Trojan...with Safe Mode problem

orchardlady · Oct 21, 2006

I run Windows XP...use Firefox...have IE and Opera on my PC

Here is what I HAVE done.

I have run Norton AntiVirus (yes, I run and update it daily)

I have run PCTools AntiVirus

I have checked my options and run CleanCasche (which I run at the beginning of the day and at the end of the day)

I have run Brower Hijack Retaliator 4.5

I have run Ad-Aware Personal SE

I have checked my options and run SpywareDoctor (yes, I update and run it daily; it is always running)

I also run The Ultimate Troubleshooter from time to time

I continue to have a trojan problem.
I receive popups fromt he trojan.
I recieve notices via a Taskbar icon...yellow triangle with an exclamation mark in it...which flashes. When I attempt to left click on it...or right click on it...it attempts to open IE at which time SpywareDoctor halt the open and warns me that I am attempting to do a bad thing, and of course, I choose not to continue.
At this point the triangle disappears, until the next event cycle begins.

I have also read the instructions to remove the trojan "manually", and have written down the file names.
Problem...when I choose to open in safe mode the process begins, a list of partitions appears, then the process halts. So, I have not been able to do the manual removal. Am I not waiting long enough for safe mode to process. In the past it has opened rather quickly.

DavidGP · Oct 21, 2006

Hi and Welcome Orchardlady

First off you have two antivirus applications installed at once and they will conflict with each other, giving various weird anomalies and most common a slow PC, especially when opening applications etc, so please uninstall one ( your choice which one but if one is paid for keep that )

then run through the below first steps guide and attach the requested logs, the guide looks long but its laid out that way to capture as much info and clean as many of the easier to remove malware items first before we get to the stubborn ones,

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy - ONLY IF you were not able to run Windows Defender

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!

I have also moved your thread into the malware forum.

orchardlady · Oct 21, 2006

Will do...Thanks!!

orchardlady · Oct 22, 2006

I believe I found my virus:

CideoCompressionCodec

Yes???

Yes, I have been wading through the instructions line by line.
I am ready to begin "Contere Spy", in "READ & RUN ME FIRST Before Asking for Support" But, before I start that I have the question above.

I tried to search the Internet for VCC and from what I could determine it is a trojan...right?

orchardlady · Oct 22, 2006

Oooops! That should be

VideoCompressionCodec

chaslang · Oct 23, 2006

orchardlady said:

I tried to search the Internet for VCC and from what I could determine it is a trojan...right?
Click to expand...

Yes it is just another member in a long line of infections related to the Smitfraud (aka Zlob) family.

I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

STEP 1: Complete this procedure completely including attaching the requested log before doing the second procedure.

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Note:process.exe ( which is used my SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/proc...processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so!
Click to expand...

STEP 2: PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode : Starting your computer in Safe mode

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Now reboot into normal mode and attach this new rapport.txt log here.
Click to expand...

How are things working now?

You really should complete the steps that Halo gave you anyway even if things appear to working okay. These kind of infections often come along with other problems.

orchardlady · Oct 23, 2006

Part 6 of READ & RUN ME FIRST Before Asking for Support says to 1) run Bitdefender. I will not run. So, as instructed, I attempted twice to run Panda...in IE, as instructed. Both times I clicked on the link within Part 6A. Both times the website was accessed, BUT both times IE shutdown. Yes, I was in SafeMode.

Is there a solution for either of these problems?

Thanks for the additional instructions for SmitfraudFix, etc. I will work through them now.

orchardlady · Oct 25, 2006

First, "1) run Bitdefender. I will not run."...should read "IT will not run."

How do I get my graphics (.jpg and .gif) to appear in my Outlook Explorer email. I have HTML format turned on. Since I started this cleaning process, my email is lacking these components...just the white box with the red x.

chaslang · Oct 26, 2006

You need to complete the two step instructions for running SmitFraudFix before you do anything else. Since you did not attach the two logs as requested, all I can assume is that you did not follow those directions.

orchardlady · Oct 26, 2006

All appears to be fine now. I'm hoping I have attached the correct log and that I am not missing another log that should be attached!!

If I may ask at this time.

How do I get my graphics (.jpg and .gif) to appear in my Outlook Explorer email. I have HTML format turned on. Since I started this cleaning process, my email is lacking these components...just the white box with the red x. I am provided the option of choosing to see them, but that is email by email.

When my computer boots I receive this message that I have to acknowledge each time..."The procedure entry point GetProcessImageFileNameW could not be located in the dynamic link library PSAPI.DLL'. Is this something I should or can do something about?

I now have the following on my computer...which do you suggest I get rid of...if any?

