TechSpot

Please help remove iamfamous.dll trojan

By HarlequinPuppet
Dec 25, 2008
  1. I have some trojans on my laptop including the one iamfamous.dll
    I'm not really sure how I got it and it's the first major virus I've had so I am very upset by it and would like to get rid of it asap.
    I don't know exactly what it does but I know it tampers with my google searches and I'm hoping hasn't stolen my netbanking information.
    I have attached the logfiles that are required.
    Thanks in advance for any help.
     

    Attached Files:

  2. gillianbrown

    gillianbrown Banned Posts: 141

    The fact that you use your system for internet banking means the only safe course of action is to disconnect from the net and reformat the system.

    You should also contact you bank and tell then that your system has been compromised.

    Doing anything else is dangerous in the extreme and could well lead to your bank details being stolen.

    I cannot impress upon you strongly enough the potential seriousness of the situation.
     
  3. HarlequinPuppet

    HarlequinPuppet TS Rookie Topic Starter Posts: 38

    I disconnected my internet banking. I want to fix my computer without losing any data. Is this possible?
     
  4. gillianbrown

    gillianbrown Banned Posts: 141

    Yes, it is possible. However, you need to be made aware of the serious risks involved.

    The fact that you do use your computer for internet banking means, your details could already have been stolen. Add to that, no one can guarantee %100, even after cleaning your system, it would be safe to use for such purposes again and that's why I have to recommend a reformat and that your contact your bank immediately.

    I personally know of someone who didn't reformat and ended up having over $10,000 stolen from his bank account.

    I assure you I am not being dramatic and I believe I'm giving you the best possible advice based on experience.

    Of course, If you really want to run the risk and clean your system, then I will help you to do so.
     
  5. HarlequinPuppet

    HarlequinPuppet TS Rookie Topic Starter Posts: 38

    I did contact my bank and froze my netbanking as a precaution. I am only a student though and don't have much money anyway.
    Also I only got the virus on Tuesday and have not used my computer much because of it. I ran those scans on Thursday night but I don't understand them too well.
    Did they already get rid of the virus or does something else need to be done? I would rather not have to reformat.
    Thanks again.
     
  6. gillianbrown

    gillianbrown Banned Posts: 141

    Ok, let's do the following.

    You need to rename HijackThis.exe to Crusty.exe. This is because some malware can hide from HijackThis.exe. Follow these instructions in order to do so.

    Go to the C:\Program Files\Trend Micro\HijackThis\HijackThis.exe file and right click on HijackThis.exe. Choose rename. Click in the title box and hit the enter key to clear what`s there.

    Now type Crusty.exe into the title box and hit the enter key. Right click on the Crusty.exe file and choose "Send to desktop Create Shortcut".

    You can now close the HJT directory.

    Please post a fresh HJT log.
     
  7. HarlequinPuppet

    HarlequinPuppet TS Rookie Topic Starter Posts: 38

    Okay thank you. This is the new one.
     
  8. gillianbrown

    gillianbrown Banned Posts: 141

    Your HJT log is clean.

    Have HJT fix the following deactivated entries.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).


    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

    Click on the fix checked button.

    Close HJT and reboot your system.

    Unless you're still having problems, you should be good to go.
     
  9. HarlequinPuppet

    HarlequinPuppet TS Rookie Topic Starter Posts: 38

    Thank you so much for your help. All the best for the new year.
     
  10. tenfold

    tenfold TS Rookie

    I'm having this now too.
    Here is my HJS log...
     
  11. kimsland

    kimsland Ex-TechSpotter Posts: 18,353

    You need to create your own thread just for you tenfold
    Also just like the originator of this thread, you must follow the guide and provide the 3 logs
    But, I don't think you'll get lots of help with filesharing programs installed (ie uTorrent)

    Have a look at:
    UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions

    Note: You won't be supported on this old thread
     
     
  12. tenfold

    tenfold TS Rookie

    Alright I'm sorry. I'll make a new thread with 3 logs.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.