Trojans? Need advice !

[tribbey]

Hello, I had some really bad malaware yesterday and went through the whole process with HijackThis to remove them in the safe made with Smitfraudfix. It worked. But when the Trojan Remover scans my computer, it finds 3 files that might be Trojans. I need some help:

Name: C:\windows\system32\pl<<
Located under: HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run


Name: rundll32.exe, C:\windows\mmfs.dll, Service
Located under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControl\Set\Services\LitCtrlService\"Image Path"


Name: C:\Program Files\Launch Manager\POWERKEY.sys
Located under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Powerkey\"Image Path"

Trojan Remover tells me that the files couldn't be found or are in use and cannot be scanned. When I run HijackThis, I get some weird names in the repport that I'd rather fix, but I don't want to do without knowing what's going on and if these files are infected. Sometimes, an alert popup opens telling me about a Trojan Downloader Virus. My Norton takes care of it and then it reappears sometime later. I really hope you can help me it! Should I post the HJT report? Thanks!

 

[N3051M]

Have a read of this

Follow these instructions BEFORE posting your HJT log.

*optional*Get rid of norton for now, its probably not helping you at the moment. Install AVG and choose a firewall (Kerio or Zonelalarm) from the link above and use them instead.

Then post your HJT log as a .txt or .log attachment on your next post.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go and read the Trojan Pakes and other nasties preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


Regards Howard :wave: :wave:


This thread is for the use of tribbey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[tribbey]

cleaning done...

hello Howard, I did everything as indicated in your mail. A lot of files were found on my computer. I have attached the HJT report, as well as the Anti Spyware Report. My Internet Explorer is still slow. What about all these anti viruses/spyware programs I have installed? Should I keep them? Uninstall them? I'm still running on Norton and I've read here that I should get rid of it and work with AVG. Is that so? Thank you so much for your time and help!

 

[howard_hopkinso]

Download the Pocket Killbox programme from HERE. Extract it but don`t run it yet.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

WINDOWS SYSTEM

Close the services window.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

ninfoie.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: (no name) - {F18F04B0-9CF1-4b93-B004-77A288BEE28B} - C:\WINDOWS\system32\scdosvrg.dll

O4 - HKLM\..\Run: [USB2Check] RUNDLL32.EXE "C:\WINDOWS\system32\PCLECoInst.dll",CheckUSBController

O4 - HKLM\..\Run: [USBToolTip] "C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe"

O4 - HKLM\..\Run: [WINDOWS SYSTEM] ninfoie.exe

O4 - HKLM\..\RunServices: [WINDOWS SYSTEM] ninfoie.exe

O4 - HKCU\..\Run: [ChkMail] p<‹

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

ninfoie.exe Search your system for this file and delete all instances of it.

Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted. If your computer doesn`t automatically restart, restart it manually.

This is the filepath you need to enter into killbox.

C:\WINDOWS\system32\scdosvrg.dll

Once your system has rebooted, turn system restore back on and rehide your protected OS files.

You shouldn`t be running more than one antivirus programme. Apart from slowing your system down, it can cause conflicts. I suggest you uninstall Symantec/Norton. If you have any problems with the uninstallation, see this thread HERE.

Once you done the above, please post a fresh HJT log and let me know how your system is running.

Regards Howard


This thread is for the use of tribbey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[tribbey]

cleaning done 2

I followed the step by step. My system couldn't find any ninfoie.exe file onmy hard disc. The Killbox coulnd't find anything either to kill (the thread you gave me). I have attached the new HJT report. Thanks you!

 

[howard_hopkinso]

Your HJT log is clean.

I cannot stress how important it is to remove one of the antivirus programmes. I personally recommend you remove the Symantec/Norton programme. If you do this, you will notice a speed increase to your system.

However, it really is your call.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of tribbey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[tribbey]

Thank You!

Dear Howard, thank you so much for your help! I have just uninstalled the Norton using the removal tool. I couldn't have done it without you! Again, THANK YOU!!!!!

 

[howard_hopkinso]

That`s good news.

You`ll probably need a to install a firewall now Symantec/Norton has been uninstalled.

I suggest either the free Zonealarm or Kerio firewall programmes.

Regards Howard

This thread is for the use of tribbey only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.