stubborn trojan attack!

hedgehog442 · Aug 3, 2006

hi good people out there,

could you help me with this evil bug?

i just tried to do the steps you guys recommended from 1-7, except:

- i couldn't run the online scanners bitdefender + panda (did the troubleshooting suggested in their pages, to no results)

- couldn't create shownew log, it wouldn't work (deleted it + re-downloaded, no results)

- i'm sure i still have active or lurking trojans. i don't have pop-ups anymore, and my browser is not obviously hijacked, but it is very slow, so it must be.

so, my specs:

=dell inspiron 2500 laptop
=running Windows ME
=126 mb ram
=Intel Celeron

what i did:i just basically followed all the steps.

i runned:

- cccleaner (normal mode)
- spybot (safemode)
- counterspy (safemode)
- hijackthis (normal mode)

i had runned before: clamwin antivirus, lavasoft ad-aware, and aboutbuster

i deleted whatever i could manually (add/remove programs)

please help!

thanks a bunch,
hedgehog

chaslang · Aug 4, 2006

Welcome to Majorgeeks!

Please redownload the latest version of ShowNew which now supports your OS (the one you had before did not support WinMe). Download it from the same link.

Then run ShowNew and attach the log.

After that we can get started on your problems; however, please explain exactly what your symptoms are. Just saying stubborn trojan does not convey enough information. Also what exactly did you mean by your browser is slow.

hedgehog442 · Aug 5, 2006

dear chaslang,

thanks for your reply. i runned anti-spyware/adware softwares twice more, so i'm attaching a new hijackthis log.

the symptoms got worse, i'm very worried: to start running windows the computer takes something like 5 minutes. IE does not work anymore, in fact when i try to run it, the computer freezes (i'm using firefox right now). safe mode only works when i change my settings in the system configurations utility. tapping the f8 key doesn't work anymore. i could check my email (outlook took a long time to start). it seems that i'm getting a lot more (like 5-10 times more) junk mail. could be a coincidence. even in safe mode, sometimes the computer freezes.

thanks so much for this, guys. you rock.

hedgehog

hedgehog442 · Aug 5, 2006

ok, let's see if i can attach that most recent hijackthis log now...
couldn't do it the first try.
well, i can't! it says i already uploaded it before, even when i change the file's name...
hope it's ok.

chaslang · Aug 6, 2006

You do not really show any malware problems! We can try to help you speed up your boot time and improve overall perfomance by removing some unnecessary processes from your startup.

First a question! Do you use the below?

O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers

WksSb.exe is a Works Portfolio tool that lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file

If you do not use this feature, add the above O4 line to the below procedure to fix with HijackThis.

Make sure viewing of hidden files is enabled (per the tutorial).
Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {3D8C5C3D-35A0-43F7-8813-36902A92766D} (SoftLinkUpdate Class) - https://sol.softitler.com/downloads/SoftLink.exe
O16 - DPF: {A86A4C7C-6911-42D3-B898-52A199AB41CB} (SoftSecure Class) - https://sol.softitler.com/downloads/SoftLink.exe
O16 - DPF: {A86FEA6F-95C0-4190-A622-C5C02739CBE3} (WebTransfer Control) - https://sol.softitler.com/Downloads/WebTran.cab

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\TEMP\ <--- delete all files in this folder! Only a couple from the current date cannot be deleted. Just work around them.:

Now we need to Reset Web Settings:

If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.

Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now.

I have a feeling you just have problems with your Windows ME OS. I have seen it quite often. Over a period of time it becomes flaky. Also when certain Windows patches (updates from Microsoft) are added. Operation on a network with shared drives becomes a nightmare. Opening just one Explorer window to a shared drive, can cause the PC to slow to a halt for 5 to 10 minutes and then all of a sudden it will respond. If you now close the Explorer windows to the shared drive, everthing we still be little slow but it will be basically okay. If you do not close the Explorer windows and attempt some other activity on the sharded drive, you will grind to a halt again.

hedgehog442 · Aug 7, 2006

did all you recommended

hey chaslang,

thanks for that.

first, let me make myself clear about the trojan - it WAS in my machine for sure. before i runned the anti-spyware + anti-virus, i had zillions of pop-ups with ads, a nasty toolbar888, and the computer wasn't working at all in normal mode. now it's just not working, but no pop-ups etc. i think it would be odd if was just a coincidence that the computer decided to stop cooperating right after the attack (it was somewhat slow, but very cooperative before).

anyhow, i appreciate you advice very much. the steps were taken, but the computer seems to be still acting weird: it froze when i was opening "my documents" (explorer froze), internet is slower than usual, i don't even dare to start opening all the software i used to run at once before.

should i just reformat my hd (sigh)? and if i do so, do you think i could run windows xp in a machine like mine? or 2k? AND, is there any risk that my files are infected?

your help is invaluable, i thank you again,

hedgehog

chaslang · Aug 8, 2006

Re: did all you recommended

I see you have both Spy Sweeper and CounterSpy installed. Are these free versions or paid versions? If free, uninstall both of them. Since they are only trials they will expire anyway. And having two programs like this running will slow your PC down alot. After uninstalling these, how are things running?

A would not recommend running Windows XP on your system. It is too slow and does not have sufficient RAM. Even for Win ME I would recommend at least 256 Mb. If you don't want to buy a new PC and are considering changing the OS. Go to Windows 2K but look into added as much RAM as you can.

hedgehog442 · Aug 8, 2006

chaslang-san,

ok, who would know that just uninstalling those two cleaning ladies would put my poor speed-challenged machine back to its old shape? it worked, as far as i can tell. so simple, yet so effective.

i know, my RAM screams loud: get a new computer! i will, i will, when i find a new source of income. in the meantime, inspired by the extraordinary services of majorgeeks, i'll offer my expertise for free in some reputable internet forum (obviously, that's not computer or tech related).

keep up the good work, i'll be raving about you guys everywhere.

a big thank you,

hedgehog

chaslang · Aug 9, 2006

You're welcome! But just remember that your PC does need protection and protection comes at a price or PC performance. You really need to work thru the below because your PC will be very prone to malware problems without proper protection.

How to Protect yourself from malware!

Log in or Sign up

stubborn trojan attack!

hedgehog442 Private E-2

Attached Files:

runkeys.txt

counterspy.txt

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hedgehog442 Private E-2

Attached Files:

newfiles.txt

Spy Sweeper Session Log 2.txt

hedgehog442 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hedgehog442 Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

hedgehog442 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member