ran logs for trojan now need help to fix

Discussion in 'Malware Help (A Specialist Will Reply)' started by lana3867, Aug 8, 2006.

  1. lana3867

    lana3867 Private E-2

    I have ran all the programs and have all my logs from the read me first. I need to know if the programs deleted all my problems so I can do a real system restore now. Do I also after restoring, put the files back to hidden? as they were before I started the whole process?
     

    Attached Files:

    lana3867, Aug 8, 2006
    #1
  2. lana3867

    lana3867 Private E-2

    here are the other files that go with my scans----please someone help me so I can finally get this done tonight.
    Thanks----GREATLY APPRECIATED!!!!
     

    Attached Files:

    lana3867, Aug 8, 2006
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What malware problems were you having that prompted you to work thru the procedures to begin with?

    You appear to have both Trend Micro and Symantec antivirus or security centers installed. You must only use one as mentioned in step 3 of the READ ME. You need to uninstall one!

    Is your copy of Spyware Doctor a paid or free version?

    No you don't need to hide files! But that is your choice. Changing the settings back will allow any future malware files to hide from your sight again.

    Why are you saying you want to do a system restore? That would possibly bring back any malware that you have already removed.

    Make sure viewing of hidden files is enabled (per the tutorial).

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    R3 - URLSearchHook: (no name) - ~EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
    O2 - BHO: (no name) - {c6d44bc0-cf2b-47a7-824c-2e30a9ddd3ec} - C:\WINDOWS\system32\igftat.dll (file missing)

    After clicking Fix, exit HJT.:
    Now we need to Reset Web Settings:
    1. If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2. Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3. If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.
    Now reboot in normal mode and post a new HJT log.

    Make sure you tell me how things are working now.

    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Aug 9, 2006
    #3
  4. lana3867

    lana3867 Private E-2

    I kept getting pop up for winantivirus and my trend micro penicillin 2006 said that I had a trojan.

    I have deleted the symantec liveupdate and the norton security center. I thought I had deleted all of the norton. It seems that my computer is working faster now that I have deleted Norton all the way. THANKS!!!

    I have the CD disk, a paid version of spyware doctor. I am just using the free evaluation version of penicillin, Should I purchase it???? I do not like Norton at all, it is very annoying.

    Thanks for the advice about hiding files, I am not to smart about why some of the computer things are the way they are. I have the hidden files showing as in step 2 of the read me first.

    So now I am going to exit the internet and go to HJT I will let you know how it goes.

    THANKS for replying
     
    lana3867, Aug 9, 2006
    #4
  5. lana3867

    lana3867 Private E-2

    I have done all that you said. Attached are my HJT new log. My computer seems to be working alot faster. Last night after I did the panda scan and then ran the HJT log and then rebooted after I thought I deleted all the norton, my microsoft updates and hp updates all showed up to be installed. I guess that whatever I had was stopping any updates from coming thru.

    THANKS AGAIN!!!!!!!!!!:) :) :) :)

    Please instruct me now if I can do a system restore. I also have to make recovery DVD's for my computer, it was never done when we got the computer but I wanted to make sure all my problems were gone before doing that.

    Also should I keep both the spyware doctor and penicillin? Do they do different things? I am clueless.....any advice would help..

    I will anxiously await your response.
     

    Attached Files:

    lana3867, Aug 9, 2006
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Let's speed things up a little more!

    If you plan on keeping the Spyware Doctor subscription and keeping it up to date (this means you have to pay the yearly subscription) then it is fine to keep it. If you do this, then uninstall the free Windows Defender.

    If you are not going to keep Spyware Doctor up to date then you should uninstall it and keep Windows Defender installed.

    Buying PC Cillin is your choice but if you want full support and all the features from it, you will have to buy it. Otherwise you can you the free tools in our How to protect thread (sticky).

    You can know have HijackThis fix the below non-malware items (they are just not needed) to help speed things up some more:


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/ctrl/SymAData.cab


    Your log is clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Aug 9, 2006
    #6
  7. lana3867

    lana3867 Private E-2

    TROJAN FREE Thanks to you!!!!

    :) :) :) :) :) :)
    Thanks a million, you were a great help!!!!! I sure appreciate all the help!!!!
    I think I am now trojan free, my computer is working much better and faster!!!

    I have done the systems restore and created a new restore point and I called it Major Geeks Clean--- so I waill always remember who helped me clean up my PC. Your website is fantastic!!!! I can't begin to thank you enough.

    :) :) :) :) :) :)
     
    lana3867, Aug 10, 2006
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: TROJAN FREE Thanks to you!!!!

    You're welcome. Surf safely!
     
    chaslang, Aug 10, 2006
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds