S.O.S. Fake Trojan Removal msiconf.exe

Discussion in 'Malware Help (A Specialist Will Reply)' started by ramir, Dec 1, 2008.

  1. ramir

    ramir Private E-2

    I was searching the internet and downloading a decent PSP video converter or dvd ripper when an X icon with message that i was infected by trojan appeared. When it suddenly changed my display resolution and turned to blue display like memory dump thing. but the message is im infected by trojan. when i tried to restart my laptop by pressing the power button, the blue screen disappeared but my screen resolution stayed the same. i searched the net for solution and tried to kill and disable msiconf.exe and the pop-up disappeared.

    i already tried the solution from this forum and finished all the steps. but and but... i would really appreciate if someone can final check this logs, if there's still infections. Please, i beg someone... im afraid that there's still problem.

    Thanks..
     

    Attached Files:

    ramir, Dec 1, 2008
    #1
  2. ramir

    ramir Private E-2

    here's the next and final log.
     

    Attached Files:

    ramir, Dec 1, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Lets first do this:

    Use windows explorer to find and delete:
    Code:
    C:\Users\JanRamir\AppData\Roaming\"
10d3c4~1      Nov 30 2008        3262  "10d3c41e53f9306b"
10ecb3~1      Nov 30 2008        3262  "10ecb39c39d7e832"
11e077~1      Nov 30 2008        3262  "11e0778c503f899e"
1600cc~1      Nov 30 2008        3262  "1600cce44ce63cdf"
176e5d~1      Nov 30 2008        3262  "176e5ddaa6bac968"
191ea2~1      Nov 30 2008        3262  "191ea228bb60a2ef"
1a89bd~1      Nov 30 2008        3262  "1a89bdd9ad41fc8"
1bde69~1      Nov 30 2008        3262  "1bde695736bbb334"
1d33db~1      Nov 30 2008        3262  "1d33db54e7734650"
1e7461~1      Nov 30 2008        3262  "1e7461ce64b662a"
1ee3dc~1      Nov 30 2008        3262  "1ee3dc22f6aa7559"
1f8840~1      Nov 30 2008        3262  "1f884092396336c3"
21bd2d~1      Nov 30 2008        3262  "21bd2d35a96d5943"
23226d~1      Nov 30 2008        3262  "23226d76e4058a1e"
240a98~1      Nov 30 2008        3262  "240a98761fe26b1e"
242549~1      Nov 30 2008        3262  "2425490d7f1c186"
2490c8~1      Nov 30 2008        3262  "2490c84948048f57"
25abe9~1      Nov 30 2008        3262  "25abe9f33255f904"
2a503e~1      Nov 30 2008        3262  "2a503ee933f19244"
2a8cec~1      Nov 30 2008        3262  "2a8ceceaf124a67b"
2b6115~1      Nov 30 2008        3262  "2b6115b4ea5b70b3"
2e677b~1      Nov 30 2008        3262  "2e677b78920b1ad"
3112c4~1      Nov 30 2008        3262  "3112c4d1ec3ae64d"
342300~1      Nov 30 2008        3262  "3423006c6d4f5273"
34a0e4~1      Nov 30 2008        3262  "34a0e4f4d17a253a"
37a53f~1      Nov 30 2008        3262  "37a53ff85faebf7d"
3bc838~1      Nov 30 2008        3262  "3bc838babc4bb588"
3ed553~1      Nov 30 2008        3262  "3ed553ea4a371072"
416b8e~1      Nov 30 2008        3262  "416b8ef48657fd12"
41837b~1      Nov 30 2008        3262  "41837ba0c24b3ab4"
42102b~1      Nov 30 2008        3262  "42102b4a3eb8a71a"
425fb4~1      Nov 30 2008        3262  "425fb4188fc53dc8"
493d65~1      Nov 30 2008        3262  "493d6576461e6e3"
498961~1      Nov 30 2008        3262  "49896148d98b4e83"
4a69f2~1      Nov 30 2008        3262  "4a69f21d74291881"
4a8609~1      Nov 30 2008        3262  "4a860920421b25a0"
4c0f07~1      Nov 30 2008        3262  "4c0f07d6a444bac8"
4c53bf~1      Nov 30 2008        3262  "4c53bf62b5ceb135"
