Win32:Trojan-gen/LdPinch and others

Discussion in 'Malware Help (A Specialist Will Reply)' started by PhilK, Jul 31, 2007.

  1. PhilK

    PhilK Private E-2

    Hi and Thanks in Advance.

    I need help. I have followed ALL the steps in the Readme (in Safe Mode where required) but apparently unsuccessful in removing the following:Win32:Trojan-gen. {UPX!}, {Other}, Win32:LdPinch-ABW [Trj].

    Also, Bit Defender Online Scan could not disinfect: Backdoor. Delf.AKI, Trojan.Spy.ProAgent.T, Trojan.Dropper.Agent.G and others.

    I have attached the requested 6 files in 2 successive messages.

    Any help will be appreciated.

    Thanks,

    Phil K
     

    Attached Files:

  2. PhilK

    PhilK Private E-2

    Here are the other 3 files requested.

    Phil K
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 11"
    J2SE Runtime Environment 5.0 Update 6
    Search Assist
    Windows Defender

    Now:
    * Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
    * On the page that opens, scroll down to WASSANYX
    * then right click the entry, select Properties and press Stop Service.
    * When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
    * Click OK until you get back to Windows.

    * Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
    * At the lower right, click on the Config button
    * Then click the Misc tools button
    * Select Delete an NT Service
    * Copy/paste WASSANYX into the box that opens, and press OK
    * If you receive any error messages just ignore them and continue.
    * Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

    Run HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking fix, exit HJT.
    '
    Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Now attach new logs for:

    * GetRunKey
    * ShowNew
    * HJT

    Be sure to tell us how things are running.
     
  4. PhilK

    PhilK Private E-2

    Tim,

    Thanks so much for your prompt and detailed instructions.

    Unfortunately, I ran into problems in the first steps.

    1. When using first Add or Remove Programs (and later CCleaner) to attempt to remove J2SE Runtime Environment 5.0 Update 11 and J2SE Runtime Environment 5.0 Update 6, a Windows Installer window opened to a J2SE Runtime Environment 5.0 Update window stating "You already have this version of the JRE installed. Please uninstall the product through Add/Remove Programs utility before installing".
    Clicking OK then goes back to Add or Remove Programs.

    2. With attempted removal of Search Assist, a Windows Installer window stated "The feature you are trying to use is on a network resource that is unavailable. Click OK to try again or enter an alternate path to a folder containing the installation package 'google.msi' in the box below".

    Attempted removal of Windows Defender was similar but substituted 'WindowsDefender.msi'.

    (Also, I recall identical window statements during failed program uninstall attempts going back a few months.)

    I await your instructions before proceeding.

    Thanks,
    Phil K.
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Skip the uninstall list for now and just do the rest.
    Attach the requested logs when finished.:)
     
  6. PhilK

    PhilK Private E-2

    Tim,

    Here are the 3 files.

    Btw, while I disabled WASSANYX, it had previously been in STOP mode.

    thanks,

    PhilK
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You have another service that needs to be removed.

    • Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
    • On the page that opens, scroll down to QVUACOU
    • then right click the entry, select Properties and press Stop Service.
    • When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
    • Click OK until you get back to Windows.

    Now attach new HJT log.

    Also please tell me what malware problems you are still having.
     
  8. PhilK

    PhilK Private E-2

    hey chaslang,

    latest HJT log attached.

    as for ongoing malware problems - i'm not sure what, if anything, has been fixed by my going through all the steps so far.

    i await further directions.

    thanks,

    philK
     

    Attached Files:

  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Well the two services Tim & I had you remove. You just need to tell us if you have any malware problems to report. Your HJT log is clean.

    The items detected by both Panda and BitDefender require manual removal by you. You should not be downloading keygens/cracks. They are one of the fastest ways to get infected.


    Your problems with uninstalling programs due to Windows Installer issues is not a topic for this forum. However, you may want to try running the below:

    Windows Installer CleanUp Utility

    And possibly the below may be able to help you uninstall a few things:

    Your Uninstaller! 2006
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds