fretog dai, the keylogger that killed system restore

webartogo · Jul 18, 2009

HELP!! I have a half fried computer!

CA Yahoo anti-spy found FRETHOG DAI and cleaned it.
That triggered a meltdown of my XP.
System restore was stopped, and will not run, not even in safe mode, IE6 and Firefox3 no longer load, Comcast's McAffee was disabled.
That alone was bad enough, but it wiped out everything connected to the internet, DNS, TCPIP, IP ADDRESS, EVERTHING!
It won't let me install anything to restore or clean, of fix anything.
I can play games, read PDF's, watch a dvd,
Did I mention that it loads slower than grass growing in a drought?
The repair console doesn't work.
It's a Dell 4700 dimension.
I've never seen a case this bad.
I've saved all my documents to a flash drive. I just want to re-install XP but I don't have my disk anymore.
Is this thing still on my hard drive? Or did it just damage things?
Can't find any info on this keylogger FRETHOG DAI
Please help.

chaslang · Jul 20, 2009

Welcome to Major Geeks!

First an important notice!

Win32/Frethog is a family of password-stealing trojans that target confidential data from Massive Multiplayer Online Games such as World of Warcraft and send the information to a remote computer. Password Stealing Trojans are very dangerous because they compromise system integrity by making changes that allow it to by used by the attacker for malicious purposes. Remote attackers use Trojans and rootkits as a means of accessing and taking control of a computer that bypasses security mechanisms. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is send back to the hacker.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised. They should be changed using a clean computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control again. and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

What Should I Do If I've Become A Victim Of Identity Theft?

Identity Theft Victims Guide - What to do

Click to expand...

Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.

TDSSserv Non-Plug & Play Driver Disable

READ & RUN ME FIRST. Malware Removal Guide

If something does not run, write down the info to explain to us later but keep on going.

Do not assume that because one step does not work that they all will not.

After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!

Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.

If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.

To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

Don't Bump! It Only Hurts You!!!

Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.

webartogo · Jul 30, 2009

Thank you so much for all the help, it's amazing that superantispy found the 2 files that were killing my computer.
I still have a couple of logs to send you.
These are the first 4 of the logs that I got during the cleaning.
So far, so good. Cleaned up most of the computer problems.
The only thing left is my internet connections are still screwed. Both the dial up and lan to the dsl.
ATT reports that they can see the connections are live but they can't ping me. I can ping them but that is about all.
Without the connection to ATT I can't redo my Motorola DSL modem.
Will it matter if I change to a high speed cable modem?

webartogo · Jul 30, 2009

Here is the last log file.

Again, I thank you for saving my life and my files. I was ready to do a complete XP restore and now I don't have to lose all my programs. Most of them I bought online and don't have a disk to them.
Thanks a million.

Cherah

chaslang · Jul 30, 2009

You need to attach the logs from SUPERAntiSpyware, Malwarebytes and ComboFix. Also you need to attach the requested log from MGtools.

Log in or Sign up

fretog dai, the keylogger that killed system restore

webartogo Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

webartogo Private E-2

Attached Files:

filereport rootrepeal.txt

Reg Loading Points.txt

ssdt scan.txt

Hijack Analysis Report.txt

webartogo Private E-2

Attached Files:

shadowssdt.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member