4e9671~1      Nov 30 2008        3262  "4e9671f84427bbd1"
508461~1      Nov 30 2008        3262  "508461b37ea50221"
50c9aa~1      Nov 30 2008        3262  "50c9aaf593f0fb79"
50f9de~1      Nov 30 2008        3262  "50f9de5b6b753361"
517cb6~1      Nov 30 2008        3262  "517cb653ed112af0"
5304c2~1      Nov 30 2008        3262  "5304c227176c7d00"
583e9f~1      Nov 30 2008        3262  "583e9fa0f4112f3"
588e8f~1      Nov 30 2008        3262  "588e8f8510a4edca"
590ed4~1      Nov 30 2008        3262  "590ed4b03dc50d1e"
59161c~1      Nov 30 2008        3262  "59161c216d3dc172"
59eca4~1      Nov 30 2008        3262  "59eca484fe758c5c"
5fec1b~1      Nov 30 2008        3262  "5fec1bcf1effada"
62e0f5~1      Nov 30 2008        3262  "62e0f51df8d95e73"
653e08~1      Nov 30 2008        3262  "653e085bafdcf311"
67e780~1      Nov 30 2008        3262  "67e78057d5c58f35"
68784a~1      Nov 30 2008        3262  "68784a34ce8f541b"
6b079a~1      Nov 30 2008        3262  "6b079a4571df78c2"
6b17af~1      Nov 30 2008        3262  "6b17af2deadbef21"
6c7190~1      Nov 30 2008        3262  "6c71907f1ca916f2"
71fae2~1      Nov 30 2008        3262  "71fae22cec6e99b0"
733a7a~1      Nov 30 2008        3262  "733a7af44788cb69"
73d28a~1      Nov 30 2008        3262  "73d28a2d734b9de"
74cc8d~1      Nov 30 2008        3262  "74cc8dd658815f23"
7608bc~1      Nov 30 2008        3262  "7608bcaf8349314c"
769fdf~1      Nov 30 2008        3262  "769fdf15f7bb5c9a"
76f0d0~1      Nov 30 2008        3262  "76f0d0eeb6b1e4ad"
78f032~1      Nov 30 2008        3262  "78f03243175e9d1c"
7c19b9~1      Nov 30 2008        3262  "7c19b9c148523643"
7eaf77~1      Nov 30 2008        3262  "7eaf773ca52b0ce0"
811ecd~1      Nov 30 2008        3262  "811ecdd8e748276c"
829fc4~1      Nov 30 2008        3262  "829fc441f1165792"
85e5bf~1      Nov 30 2008        3262  "85e5bf9b9cf2203f"
8893ae~1      Nov 30 2008        3262  "8893ae7369cbd3e6"
895026~1      Nov 30 2008        3262  "8950265c187758de"
8efea6~1      Nov 30 2008        3262  "8efea6a9ea8863ee"
8f26a7~1      Nov 30 2008        3262  "8f26a79757bb7466"
91d51d~1      Nov 30 2008        3262  "91d51dff9d79988e"
922107~1      Nov 30 2008        3262  "922107cb6429ec0a"
9315a2~1      Nov 30 2008        3262  "9315a26f8c6523b4"
9382bc~1      Nov 30 2008        3262  "9382bcaa378efe8d"
94c708~1      Nov 30 2008        3262  "94c7087dc1d36875"
9714d9~1      Nov 30 2008        3262  "9714d9df22c03895"
985ee3~1      Nov 30 2008        3262  "985ee36e301759b1"
98ef76~1      Nov 30 2008        3262  "98ef76193c17c2ec"
9d2e9d~1      Nov 30 2008        3262  "9d2e9d9c58a50ac6"
a0cda9~1      Nov 30 2008        3262  "a0cda904c8addcfd"
a1588f~1      Nov 30 2008        3262  "a1588f51ed2d877"
a34077~1      Nov 30 2008        3262  "a34077afcc15358e"
a78593~1      Nov 30 2008        3262  "a785936ba4725930"
a86d89~1      Nov 30 2008        3262  "a86d89ecbe07ddc2"
a872a8~1      Nov 30 2008        3262  "a872a838331841ae"
a92bd4~1      Nov 30 2008        3262  "a92bd45c1ee076c7"
aaf35e~1      Nov 30 2008        3262  "aaf35e2c26fdec6"
adf6c9~1      Nov 30 2008        3262  "adf6c9773a409c4
b41a09~1      Nov 30 2008        3262  "b41a09065e56272a"
b9524f~1      Nov 30 2008        3262  "b9524f5a71657aa4"
b973a0~1      Nov 30 2008        3262  "b973a061adc1a0d7"
b97c3d~1      Nov 30 2008        3262  "b97c3d74d653bf05"
b9925a~1      Nov 30 2008        3262  "b9925a173b4e3b58"
bb6d99~1      Nov 30 2008        3262  "bb6d9966348130a4"
