TechSpot

Is this you on that photo virus

By basket023
Apr 22, 2007
  1. I've found a thread talking about this virus and it said to follow the steps to remove a virus. So I did it and got to step 11 and got this:

    C:/Windows/system32/ftfgre.exe (hidden application file), c:/Windows/Prefetch/FTFGRE.EXE-2D3DC956.pf (hidden file), c:/Windows/system32/ftfgre.dat (hidden file),
    c:/Windows/system32/ftfgre.exe (hidden file), c:/Windows/system32/ftfgre_nav.dat (hidden file), c:/Windows/system32/ftfgre_navps.dat (hidden file).

    What should I do with that?
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Have AVG Antirootkit fix those entries.

    Continue with the rest of the instructions and post the requested logfiles.

    Regards Howard :wave: :wave:

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. basket023

    basket023 TS Rookie Topic Starter

    But it says that if I do fix them all it can damage my computer, is it really safe to do so?
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    This is the only info on the tfgre.exe file I can find. Apparently it`s nasty and needs to be got rid of.

    If in doubt, do the following.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.


    Please visit this link http://virusscan.jotti.org/
    * Click the Browse... button
    * Navigate to the following file C:/Windows/system32/ftfgre.exe
    * Click Open
    * Please let me know the results.

    Do the same for the rest of these files.

    c:/Windows/system32/ftfgre.dat
    c:/Windows/system32/ftfgre.exe
    c:/Windows/system32/ftfgre_nav.dat
    c:/Windows/system32/ftfgre_navps.dat

    Once done, rehide your protected OS files.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. basket023

    basket023 TS Rookie Topic Starter

    C:/Windows/system32/ftfgre.exe: AntiVir found HEUR/Malware
    c:/Windows/system32/ftfgre.dat: found nothing
    c:/Windows/system32/ftfgre_nav.dat: found nothing
    c:/Windows/system32/ftfgre_navps.dat: found nothing
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Since the C:/Windows/system32/ftfgre.exe file has been shown to be malware, it stands to reason the rest of the ftfgre files are also malware. AVG Antirootkit says they are and therefore you should have AVG Antirootkit fix them.

    Then, follow the rest of the instructions and post the requested logfiles.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. basket023

    basket023 TS Rookie Topic Starter

    I wasn't able to scan for the other file c:/Windows/Prefetch/FTFGRE.EXE-2D3DC956.pf, I wasn't able to find it even after having turned on the "Show all files and folders, including hidden files".
    I've fix the other five ones but I don't know how to see the logfiles you're talking about. It just restarted my computer and told me that the rootkits had been removed, even though after doing another search I found them again.
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Follow the instructions I gave you in this link and post the requested logfiles when finished. Until you do, I can`t help you.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  9. basket023

    basket023 TS Rookie Topic Starter

    You mean I should go on with step 12?
     
  10. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    That`s exactly what I mean, then do step13.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  11. basket023

    basket023 TS Rookie Topic Starter

    I got the following logs from ComboFix and HijackThis.
     
  12. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You didn`t post an AVG Antispyware log as requested, please do so in your next reply.

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    Zango Programs
    Zango Toolbar
    FICHIE~1

    Close control panel.

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as fresh AVG Antispyware, Combofix and HJT logs.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  13. basket023

    basket023 TS Rookie Topic Starter

    Well I found this but I don't know if it's the log you're looking.
    And concerning the files you told me to remove, I couldn't, I found Zango toolbar but when I try to remove it it freezes the control panel.
     
  14. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Run the Avenger as per the instructions in my post above and post all the requested logfiles.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  15. basket023

    basket023 TS Rookie Topic Starter

    Here are the logs from avenger, combofix and hijackthis.

    What about the Zango Toolbar?
     
  16. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The Zango toolbar appears to have been deleted.

    Your didn`t post an AVG Antispyware log as requested. Please do so in your next reply.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    ioqrm.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (file missing)

    O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL (file missing)

    O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL (file missing)

    O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll (file missing)

    O4 - HKCU\..\Run: [ioqr] C:\PROGRA~1\FICHIE~1\ioqr\ioqrm.exe

    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL (file missing)

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBIniti alSetup1.0.0.15.cab

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\PROGRA~1\FICHIE~1\ioqr<Delete the entire folder.

    Reboot into normal mode and rehide your protected OS files.

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply as well as AVG Antispyware, Combofix and HJT logs.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  17. basket023

    basket023 TS Rookie Topic Starter

    I couldn't run Avenger, but I'll post the logs from HJT and Combofix next. Unfortunatly I couldn't send you the AVGAntispyware log since it was too big for the forum, about 266kb.
     
  18. basket023

    basket023 TS Rookie Topic Starter

    Here they are.
     
  19. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Why couldn`t you run the Avenger programme?

    Go and follow the instructions for running the Ccleaner programme in step9 of this thread HERE.

    Then, run an AVG Antispyware scan as per the instructions.

    Try and run the Avenger as per the instructions and post the Avenger log as well as an AVG Antispyware log.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  20. basket023

    basket023 TS Rookie Topic Starter

    I'm sorry, I know it's been quite long but here is the log for avenger. I couldn't post the AVG Anti-Spyware log since it was too big.
     
  21. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    No problem mate.

    Follow the instructions for using the Ccleaner programme in my post above.

    Then, follow the instructions HERE for running AVG Antispyware and Combofix.

    Post a fresh HJT log as well as AVG Antispyware and Combofix logs.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  22. basket023

    basket023 TS Rookie Topic Starter

    Here are the HJT and Combofix logs. I'm sorry but I just can't post the AVG log, it's too big, and I have followed the instructions for running AVG antispyware.
     
  23. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Run the Ccleaner programme as per the instructions in step9 of this thread HERE.

    6. Run a new AVG Antispyware scan as per the instructions in step13 of this thread HERE.

    7. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log and the AVG Antispyware log.

    Regards Howard :)

    This thread is for the use of basket023 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...