Getting a new trojan every few days

You also need to attach the C:\MGLogs.zip.

 

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Download Registry Search (see the link titled RegSearch Download Link )

• Extract the files from Regsearch.zip into a folder.
• Doubleclick regsearch.exe to start the program.
• See the top 3 boxes under the Enter search strings (case independent) and click Ok... option, enter the below bold string (use copy and paste)

• itlperf
  itlsvc

• Then click "OK".
• Notepad will be opened with text in it (the file named RegSearch.txt will be saved in the program's folder as well).
• Attach this RegSearch.txt file.

Now download and install Registrar Lite

• Open up the program and from the menu at the top select "search"
• In the "search in" box choose/navigate to HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost
• In the "what to look for" box ensure that key names, value names, and data boxes are checked.
• In the "text or data to search for" box copy and paste itlperf into it and press enter. The software will run a search, be patient, eventually after a few moments the results will be displayed. If anything *is* found you should be able to click on "export results" from the menu at the bottom (little disk icon) and save to a text file to attach here.

Let me know how you get on.

 

Wrong link to Registrar Lite was given. Uninstall that version and use the one at Registrar Lite

 

Yes it does! 4 buttons to the left of the magnifier glass button ( used for searching ). But you can also just use the menus rather than the buttons too. Just click File, Export

 

Looks like you forgot the below step:

Repeat the search for itlsvc too and attach those results also.

 

You do not need to export anything. Nor is a search necessary either. Just do the below.


Copy the bold text below to notepad. Save it as fixIT.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.


Are you currently having any malware problems?

 

Silly names that scanners give are just about useless. What we need to know is exactly where and what was detected? Like file and folder names ( full paths ) or registry keys...etc. This may be a false detection or could be just a detection of what we already removed. This is part of the reason the READ & RUN ME instructions ( right at the start ) state not to do anything we don't ask you to do. Not even other scans. You need to wait until we are 100% finished and have performed final instructions. So let's do this now and then see what happens.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome. Safe surfing.