Trojan Collected.af HELP... I have an HJT log file.

Hello.. I happened to come across your sight searching on Google for info on this Collected.af virus. I have had no luck in getting rid of it so I thought I'd seek your help. It keeps coming up and bringing up a blank webpage to sssl.

I followed the instructions you had under...http://forums.majorgeeks.com/showthread.php?t=35407
I wasn't able to do the scans in safemode FYI.

I have also looked at the thread under...
http://forum.majorgeeks.com/archive/index.php/t-65113.html
for help. I already created the HJT folder under the Program files and now I guess I need to have someone take a look at my HJT logfile so I've attached.

Any help will be supremely appreciated! I'm located in Las Vegas and i have a few other colleagues infected with this!! Thanks...

LNETH

 

1. You MUST close ALL browsers before running HJT!

• C:\Program Files\Internet Explorer\IEXPLORE.EXE

2. You MUST run only ONE antivirus program, you need to pick between the two and uninstall one.

• Symantec AntiVirus
• AVG AntiVirus

Please look in Add or Remove Programs for the following and Uninstall them if found:

Viewpoint


Download the following two files, create a folder on your desktop, call it TSC. Save these 2 files there!

Sysclean Package

Pattern.zip

Once you have these downloaded into the folder you just created, double click the file sysclean.com

When the system cleaner loads, click SCAN to start the scanner. After you have complete the above scan attach the log along with a fresh HJT log.

 

Thanks for getting back to me..

Ok, i have unistalled AVG Antivirus and Viewpoint.
Downloaded sysclean with the pattern file.

Attached are the logs you requested from me.

 

Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled


Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

R3 - Default URLSearchHook is missing

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (file missing)

O4 - HKLM\..\Run: [Search Bar] C:\WINNT\taskbar.exe
O4 - HKLM\..\Run: [Zip Master] C:\dials.exe
O4 - HKLM\..\Run: [tefgj] C:\WINNT\tefgj.exe
O4 - HKLM\..\Run: [01k6satt] C:\WINNT\system32\01k6satt.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAccessVerisign/ie/bridge-c5.cab
O16 - DPF: {CAFECAFE-0013-0001-0009-ABCDEFABCDEF} (JInitiator 1.3.1.9) - http://m32967/webhtml/opera_jinit_p13.exe
O16 - DPF: {DAAC8ECF-DB09-4821-8126-E2C9499A20BA} (RegTerminalSrv Object) - http://operaapp1/installregterm.exe

O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - C:\WINNT\Downloaded Program Files\mimectl.dll

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\Program Files\Viewpoint ←–– Delete this whole folder if it exist!

C:\WINNT\Downloaded Program Files\mimectl.dll

C:\WINNT\system32\01k6satt.exe

C:\WINNT\taskbar.exe

C:\WINNT\tefgj.exe

C:\dials.exe

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


After you complete ALL of the above REBOOT to Normal Windows and procede with the rest of this fix!



FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After you have completed the above, attach a fresh HJT log and let me know how things are running.

 

Ok.. got rid of all those files.. here's an update HJT log for you.

I'll keep you updated, but once again.. thanks.

 

Your HJT log is clean, are you having any further Malware problems?

 

Not that I've seen so far. I'll post back if I get anything more. Thanks.

 

Okay! For now I would recommend following the steps in this thread on How to Protect yourself from malware!