How do I rid my system of "Your computer is in Danger!" trojan?

By bkdickard
Sep 15, 2006
Topic Status:
Not open for further replies.
  1. I have followed the steps on your thread for removing the "Your computer is in Danger!" trojan with no luck so far. After running a half dozen different spyware scan/remove tools, nothing new is being detected, yet the system tray message persists. I have attached my most recent "Hijack This" log.

    I would greatly appreciate any assistance in ridding my system of this issue.

    Thanks!

    Attached Files:

  2. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Hello and welcome to Techspot.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    WildTangent

    Close control panel.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    GameChannel.exe
    xpupdate.exe
    GameDrvr.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R3 - Default URLSearchHook is missing

    O2 - BHO: Class - {4AA49065-61BA-E106-4AFA-CDCA7585AA1C} - C:\WINDOWS\qcxgu1.dll (file missing)

    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll (file missing)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (file missing)

    O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe

    O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxmk361YYUS

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBIniti alSetup1.0.0.15.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{8CC13DA5-C870-43D9-8B34-3B142DC8E137}: NameServer = 205.171.3.65,205.171.2.65
    O17 - HKLM\System\CCS\Services\Tcpip\..\{D85CCF9A-241E-4EDA-BFD0-09930A1AF524}: NameServer = 205.171.3.65,205.171.2.65
    O17 - HKLM\System\CCS\Services\Tcpip\..\{DB34D527-0ABB-4680-939A-9524B90162E8}: NameServer = 205.171.3.65,205.171.2.65

    Only fix the above 017 entries, if they don`t belong to your ISP.

    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Windows\xpupdate.exe
    C:\Program Files\WildTangent Delete the entire folder.

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Important: Rename the file HijackThis.exe to HijackThis1991.exe and post a fresh HJT log.


    Regards Howard :wave: :wave:


    This thread is for the use of bkdickard only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. bkdickard

    bkdickard Newcomer, in training Topic Starter

    That worked!

    Your instructions for a fix appear to have worked. I have attached a new HJT. I retained the 017 entries as a "tracert" showed they resolved to my ISP qwest.net.

    Many Thanks!!
  4. howard_hopkinso

    howard_hopkinso Newcomer, in training Posts: 25,948   +19

    Your HJT log is clean.

    However, I recommend you uninstall the following suspect anti-spyware programme.

    ParetoLogic\Anti-Spyware

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of bkdickard only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.