I've got a trojan or a few, please help.

katieplum · Apr 28, 2009

Hi

About a week ago I started getting messages from AVG that I had a trojan, I've subsequently tried a number of spyware programmes e.g. Unhackme and Malwarebytes to get rid but nothing seems to work. If you can help me I'd be most grateful.

I've done everything as requested in the read me first guide, although on both the Combofix and the MGtools my PC rebooted itself mid scans as if it had an error. This was after the Combofix had already rebooted itself i.e. it rebooted itself twice and the second time it didn't give me the log file although I have found it at c://combofix.txt.

I hope I've done everything right, if you need me to do anything else please let me know. Otherwise any help you can give me is most appreciated.

Thanks

chaslang · May 2, 2009

Welcome to Major Geeks!

Your logs from ComboFix and MGtools show that they did not run completely and as such they do not give us all the info that we need to continue. Also your Malwarebytes log shows that you were not updated to the current database. So let's try being with the below.

Run Malwarebytes and click the Update tab. Then click the Check for Updates button so you update to the current version of the program and database. Then run a new scan with it too. If it tells you it needs to reboot then reboot immediately. Attach the new log.

Now download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Drivers to delete:
i386si
ati64si
port135sik
nicsk32
netsik
ksi32sk
acpi32

Files to delete:
C:\WINDOWS\system32\CF13287.exe
C:\WINDOWS\SYSTEM32\DRIVERS\I386SI.SYS
C:\WINDOWS\SYSTEM32\DRIVERS\NICSK32.SYS
C:\WINDOWS\system32\digiwet.dll
C:\WINDOWS\Temp\BN12.tmp
C:\WINDOWS\Temp\BND.tmp
C:\WINDOWS\Temp\D653F3EC.TMP
C:\Documents and Settings\HP_Owner\Local Settings\Temp\8B57FEA3A174D628D7F49EA8FD939D31
C:\Documents and Settings\HP_Owner\Local Settings\Temp\904D57F61A9D7FE5185C01B47D54C2FB
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).
If you see a license agreement for TrendMicro HijackThis popup, you must click the Accept button twice for it to run.

Then attach the below logs:

C:\avenger.txt

C:\MGlogs.zip

and don't forget the new log from Malwarebytes

Make sure you tell me how things are working now!

Log in or Sign up

I've got a trojan or a few, please help.

katieplum Private E-2

Attached Files:

SASlog.txt

mbam-log-2009-04-28 (10-37-05).txt

ComboFix.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member