also @ TechSpot: Adobe Creative Cloud apps now available; Photoshop CC includes new features

Trojan Horse Downloader.Generic3.MIT

Discussion in 'Virus and Malware Removal' started by havoc123123, Feb 2, 2007.

Page 3 of 3

  1. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    That`s part of Nero so don`t delete it.

    See if you can find and delete the rest of the entries I gave you.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #41

  2. havoc123123 Newcomer, in training Posts: 32

    i cannot find :
    HKEY_CLASSES_ROOT\TypeLib\{385AB8C5-FB22-4D17-8834-064E2BA0A6F0}
    HKEY_CLASSES_ROOT\Interface\{385AB8C4-FB22-4D17-8834-064E2BA0A6F0}

    i am not able to delete:
    HKEY_CLASSES_ROOT\CLSID\{385AB8C6-FB22-4D17-8834-064E2BA0A6F0}
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
    Browser Helper Objects\{385AB8C6-FB22-4D17-8834-064E2BA0A6F0}
    havoc123123, Mar 12, 2007
    #42

  3. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    Ok, let`s see if the Avenger will delete those reg keys.

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #43

  4. havoc123123 Newcomer, in training Posts: 32

    HKEY_CLASSES_ROOT\CLSID\{385AB8C6-FB22-4D17-8834-064E2BA0A6F0}
    is still there.
    havoc123123, Mar 12, 2007
    #44

  5. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    The Avenger report says it successfully deleted that reg key and it`s no longer showing up in your HJT log.

    Your HJT log is now clean.

    As far as I can tell, your system is now clean.

    Turn off system restore.(XP/ME only) See how HERE.

    Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #45

  6. havoc123123 Newcomer, in training Posts: 32

    Thank you very much. can i like delete everything that is in my C:\Documents and Settings\user\Local Settings\Temp?
    havoc123123, Mar 12, 2007
    #46
     

  7. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    Rehide your protected OS files.

    Yes, you can safely delete whatever Windows will let you in that temp folder.

    You can also delete the Avenger and killbox backups and get rid of the programmes.

    I also suggest you run the Ccleaner programme as per the instructions in step9 of this thread HERE.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #47

  8. havoc123123 Newcomer, in training Posts: 32

    The PCtools folder is now in my avenger folder and i am not able to delete the folder.
    havoc123123, Mar 12, 2007
    #48

  9. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    Can`t you just delete the whole Avenger folder?

    Regards Howard :)
    howard_hopkinso, Mar 12, 2007
    #49

  10. havoc123123 Newcomer, in training Posts: 32

    not able to delete the whole avenger folder because of the PCtools.dll which is in the PCtools folder
    havoc123123, Mar 12, 2007
    #50

  11. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    First, try deleting it from safe mode.

    If that doesn`t work, try deleting it using this utility HERE.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #51

  12. havoc123123 Newcomer, in training Posts: 32

    still access denied
    havoc123123, Mar 12, 2007
    #52

  13. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    I don`t know why you can`t delete the C:\avenger\backup.zip. However, as long as the files are in that zip file, they can`t do any harm. Whatever you do, don`t unzip the files.

    Try killbox to delete the file.

    Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

    This is the filepath you need to enter into killbox.

    C:\avenger\backup.zip

    Once your system has rebooted, rehide your protected OS files.

    Post a fresh HJT log and let me know the outcome.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #53

  14. havoc123123 Newcomer, in training Posts: 32

    sorry about it.there is a folder other than backup.zip which is C:\avenger\PCTools.i am able to delete the backup.zip but not that PCtools folder
    havoc123123, Mar 12, 2007
    #54

  15. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

    2. Download the attached avengerscript.txt and save it to your desktop

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    3. Now, start The Avenger program by double clicking on its icon on your desktop.

    Under "Script file to execute" choose "Load script from file".
    Now click on the folder icon which will open a new window titled "open Script File"
    navigate to the file you have just downloaded, click on it and press open
    Now click on the Green Light to begin execution of the script
    Answer "Yes" twice when prompted.

    4. The Avenger will automatically do the following:

    It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    On reboot, it will briefly open a black command window on your desktop, this is normal.
    After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT log.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #55

  16. havoc123123 Newcomer, in training Posts: 32

    the folder is still there
    havoc123123, Mar 12, 2007
    #56

  17. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    I really don`t know what else to suggest, other than try the instructions again.

    I have changed the avenger script file to try and delete the pctools.dll from inside that folder.

    Run the Avenger again as per the instructions in my post above.

    Attach the Avenger log as well as a fresh HJT log.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #57

  18. havoc123123 Newcomer, in training Posts: 32

    the folder is gone.
    havoc123123, Mar 12, 2007
    #58

  19. howard_hopkinso Newcomer, in training Posts: 25,949   +16

    That was hard work lol.

    Now delete the Avenger including it`s backups from your system.

    Your HJT log is still clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of havoc123123 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
    howard_hopkinso, Mar 12, 2007
    #59

  20. havoc123123 Newcomer, in training Posts: 32

    Agree .Thanks for your help.I would not be able to clear it without your help
    havoc123123, Mar 12, 2007
    #60
Page 3 of 3
Topic Status:
Not open for further replies.

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...

Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.