

Please carry out the instructions in post 14. They don't take long and I can look at your logs after that. If your computer looks clean, I'll post a last set of instructions to you. Straight from the horse's mouth: Dealio Toolbar is not malware. Why the uninstall took you to their website? - nice trick, but I think you're okay there.

abri

 

ran scans as requested. jotto said that pc was clean in more info it said "your hash has been found in 54 packages.
here are avenger, shownew and getrun and hijack logs. it seems to run faster but i haven't rebooted should i set restore point?

 

here's hijack.txt

 

yes i scanned c://program files/internet explorer/iexplore.exe
here are the results. sorry i didn't copy and paste all of them previously. it didn't occur to me. i hope this helps ..thanks for ur continuing help.
Ericbk
Service load:
0% 100%
File: iexplore.exe
Status:
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: e7484514c0464642be7b4dc2689354c8
Packers detected:
-
Bit9 reports: No threat detected (more info)
Scanner results
Scan taken on 25 Aug 2007 21:08:49 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

 

do u mean post 15? the one with the lines to fix in hjack? if not... i'm not sure what ur referring to?
thanks abri
Ericbk

 

thanks chas .. i was going to take today off from the pc but i'm glad i turned it on. it seems to be running a little faster. abri has suggested something for me to do but i'm not sure which previous post he was referring to for me to follow.
thanks chas,
Ericbk

 

hi abri and chas. i did the scans early this morning and uploaded them i just have to change the extension for analyse to analyse.txt and they will be complete.
i guess that ticked off abri or else a lot of other people are busy cleaning up their pc's.
thanks for your help chas

 

i tried twice to upload analyse.txt but it wasn't attached to post so trying again here.

 

will try one more time to upload analyse.txt. then i've got a dinner date with friends. must leave.

 

well now i've really got to run.

 

Hi Eric!
Your logs look clean. I will be more conservative this time and suggest that you first set a clean restore point as per the linked instructions below (Disable and Enable System Restore). Run your computer for a couple of days, and if everything seems to be working okay, then remove the below logs and tools listed in the box below. Please consider following the suggestions in the below link: How to protect yourself from malware. You have several antispyware programs running in parallel and this is not necessarily more effective in protecting you. More does not always mean better. The programs and suggestions listed in this tutorial are useful and it's a nice read.
abri