Update, downloader.generic6.aeph avg

[gadge]

I have a reappearing trojan which comes back on every restart. I use avg free and spybot and ad-aware. I have looked at the previous thread on this and appears that I do not have the c\windows\?dobe.exe. but as informed it could be any infected file. can anybody please help, I can find my way around the machine but am not that competant so please be gentle!!! many thanks for any interest

 

[gadge]

think i have also attached a word doc showing the avg screen

 

[Blind Dragon]

Ok.

Boot into Safe Mode

• Restart your computer and start pressing the F8 key on your keyboard.
• Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Launch Hijackthis -> Select Do a System Scan only -> put a check mark next to:
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKCU\..\Run: [Kufezjww] "C:\Program Files\Common Files\?ymantec\?explore.exe"


Select Fix checked

Use Windows Explorer to navigate to and delete the following files:

• Access Windows Explorer by clicking Start, point to All Programs, Accesories, and then click Windows Explorer. Or hold the windows key and press E

Folders:
C:\Program Files\Common Files\?ymantec <-This folder only

Reboot the computer into Normal Mode
--------------------------------------------------------------------------------------------------------
Make sure that Spybot is up to date, and that you have recently Immunized.

Navigate to C:\Windows\System32\drivers\etc ->Right click on your hosts file and click on properties. Make sure it is set to read only.

and just to be sure we got everything:
Combofix

• Download Combofix to your desktop.
• Double click combofix.exe & follow the prompts.
• A window will open with a warning.
• Type "1" (and Enter) to start the fix.
• When the scan completes it will open a text window. Please attach that log back here

Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Combofix is a very powerful tool so please do NOT do anything without instruction

Combofix will automatically save the log file to C:\combofix.txt

 

[gadge]

it worked no trojan on the re boot. many many thanks

 

[Blind Dragon]

Excellent,

you should still make sure that spybot is updated and Immunize.

you should still navigate to the hostfile and make sure it is set to read only.

If you have any more problems please post in this thread