Need help please!!!!

Discussion in 'Malware Help (A Specialist Will Reply)' started by vandria25, Jan 25, 2008.

  1. vandria25

    vandria25 Private E-2

    Downloaded files from torrent site,it was a while back!Nod32 picked it up as reg/zapchast trojan,so when asked what to do with it i deleted the file thinking that was the end of that now every time i close i.e i get a (about blank microsoft).It always says that scvhost32 created it.So i done the clean up procedure,followed all the steps and downloaded all the tools and done the scans,sorry still a novice when on the pc.Here's my logs...Thanks in advance guys!
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You must rerun AVG Antispyware and this time do not Ignore all the problems it finds like you did last time. You must either Quarantine or Delete allt he problems. Save a new log and attach it at the end of the below instructions.
    Please use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 11

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.


    Use windowexplorer to find and delete:
    C:\WINDOWS\S1632CCC5.tmp.

    Now run CCleaner.

    Now install the current version of Sun Java from: Sun Java Runtime Environment.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.
    Then attach the new logs:

    * new AVG Antispyware log
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  3. vandria25

    vandria25 Private E-2

    Thanks for your time and patience,have done all steps but had a problem deleting the file C:\WINDOWS\S1632CCC5.tmp.came up as cannot delete s1632ccc5:it is being used by another person or program
    close any programs that might be using the file.I'm pretty sure i closed all programs that i know of,and now my wallpaper has dissappeared.Anyways have attatched both logs so thanks once again.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please disable all anti-virus and anti-spyware programs while we do the following:

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to see if this exists:
    C:\WINDOWS\system32\msnsc.exe

    If so..delete it.

    Tell me what problems you still have.
     
  5. vandria25

    vandria25 Private E-2

    hey Tim just just finished doing the second set of steps you gave me,and the news is pretty good scanned with spybot s&d,no threats detected!scanned with avast found one,i know i deleted it but seems to be back.It doesn't seem to be affecting the performance,cause ie and firefox are a lot more stable and there's no more of that (about blank) crap.Just glad that trojans gone.Before i ramble on just wanna say thanks alot and very much apprecciated for the time and effort spent helping me and others!!!!!attatched report!once again thank you!!!:D
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I suggest that you periodically do an online scan (such as BitDefender) as a backup to your anti-virus programs .....additionally, lets clean out the temps:

    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

    * Double-click ATF-Cleaner.exe to run the program.
    * Under Main choose: Select All
    * Click the Empty Selected button.

    If you use Firefox browser

    * Click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    * Click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main ATF Cleaner menu to close the program.

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used Pocket Killbox during your cleanup, do the below
    * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combofix.txt and C:\ComboFix-quarantined-files.txt logs that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    10. If you are running Windows XP or Windows ME, do the below:
    * Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    11. After doing the above, you should work thru the below link:
    *How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds