Trojan Horse Removal Help Needed

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by chimphorse, Nov 21, 2011.

  1. chimphorse

    chimphorse Private E-2

    Hi there,
    I had Trojan Horses that my AVG detected but was unable to remove. The AVG wasn't able to move the viruses to vault and was saying that they were "inaccessible". Interestingly enough, my CC Cleaner and Malwarebytes, which were up to date, weren't even able to detect any threats, including the Trojans!
    I followed the Vista and Win 7 Malware Removal/Cleaning Procedure and the SuperAntiSpyware detected a Trojan.Agent/Gen-AntiAV which I deleted. The Malwarebytes which I ran afterwards found a Trojan.Chydo which I removed as well.
    Because I am very illiterate when it comes to computers, I'm not sure if my computer is completely cleared of Malware for 2 reasons:
    1. I'm not sure how to "Toggle System Restore" and I don't even know if at this point I need to do that
    2. The Trojans that my AVG found were different than the ones removed.

    Below is the copy of the AVG Free Edition Resident Shield Detection.
    I have a Lenovo Laptop with Windows 7 and a 64-bit Operating System.
    How do I proceed at this point?
    I really appreciate your time and help! Looking forward to hearing form you soon.
    ~S
     

    Attached Files:

    Last edited by a moderator: Nov 21, 2011
    chimphorse, Nov 21, 2011
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Here is your avg report, I attached it properly. It got caught up in the spam filter as it was. Reviewing your logs now.
     

    Attached Files:

    Kestrel13!, Nov 21, 2011
    #2
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I want you to run TDSSKiller so refer to the below for how to do so.

    TDSSkiller - How to run


    Please also download MBRCheck to your desktop
    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some information that will contain either the below line if no problem is found:
      • Done! Press ENTER to exit...
    • Or you will see more information like below if a problem is found:
      • Found non-standard or infected MBR.
      • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
    • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
    • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
    • Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )
     
    Kestrel13!, Nov 21, 2011
    #3
  4. chimphorse

    chimphorse Private E-2

    Hi Kestrel13!,

    thank you for all your help. I followed your instructions and I've attached the logs.
    I noticed that 2 files have showed up on my Desktop but I'm unable to attach them (they were there before I ran the 2 programs you recommended). They both have the same name desktop.ini and when I open them, that's what they read:
    [.ShellClassInfo]
    LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21799 (that's the firsr one).
    [.ShellClassInfo]
    LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
    IconResource=%SystemRoot%\system32\imageres.dll,-183 (that's the 2nd one)
    I wonder if this has something to do with the shortcut I created for Desktop in the C:/ because I had to download MGTools in C:/ and the computer wouldn't let me do so.
    Is there anything else I need to do?
    What do I do with all the programs I downloaded for the Vista and Win 7 Malware Removal/Cleaning Procedure (Malwarebytes, ComboFix, MGTools, Superantispyware) and the extra 2 programs (TDSSKiller and MBRCheck) you recommended downloading?
    Should I turn the User Account Control back on?
    Should I go back to using AVG again? I downloaded it but I didn't run it yet.

    Thanks,
    ~S
     

    Attached Files:

    chimphorse, Nov 22, 2011
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Why do you have utorrent running from this location??

    C:\Users\\Gencho\Downloads\utorrent.exe


    SystemLook

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Copy the content of the following codebox into the main textfield:
      Code:
      :filefind
Public.exe
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt


    Run this and attach the results.

    Using ESET's Online Scanner

    Now run a full system scan with avg again and let me see another log like you added before (only attach it)
     
    Kestrel13!, Nov 22, 2011
    #5
  6. chimphorse

    chimphorse Private E-2

    Hi Kestrel13!,

    Thank you so much for following up on my malware removal! I've followed the next set of instructions and attached the logs. Please advice on what to do next.
    Thanks,
    ~S
     

    Attached Files:

    chimphorse, Nov 23, 2011
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I should have had you use the 64 bit version of SystemLook, so with the same criteria, let's try again. I apologise. SystemLook 64- bit I need to download and install Open Office on this paticular PC before I can view the .doc so hang in there, it's downloading slowly.
     
