Possible downloader trojan - Hijack log, plz help

[khurramt]

Hello,
My norton antivirus detected a downloader trojan. I followed most of the steps in the malware stickied thread above.

I downloaded AVG anti-spyware... and it detected 290 different spyware/adware objects a few of which were downloader and other trojans. I quarantined those and deleted those. I ran ad aware and now both of them say that the system health is okay. I ran norton's full system scan in safe mode and it found nothing.

But I still keep getting popups when I run internet explorer. Is this because there are still some dll files in the system? I looked in the regedit... and did not find anything. Here is my HiJack This log, plz help!!

 

[howard_hopkinso]

Hello and welcome to Techspot.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT, AVG Antispyware and Combofix logs as attachments into this thread, only after doing the above.

Also, let me know the results of the AVG Antirootkit scan.

Regards Howard :wave: :wave:

This thread is for the use of khurramt only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[khurramt]

Ok here are all the required attachments.

The AVG spyware doesn't show anything. the iopus starr monitoring and the other file are just setup files that i downloaded before, will delete them now.

The Anti-Root didn't show anything. The combo fix quarantined some items and they are listed in that log. there are two hijackthis logs. 1 is before the combofix and 2 is after the combo fix.

The norton scan didn't show any viruses either.

Do I still have traces of the downloader or another trojan? Is there anything that seems out of the ordinary that maybe causing the popups? I have put the pop up settings of internet explorer to high... so lets see what happens. Please let me know what you see.

Thanks a lot in advance!!

 

[howard_hopkinso]

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

Regards Howard

This thread is for the use of khurramt only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[khurramt]

hey,
here are the logs. any next steps? The pop ups seem to have stopped. i turned down the IE pop up settings to medium, and from what i have noticed so far... no pop ups.

Other problems:
How can I edit what programs load at startup?
I only have the Windows Firewall on right now. Which one would you recommend, keeping in mind i am only running on 256 mb of ram (for now).

Thanks Howard!!!

 

[howard_hopkinso]

I recommend the use of either of the firewall programmes below.

Zonealarm or Kerio free firewall programmes.


Your can edit which programmes start with Windows by doing the following.

Click start/run and type msconfig into the run box and press the enter key.

When the windows appears, click the startup tab and uncheck anything you don`t want to start with Windows. Click apply/ok and reboot your computer. Untick the box that says don`t run msconfig the next time you start your system.

You can also free up resources by uninstalling anything you don`t use or want from add remove programmes in your control panel.

You might want to take a look at this thread HERE. It`ll show you how you can speed up your system.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O2 - BHO: TW_BHO Class - {1E1B2879-88FF-11D2-8D96-FFFFAC95951F} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - Startup: APM.lnk = C:\Program Files\Advanced Password Manager\apm.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)

O9 - Extra 'Tools' menuitem: &Messenger Addon - {FB5F1911-F110-11d2-BB9E-00C04F795683} - http://messenger.ipfox.com (file missing)

O16 - DPF: {25365FF3-2746-4230-9DA7-163CCA318309} (Automatic Driver Installation Control) - http://inst.c-wss.com/n017p/EN/install/gtdownlr.cab

O20 - Winlogon Notify: ddccd - C:\WINDOWS\system32\ddccd.dll (file missing)

Click on the fix checked button.

Close HJT and reboot your system.

Other than the above, your HJT log is clean.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of khurramt only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.