Multiples Trojans

Discussion in 'Malware Help (A Specialist Will Reply)' started by riconsdca, Aug 7, 2008.

  1. riconsdca

    riconsdca Private E-2

    When ever I launch ie6 AVG reports 3 Trojans, I have both healed them and exiled them to the vault but to no avail. Sorry, but I have no knowledge of their infection source, but it most likely involved a ‘friend’ downloading something that he wouldn’t tell his mother about. They showed up August 6, 2008 0530 PDT when I started the comp that day.

    Dialer.SAP
    PSWS onlinegames.AYGY
    b.exe

    Even with “show hiden folders” toggled on I still do not see the ie5 temp folder.

    Attached are the requested logs.

    Thank you for any help,

    Ric
     

    Attached Files:

    riconsdca, Aug 7, 2008
    #1
  2. riconsdca

    riconsdca Private E-2

    Log 4
    thx
    R
     

    Attached Files:

    riconsdca, Aug 7, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!


    Begin by deleting the below huge file and then immediately empty the Recycle Bin.
    Code:
    2008-08-06 15:05 294,501,297 --a-- C:\WINDOWS\system32\syspilog.pil

    Now download LSP - Fix

    Run LSP-Fix.

    Check the Box labeled "I know what I'm doing" and then click on the mmchost.dll file (in the “Keep” section) to select it.

    Then, Select the >> button to move mmchost.dll into the Remove section.

    Now, click the Finish Button. When the Repair Summary box appears, click OK.
    If it is already in the Remove section, just click Finish.



    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).



    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Aug 8, 2008
    #3
  4. riconsdca

    riconsdca Private E-2

    So I have done every thing, BUT, during the Combofix run, a box with a big red dot with a white X came up and counted down stating something like ‘NT Authority SYS initiated shutdown save everything…’ Combofix made it to action 20 or so, the system restarted it self but took a long time saving settings and created a 790,000k “pagefile.sys” on c:\ . After restart I just started comofix again but zone alarm has been corrupted, custom mouse keys cant be used, drag and drop is gone as is all but the most basic cut and paste, the internet connection is offline (and now physically disconnected), this is why the logs might seem strange I had to use a jump drive and copy and paste the text from the logs .txt files on c:\, to a shortcut created on the desktop from the jump and then 'save as' on the jump. Just so you know none of this is bitching I am just trying to be thorough.

    The “sysinfo.txt” folder was empty after decompression.

    Reg edit was successful.

    MGlog was recompressed with Z7.

    Thanks for the help so far, should I be looking for xp’s key code?:) The os sits in its own partition, I built the thing when it was the rage to separate os, programs, and user files into their own partitions.

    Please find attached the requested logs.

    Ric
     

    Attached Files:

    Last edited: Aug 8, 2008
    riconsdca, Aug 8, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Do you have all of your Windows Updates (except maybe Win XP SP3)

    ComboFix did not create the pagefile. This is part of your Windows OS and has always been there. It was just hidden.

    The only possible reason for this was the shutdown while all the software was running. Nothing we did removed anything from ZoneAlarm. Right now I suggest uninstalling ZoneAlarm to avoid having issues with it blocking a connection especially if you think it is corrupted.


    After uninstalling ZoneAlarm check again. Also check that your TCP/IP settings are set for Obtain an IP Address automatically (this is commonly referred to as setting your PC for DHCP). See this: http://www.wolfson.cam.ac.uk/computers/roomconnection/setdhcp/windowsxp.html

    Can you get online now?

    You should not be adding anything to the ZIP file or making a ZIP file on your own. The correct ZIP file was already made by the program and it is located where stated. That is C:\MGlogs.zip Check for yourself. Delete the file you made which has multiple copies of logs in it.

    A few files related to things we were fixing seem to have created new files. I see the below which were not in your previous logs. These are slightly different names. Do you see them? Can you manually delete them?

    Code:
    2000-02-02 00:01 40,960 --sh--r C:\WINDOWS\system32\Karna2Drv.dll
2002-08-29 12:00 10,752 --sha-w C:\WINDOWS\system32\Proxy.dll
     
    chaslang, Aug 9, 2008
    #5
  6. riconsdca

    riconsdca Private E-2

    Thanks for your help,after i sent the last reply the system would not reboot but just hung while trying to shut down (the switch on the power supply worked after 20 minutes of it "saving settings") , so I just re-installed windows; i was planning a nice Friday eve at home anyway, and this meant i didn't rot my brain more by watching the teevee. The os install you were working on was 3 years old, had been ridden hard and put away wet most of the time, and had more issues that i had ignored before the trojans.

    So again thank you, I do appreciate all you did greatly.
    R
     
    riconsdca, Aug 9, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    chaslang, Aug 9, 2008
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds