"Please wait while the connection is beeing established" Desktop.ini Trojan infection

mcassidy · Jul 18, 2012

Hello everyone.

This is my first post on the forum. I have a problem with my Acer Aspire 5315 running Windows Vista. Home Premium. On start up everything appears to go as normal but just as the "Welcome" message begins to appear I get a white screen with the message "Please wait while the connection is beeing established". I assume "beeing" should be spelled as "being" but that is how it appears on the screen. The same message is repeated in German on the next line. There is also constant thrashing of the hard disc drive. The computer just stays constantly in this state. I have read the appropriate about this virus on your very helpful forum and have done the following:

1. Downloaded and ran frst.exe via a USB flash drive attached to the computer.
2. Generated the frst.txt file as a result of the scan.

As far as I understand I need to generate a fixlst.txt file from the frst.txt file and then run the frst.exe application again but this time click the "fix" button" The fixlst.txt file needs to be on the USB flash drive in the same folder as as frst.exe program and frst.txt file.

I am hoping that you will be able to generate the fixlst.txt file for my computer. I will attach and upload the frst.txt file.

Thank You.

Maurice Cassidy.

TimW · Jul 18, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

Running MGTools.

mcassidy · Jul 18, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hi

Thank you very much for the fix file. It worked in that I was able to get to the windows desktop. Everything seemed ok and I was about to connect to the internet and run the tools recommended in the malware forum. However the dreaded "Please wait while the connection is beeing established" appeared yet again!! So I had to start again using the frst.exe and clicking "fix".

However the message kept appearing before I was able to do anything useful. I did find that if I pressed the Windows key on the keyboard I was able to click start and view desktop but it was difficult.

Eventually I booted into Safe Mode and all was quiet!! No messages but obviously limited functionality. I could not connect to the internet as I was using a usb dongle. I downloaded the HitmanPro36, mbam-setup,MGtools and RogueKiller via my netbook and saved them to a flash drive. I then inserted the flash drive into the infected Acer Aspire. I was not sure if the programs would run in Safe Mode. I started with Malwarebytes and although there were a couple of error messages it did eventually get to the home screen in Safe Mode. I was able to do a scan and remove threats which were identified.
On starting windows normally all was well. I then ran the other applications. No malware was present. I have posted the log of the rogueKiller program along with the fixlog.txt file from the frts program.

I have learned a lot but you are still light years ahead!!

Many thanks again.

Maurice Cassidy.

TimW said: ↑

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST.exe on your flash drive.

Now reboot back into the System Recovery Options as you did previously.
Run FRST and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (See how to attach)

Now boot into normal Windows can continue with the below.

Running MGTools.
Click to expand...

TimW · Jul 19, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 3 detections:

Rans.Gendarm

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* RKLog.
* C:\MGlogs.zip

Make sure you tell me how things are working now!

mcassidy · Jul 19, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hello

Thanks for your reply. I have run both programs as you requested. When I ran RogueKiller there were no entries for the registry tab.

When I ran MGtools for the first time (yesterday) all the action from the program took place in a command (DOS) window. At a certain point the command window prompted ... Press any key to continue .. And then the trend micro HijackThis program took over. I don't have a folder C:/MGTools. The MGTools program is not installed on the hard drive. I have just ran the MGTools program again. This time nothing happened after the prompt ... Press any key to continue...

I think the name of the file in the command window was MGTools.bat. It looked to me that it was a batch file executing the commands listed.

I am using an iPad at the moment and so cannot easily attach the Rkreport.txt file. I will attach at my next post on the PC. As I said earlier I dont have the batch file for the RogueKiller program on the hard drive.

The Acer Aspire which was infected is working fine. I am following your advice on the forum and installing some suggested programs eg antivirus and firewalls.

Thanks again for all you help.

Maurice Cassidy.

mcassidy · Jul 19, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hello again

I am back at the PC. Please find attached log file from run of the RogueKiller program.

Thank You.

Maurice Cassidy.

TimW · Jul 19, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Please click Start, All Program, Accessories and you will see ( among other things ) a Command Prompt entry.

Right click the Command Prompt entry and select Run As Administrator.

It is critical that you run it this way.

If you do this properly, a command prompt window will open with a title of Administrator Command Prompt.

Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple/brown is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
GetRunKey<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
ShowNew<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.

mcassidy · Jul 20, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hello

Thanks very much again for your reply. I have carried out your instructions.

The process seemed to go very similar to the first time I ran MGtools.

The first command GetRunKey eventually produced a text file filelog.txt

The second command ShowNew seemed to produce a similar process to the GetRunKey. Again a text file newfiles.txt was produced.

I have attached copies of both files.

The Acer Aspire which had been infected is still working fine. Thanks again for your help.

Maurice Cassidy.

TimW · Jul 20, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

What malware issues are you still having, if any?

mcassidy · Jul 20, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hello.

There does appear to be any malware issues. I have put in place the measures as outlined in your helpful sticky about protecting from malware. Hopefully all will be well.

Thanks.

Maurice Cassidy

TimW · Jul 20, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Good to know.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

mcassidy · Jul 22, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Hello

Thanks for your reply. I will put in place the measures you have outlined.

Your help has been very much appreciated for sorting out the problem.

Maurice Cassidy.

TimW · Jul 23, 2012

Re: "Please wait while the connection is beeing established" Desktop.ini Trojan infec

Sorry for the delay, I lost internet service on Sat. and just got it back.

Good to know and you are most welcome.

Log in or Sign up

"Please wait while the connection is beeing established" Desktop.ini Trojan infection

mcassidy Private E-2

Attached Files:

FRST.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Attached Files:

Fixlist.txt

mcassidy Private E-2

Attached Files:

Fixlog.txt

RKreport[1].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mcassidy Private E-2

mcassidy Private E-2

Attached Files:

RKreport[2].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mcassidy Private E-2

Attached Files:

filelog.txt

newfiles.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mcassidy Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

mcassidy Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member