bbf2df~1      Nov 30 2008        3262  "bbf2dfaded624692"
bda898~1      Nov 30 2008        3262  "bda898fdae76864a"
be5818~1      Nov 30 2008        3262  "be58187f7be7a173"
c311ad~1      Nov 30 2008        3262  "c311ad9785da5c7d"
c53cee~1      Nov 30 2008        3262  "c53cee9c6fe68f32"
c5af56~1      Nov 30 2008        3262  "c5af56ffef102ae8"
c908f8~1      Nov 30 2008        3262  "c908f82634d159"
c920e1~1      Nov 30 2008        3262  "c920e1f72f5d6a7c"
cb8fa2~1      Nov 30 2008        3262  "cb8fa24025a9edfe"
cc8e92~1      Nov 30 2008        3262  "cc8e92517a9fc355"
cdfa0e~1      Nov 30 2008        3262  "cdfa0e1cc88b644"
ce12f9~1      Nov 30 2008        3262  "ce12f99b018cbfd
d1839c~1      Nov 30 2008        3262  "d1839cf17926fc9a"
d3e93f~1      Nov 30 2008        3262  "d3e93f9e91ff31a9"
d42119~1      Nov 30 2008        3262  "d4211901243e3f9a"
d76cad~1      Nov 30 2008        3262  "d76cad26780efaf"
d7c5f0~1      Nov 30 2008        3262  "d7c5f009765e33a1"
d8d1c6~1      Nov 30 2008        3262  "d8d1c6e2de2de6fa"
dabad7~1      Nov 30 2008        3262  "dabad73c1556e5d0"
dcc44a~1      Nov 30 2008        3262  "dcc44a73b2dd4f69"
dd0b57~1      Nov 30 2008        3262  "dd0b57971caf025d"
de692a~1      Nov 30 2008        3262  "de692a3b2d2ac11b
e3be1f~1      Nov 30 2008        3262  "e3be1f4dca6d2d2b"
e5c0f5~1      Nov 30 2008        3262  "e5c0f57aec852831"
e8ca0e~1      Nov 30 2008        3262  "e8ca0e4594d0a555"
e91ffa~1      Nov 30 2008        3262  "e91ffa869e362b70"
eb0215~1      Nov 30 2008        3262  "eb0215fc6deb7bca"
eb99a6~1      Nov 30 2008        3262  "eb99a60df4261f6"
ec8e95~1      Nov 30 2008        3262  "ec8e95cab059a4ba"
ee3aaa~1      Nov 30 2008        3262  "ee3aaa55c9072c66"
ef8fe5~1      Nov 30 2008        3262  "ef8fe54a8a075da4
f11eea~1      Nov 30 2008        3262  "f11eeaf87a6cb7c1"
f1ca52~1      Nov 30 2008        3262  "f1ca5207f60bf668"
f217a8~1      Nov 30 2008        3262  "f217a8d1c299e750"
f575c4~1      Nov 30 2008        3262  "f575c4fe18a2b35c"
f64d59~1      Nov 30 2008        3262  "f64d59ec444e4f4"
f873e0~1      Nov 30 2008        3262  "f873e0d2a1e9fc84"
f8c8c9~1      Nov 30 2008        3262  "f8c8c975ed910926"
f9658b~1      Nov 30 2008        3262  "f9658b54c0e0ead7"
fd68d9~1      Nov 30 2008        3262  "fd68d9246ac18732"
fefb5a~1      Nov 30 2008        3262  "fefb5a769b4df706"
ff0017~1      Nov 30 2008        3262  "ff00174f8b155e3a"
ff83b4~1      Nov 30 2008        3262  "ff83b49de900bd38"
    Now tell me exactly what issues you are having. Have you also checked your device manager for any errors?
     
    TimW, Dec 3, 2008
    #3
  4. ramir

    ramir Private E-2

    the error i had before i tried the fixes, everytime i browse and even after i closde my ie or firefox, this error that im affected by trojan appears on the upper left corner of the display. then i just happen that blue screen appeared. sir, can i have a question? whats the use of those rfoaming files that im going to delete?

    thank you for your prompt response.
     
    ramir, Dec 4, 2008
    #4
  5. ramir

    ramir Private E-2

    i have checked also my device manager, there's no error so far.
     
    ramir, Dec 4, 2008
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The roaming files are a result of you being on either a workgroup or a domain.

    Are you having problems?
     
    TimW, Dec 5, 2008
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds