Trojan Horse Downloader.Generic3.MIT

[havoc123123]

AVG detected this while opening c:\\WINDOWS\system32\autosys.exe.I tried heal it but it says access denied.when i use other software to scan other than AVG it will always flash a blue screen and auto reboot the com(same when i manually open my system32).After the system reboots there will be error saying that the windows just recovered from a serious prob.Plz help me ,thanks.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Very Important: Before deciding whether you should clean or reformat your system, go and read this thread HERE and decide what it is you want to do.

If after reading the above, you wish to clean your system, do the following.

Download and run the Blacklight programme. follow all the instructions carefully.


Then, go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

Regards Howard :wave: :wave:

This thread is for the use of only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i scanned a few times with the backlight programme but nothing was found .Also i forgot to mention that when press F8 when system startup trying to get to the menu for safe mode but the screen become all colorful and after awhile the corner of the screen become a bit dark blue.

 

[howard_hopkinso]

Ok, forget safe mode for now and follow the instructions from normal mode.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i scanned with norton AVG antispyware/antivirus but nothings was found .i used CCleaner to cleaned up.But when i used spybot S&D it flashes the blue screen and reboot again. Whenever i scan the avg will detect the trojan horse downloader.downloader.generic3.mit. Btw is there any tools to remove spysheriff? norton detect and removed it when i scan but it keeps coming back.Also when i use AVG antivirus there is a file on the list host, Result/Infection: change , Path c:\\windows\system32\drivers\etc\hosts

 

[howard_hopkinso]

Please post the requested log files after completing the instructions as best you can.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

sorry about it.Here are the logs.This is wad there error report contains aft it says windows recovered from a serious problem.
C:\DOCUME~1\user\LOCALS~1\Temp\WER070a.dir00\Mini020307-01.dmp
C:\DOCUME~1\user\LOCALS~1\Temp\WER070a.dir00\sysdata.xml

Edit: I think i somehow managed to clean my com. This is my new log.

 

[howard_hopkinso]

It appears you still have some bits of Symantec/Norton running as well as AVG free. This is not recommended and can cause conflicts, including system crashes. Therefore we need to get rid of Symantec/Norton.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Norton Internet Security<If you have any problems uninstalling Symantec/Norton, please see this thread HERE.

Please post a fresh HJT log once done and let me know if you`re still having system crashes.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

ok.here is my log.Thanks so much for ur help

 

[howard_hopkinso]

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

ParetoLogic\Anti-Spyware

Close control panel.

Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitLord\BitLord.exe"

O4 - HKCU\..\Run: [ParetoLogic Anti-Spyware] "C:\Program Files\ParetoLogic\Anti-Spyware\Pareto_AS.exe" -NM -hidesplash

O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://www.cabalonline.net/Com/CabalWebLauncher.cab

O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.gamengame.com/KALogoutComponent.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{250BCF07-4E23-42F9-B06B-787A3BF14790}: NameServer = 202.156.1.78,202.156.1.68

O17 - HKLM\System\CS1\Services\Tcpip\..\{250BCF07-4E23-42F9-B06B-787A3BF14790}: NameServer = 202.156.1.78,202.156.1.68

O17 - HKLM\System\CS2\Services\Tcpip\..\{250BCF07-4E23-42F9-B06B-787A3BF14790}: NameServer = 202.156.1.78,202.156.1.68

Only fix the above 017 entries if ther don`t belong to your ISP.

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Program Files\ParetoLogic

Reboot your system.

I asked you in my last post if you were still getting system crashes. Please let me know.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i dun have any more crashes .Regardin the files that you asked me to remove, i think i need it.

 

[howard_hopkinso]

i dun have any more crashes .Regardin the files that you asked me to remove, i think i need it.

In that case feel free to keep them.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

Thank you very much for your time and help.

 

[havoc123123]

i am having problem with my computer again .when ever my com load finish when going into windows.it will flash a blue screen and reboot.i tried wif safe mode n last know good configuration but it still did not work.any idea how i can solve the prob? i do not want to reformat my drive cu z i still have things i want inside.

 

[howard_hopkinso]

You need to open a new thread for this in our Windows OS forum, after reading this thread HERE.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i managed to get com back on.here is my log

 

[howard_hopkinso]

Your system is riddled with nasties once again. A lot of this is caused through running a completely unpatched version of Windows. You really need to run Windows updates and install at least service pack 1 and preferably service pack 2. Unless you do this, your problems are going to keep happening.

Go HERE and follow all the instructions exactly, including installing firewall software.

Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i patched to the newer version.here is my new log

 

[howard_hopkinso]

You have not attached an AVG Antispyware log as requested, nor have you installed any firewall software.

Install one of the firewall programmes below.

Zonealarm or Kerio free firewall programmes.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

LiveUpdate

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

LUCOMS~1.EXE

Close task manager.


Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools\pctools.dll

O4 - HKLM\..\Run: [ErrorRepairPro] ' '

O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitLord\BitLord.exe"

O16 - DPF: {76CB493D-11F7-4236-BDE4-7A5851B03FA9} (Launcher Class) - http://www.cabalonline.net/Com/CabalWebLauncher.cab

O20 - Winlogon Notify: cmdmant - msgcom.dll (file missing)

O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\PROGRA~1\Symantec\LIVEUP~1<Delete the entire folder.
C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Post a fresh HJT log as well as an AVG Antispyware log.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

i cant delete C:\Documents and Settings\All Users\Application Data\Microsoft\PCTools.
when i press ctrl+alt+del it pops up a windows saying my task mangaer disabled by administrator.
when my windows startup there is a pop up saying error loading c:/Windows/system32/nhnnw.dll.Invalid access to memory location.

 

[howard_hopkinso]

We need to temporarily disable Spybot search & Destroy`s tea time, as it may interfere with any fix we are trying to run.

Disable Spybot's TeaTimer. This is a two step process.
First:
- Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
- Choose Exit Spybot S&D Resident
Second:
- Open Spybot S&D
- Click Mode, check Advanced Mode
- Go To Left Panel, Click Tools, then also in left panel, click Resident
- If your firewall raises a question, say OK
- Uncheck the box labeled Resident Tea-Timer and OK any prompts.
- Use File, Exit to terminate Spybot
- Reboot your machine for the changes to take effect.

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

ok. here are my logs

 

[howard_hopkinso]

The nasty BHO is still there.

Download combofix.exe. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "Y" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[havoc123123]

here are the logs

 

[howard_hopkinso]

You still have not installed a firewall programme, please do so.

It seems your system is infected with some kind of rootkit.

Download the AVG Antirootkit programme. Disconnect from the net and install the programme, then restart your computer.

Run the programme and click the "Perform in-depth search." Allow AVG to complete the scan. The AVG scanner will give the "Rootkit path"
* Select the Rootkit Driver by placing a checkmark against it and click "Remove selected items." Next, agree for the terms and conditions that is displayed by AVG and click "OK" to reboot the PC. Reconnect to the net.

Then, go HERE and follow the instructions for removing the infection. Try the automatic removal tool first. If that doesn`t help, try the manual removal instructions.

Let me know the results and post a fresh HJT log.

Regards Howard

This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.