    Kestrel13!, Nov 23, 2011
    #7
  8. chimphorse

    chimphorse Private E-2

    All done!:)
     

    Attached Files:

    chimphorse, Nov 23, 2011
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    OK, one more run of the online ESET scanner and attach the results.
     
    Kestrel13!, Nov 23, 2011
    #9
  10. chimphorse

    chimphorse Private E-2

    Hi Kestrel13!,

    I ran the ESET scanner twice and both times it didn't give me the option to copy the results. It said that no threats were found. I went to "manage the quarantine" but there was no option to "Export to text file" and the text wouldn't copy and paste so I have no results to attach :-o.
     
    chimphorse, Nov 24, 2011
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    OK, so do any malware problems remain now at all?
     
    Kestrel13!, Nov 24, 2011
    #11
  12. chimphorse

    chimphorse Private E-2

    Again thanks a lot for all your help!
    There are no problems right now :). The only problems in the past were the messages AVG was showing that there's a threat detected and afterwards it wasn't able to remove it. It was saying "the object is inaccessible". Otherwise the computer has been running just fine.
    ~S
     
    chimphorse, Nov 25, 2011
    #12
  13. chimphorse

    chimphorse Private E-2

    Should I uninstall some or all of the new malware programs I downloaded so there would be no conflict between them? Before I was using only AVG, CCleaner and Malwarebytes.
     
    chimphorse, Nov 25, 2011
    #13
  14. chimphorse

    chimphorse Private E-2

    Hi Kestrel13!,
    I have bad news! AVG Notifies me again of a threat with:
    File name: c\Users\Public\Public. Exe
    Threat name: Trojan horse BackDoor.Generic13.AFMG
    And below is all the info I was able to find about it. Under “Show Details” I see:
    File name: c:\Windows\System32\SearchProtocolHost.exe
    Process ID: 4544
    Under Resident Shield detection:
    Infection;"Object";"Result";"Detection time";"Object Type";"Process"
    Trojan horse BackDoor.Generic13.AFMG;"c:\Users\Public\Public.exe";"Infected";"11/25/2011, 7:45:45 AM";"file";"C:\Windows\System32\SearchProtocolHost.exe"
    Trojan horse BackDoor.Generic13.AFMG;"c:\Users\Public\Public.exe";"Infected";"11/25/2011, 7:45:03 AM";"file";"C:\Windows\System32\SearchProtocolHost.exe"
    Trojan horse BackDoor.Generic13.AFMG;"c:\Users\Public\Public.exe";"Infected";"11/25/2011, 7:44:26 AM";"file";"C:\Windows\System32\SearchProtocolHost.exe"
    Trojan horse BackDoor.Generic13.AFMG;"c:\Users\Public\Public.exe";"Infected";"11/25/2011, 7:43:26 AM";"file";"C:\Windows\System32\SearchProtocolHost.exe"
    Trojan horse BackDoor.Generic13.AFMG;"c:\Users\Public\Public.exe";"Infected";"11/25/2011, 7:42:49 AM";"file";"C:\Windows\System32\SearchProtocolHost.exe"
    AVG is not able to remove it!
     
    chimphorse, Nov 25, 2011
    #14
  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Now we need to use ComboFix by sUBs

    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::

File::
c:\Users\Public\Public.exe
DirLook::
c:\Users\Public
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
     
    Kestrel13!, Nov 25, 2011
    #15
  16. chimphorse

    chimphorse Private E-2

    Hi Kestrel13!,
    I followed the instructions and attached the logs. I also attached a Word document I named "important" with messages that showed up while the programs were running.
    ~S
     

    Attached Files:

    chimphorse, Nov 27, 2011
    #16
  17. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Are you able to delete these files? Do so, reboot and see if they still exist. Then tell me what issues remain.

    c:\users\Public\AppData\AppData.exe
    c:\users\Public\AppData\AppData.rar
     
    Kestrel13!, Nov 27, 2011
    #17

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds