win32.trojan virus - very persistant

Hi, I have a very persistent Trojan virus that allows itself to be wiped but reappears a day later. I've been struggling with it for a week. I've tried Spysweeper, Vundofix.exe, fixVundo.exe, Spybot Search and Destroy, Spywareblaster Adaware SE, Superantispyware and Combofix. I just yesterday found out that Combofix could be hurting my computer but it seems to do the best job of eliminating the virus for a time while the others don't do much. I messed around with Hijackthis yesterday and I think I accidentally deleted my company installed Checkpoint Secureclient firewall. (They are sending me another copy) And still it remains. These are the two recent incarnations of the virus:

win32.trojan.bho

win32.trojan.dnschanger

although it seems to take a different form each time I find it.I just did a search with Adaware SE and it found it again. I tried to remove it and my computer blue screened - I thought that was it, but then my computer restarted so I came right to here. I thought this was just ad spyware, can it really kill my computer?

Here is my most recent hijackthis log:

• Edit by bjgarrick: Inline HJT log removed. READ & RUN ME sticky not followed.

 

http://www.majorgeeks.com/images/grenade.gifWelcome to MajorGeeks.com!http://www.majorgeeks.com/images/grenade.gif

Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

Read & RUN ME FIRST Before Asking for Support

 

Win32.trojan Virus keeps coming back after a week

i, I have a very persistent Trojan virus that allows itself to be wiped but reappears a day later. I've been struggling with it for a week. I've tried Spysweeper, Vundofix.exe, fixVundo.exe, Spybot Search and Destroy, Spywareblaster CCleaner, Adaware SE, Superantispyware and Combofix. Combofix does the best job of eliminating the virus for a time while the others don't do much. I messed around with Hijackthis yesterday and I think I accidentally deleted my company installed Checkpoint Secureclient firewall. (They are sending me another copy) And still it remains. These are the two recent incarnations of the virus:

win32.trojan.bho

win32.trojan.dnschanger

although it seems to take a different form each time I find it.I just did a search with Adaware SE and it found it again. I tried to remove it and my computer blue screened - I thought that was it, but then my computer restarted so I came right to here. I thought this was just ad spyware, can it really kill my computer?

I'm including my most recent hijackthis log:

 

Re: Win32.trojan Virus keeps coming back after a week

Sorry about the double post, I thought the first one didn't go through. My computer is running at a snails pace thanks to this virus and my browser keeps freezing up when I try to delete the earlier post.

 

I have merged all of your threads together so please post in here from now on.

Now, please go back to post 2 and follow those instructions and attach the requested logs.

 

I've tried to run some of those tools but I don't have admin rights on my computer. I'm pretty burnt out on this and am pretty disgusted with myself for screwing up this computer. I came here to see if there is a way I can avoid the humiliation of having to send my computer back to my corporate headquarters. Is there another forum you can recommend for someone who doesn't know what he's doing and needs his hand held through the process?

 

Win32.Trojan virus deleted?

Had this virus for a week. Keep trying to clean it and it keeps popping back up with different names. The only thing I did differently was last Wednesday I tried to log on to a wireless router at my sister-in-law's house but I could not gain access - I came home the next day to find IE windows popping up while I was using Firefox. I tried all different methods to purge it to no avail. Here are the log files requested in the xp cleanup thread hope you can help, thanks

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Next, we need to remove a service…

• Now Click on Start, then Run ... type services.msc into the box that opens up, and press 'OK'.
• On the page that opens, scroll down to VundoFix Service (VundoFixSvc
• Then right click the entry, select Properties and press Stop Service.
• When it shows that it is stopped, next please set the Start-up Type to 'Disabled'.
• Click OK until you get back to Windows.

• Next, run HJT, but instead of scanning, click on the None of the above, just start the program button at the bottom of the choices.
• At the lower right, click on the Config button
• Then click the Misc tools button
• Select Delete an NT Service
• Copy/paste VundoFixSvc into the box that opens, and press OK
• If you receive any error messages just ignore them and continue.
• Now exit HJT but do not reboot when it tells you it needs to. We will do that further down after running HJT again to fix some other items.

Step 3:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 4:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 5:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 6: Begin here after rebooting from Step 5!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 7:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 8:
Finally, I would like you to install the current version of Sun Java: Sun Java Runtime Environment

Step 9:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

I've disabled all antispyware apps but I can't get rid of Webroot spysweeper. I tried to remove in Add/remove and just delete the program file and it states "uninsta000.dat does not exist" It won't even let me stop the process with alt ctrl del. Is it ok to proceed with the fix with it running?

 

It needs to be closed, did you purchase it? If so you can leave it, right click on the icon in the System Tray and select Shut Down.

If you did not purchase it then we can uninstall using another application that will force it to uninstall.

 

I didn't purchase it, I tried the free trial. What tool can I use to force it to delete? Also, it's not in the sys tray but it does show up under processes running

 

I haven't heard back from anyone so I'm going to go ahead with the fix and see if it works despite spysweeper running since I can't delete it.

 

so far so good, haven't had any problems with popups, thanks! Is there any way to be sure it's gone for good?

 

Download Your Uninstaller! 2006 5.0.0.360, save to desktop and install. Once installed, locate Spy Sweeper and uninstall.

 

If possible, run Your Uninstaller! to remove Spy Sweeper before running this fix.

Step 1:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Next, we need to run Avenger again, just like you did before.

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

 

I downloaded uninstaller and uninstalled Spysweeper but it still is a running process. It no longer shows up on the Uninstall list or Add/Remove programs but it is still running on my machine. Every thing I've tried to delete it comes up in red.

 

looks like something went wrong with Avenger. The text file is empty

 

The Trojan virus is back and worse now than it was originally help!

 

Trojan virus will not go away

went through all the steps yesterday, thought it was gone but the trojan came back today.

 

can someone please give me some kind of answer on this? Do I need to take my computer to a professional? Reinstall windows? Or just be patient until someone gets back to me?

 

I implemented your suggestions. Here are the new logs. I've been using Spydoctor, AVG Anti Spyware, Trojan Hunter, Spybot S&D and Ad-Aware SE to scan and delete virus and trojans but they keep popping up. The computer seems to be pretty calm the past couple of days as long as I keep running all the antivirus/spyware/trojan programs. How can I be sure when it's clean? Can you tell me from the logs if it's gone?

ps: nylasavx does belong on the computer

 

Thanks Chaslang! all the scans are coming up negative now.