Spybot Search & Destroy

CCleaner

Spyware Doctor

PC Tools AntiVirus

WindowsDefender

SmithfraudFix

Browser Hijack Retaliator 4.53

Clean Cache 3.0

Spyware Blaster

Ad-Aware SE Personal

Windows Security Center

Installers...is it now safe to remove these?

WindowsXP-KB835935-SP2-ENU.exe

IE7-WindowsServer2003-x86-enu.exe

IE7-WindowsServer2003-x86-enu.exe

WindowsInstaller-KB893803-v2-x86.exe

WGAPluginInstall.exe

Windows-KB890830-V1.21.exe

jre-1_5_0_09-windows-i586-p.exe

chaslang · Oct 28, 2006

orchardlady said:

If I may ask at this time.

How do I get my graphics (.jpg and .gif) to appear in my Outlook Explorer email. I have HTML format turned on. Since I started this cleaning process, my email is lacking these components...just the white box with the red x. I am provided the option of choosing to see them, but that is email by email.

When my computer boots I receive this message that I have to acknowledge each time..."The procedure entry point GetProcessImageFileNameW could not be located in the dynamic link library PSAPI.DLL'. Is this something I should or can do something about?

Click to expand...

Sorry but these are not malware issues and we are just way too busy in this forum to address anything that is non-malware related. You should try asking these in the Software Forum.

orchardlady said:

I now have the following on my computer...which do you suggest I get rid of...if any?

Spybot Search & Destroy

CCleaner

Spyware Doctor

PC Tools AntiVirus

WindowsDefender

SmithfraudFix

Browser Hijack Retaliator 4.53

Clean Cache 3.0

Spyware Blaster

Ad-Aware SE Personal

Windows Security Center

Click to expand...

Is Spyware Doctor a paid program or free trial?
Is PC Tools AntiVirus a paid program or free trial?
Do you have any other antivirus programs installed?
Windows Security Center is part of Windows. You cannot remove it. Or did you mean to give a different program name.
You don't need SmitFraudFix!
And whether you need Browser Hijack Retaliator depends on answers to the above questions.

orchardlady said:

Installers...is it now safe to remove these?

WindowsXP-KB835935-SP2-ENU.exe

IE7-WindowsServer2003-x86-enu.exe

IE7-WindowsServer2003-x86-enu.exe

WindowsInstaller-KB893803-v2-x86.exe

WGAPluginInstall.exe

Windows-KB890830-V1.21.exe

jre-1_5_0_09-windows-i586-p.exe

Click to expand...

Again not malware, but if you don't need them because you already installed them, then delete them.

orchardlady · Oct 28, 2006

Okay, let me make sure I understand. By following the instructions given to me above so that I could clean out my malware, I had to install...specifically these items:

* Spybot Search & Destroy
* WindowsDefender
* SmithfraudFix
* Browser Hijack Retaliator 4.53
* Ad-Aware SE Personal
* WindowsXP-KB835935-SP2-ENU.exe
* IE7-WindowsServer2003-x86-enu.exe
* IE7-WindowsServer2003-x86-enu.exe
* WindowsInstaller-KB893803-v2-x86.exe
* WGAPluginInstall.exe
* Windows-KB890830-V1.21.exe
* jre-1_5_0_09-windows-i586-p.exe

Now that all has been done and I have these items on my PC, you can't tell me what to do with them. Is that right?

I don't understand this. I have them because the instructions I was provided and downloaded them per those instructions.

So which forum do I go to now to discover if I should remove them from my PC? I hope you can at least answer this question.

chaslang · Oct 29, 2006

orchardlady said:

Now that all has been done and I have these items on my PC, you can't tell me what to do with them. Is that right?

I don't understand this. I have them because the instructions I was provided and downloaded them per those instructions.

So which forum do I go to now to discover if I should remove them from my PC? I hope you can at least answer this question.
Click to expand...

First that is not what I said!

Second you never completed the READ & RUN ME instructions so I have no idea what you installed.

Third we (in the READ & RUN ME or in this thread) never told you to install any of the below:
* Browser Hijack Retaliator 4.53
* Ad-Aware SE Personal
* WindowsXP-KB835935-SP2-ENU.exe
* IE7-WindowsServer2003-x86-enu.exe
* IE7-WindowsServer2003-x86-enu.exe
* WindowsInstaller-KB893803-v2-x86.exe
* WGAPluginInstall.exe

And fourth if you answered my questions, I could try to answer yours! I already told you to delete the installation files for anything you already installed or did you not read the whole message.

Log in or Sign up

Trojan...with Safe Mode problem

orchardlady Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

orchardlady Private E-2

orchardlady Private E-2

orchardlady Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

orchardlady Private E-2

orchardlady Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

orchardlady Private E-2

Attached Files:

rapport.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

orchardlady Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member