Welcome to the TechSpot OpenBoards. Please read the FAQ if you have any questions. Login to participate.
|
|||||||
Help: _helper.dll, _helper.sig and helper.sig
 |
|
|
|
Thread Tools |
|
#1
11-30-2008
|
|||
|
|||
|
Help: _helper.dll, _helper.sig and helper.sig
When my computer boots up a window labeled Common opens containing the three files in the title. After following the 8-step Viruses/Spyware/Malware Preliminary Removal Instructions I found several trojans on my computer including (but not limited to) Monder, Dropper.Gen, Spy.Agent and Dlkroha.
I followed all of the 8 steps but still have the same problem (along with slowed performance). I've attached the requested logs. Thanks in advance for any help. |
|
#2
12-01-2008
|
|||
|
|||
|
Welcome to TS. Your description is helpful. Your logs show found and removed items. For your case, we will supplement our guide with a special scan / tool.
Overview -
Quote:
Quote:
|
Combofix
|
|
#3
12-01-2008
|
|||
|
|||
|
Thank you for the response. I'll follow your suggestions when I get home this evening and respond with the requested logs.
Just to be clear, when you suggest: Quote:
Thank you again. |
|
#4
12-01-2008
|
|||
|
|||
|
One re-run is the norm. SAS is the "canary" here. It reported a 'trojan.trace'. The scanners after applying fixes, then uncover additional infections. As I said, one run is the norm since MBAB is good at what it finds. ComboFix will be examined for confirmation that the trace referred to by SAS, is residue and not an active infection.
|
|
#5
12-01-2008
|
|||
|
|||
|
Hello again.
I've follwed your instructions and attached the following logs: *2 MWBM logs (first one found 6 instances of the Vundo trojan and the second all clear) *2 SASW logs (first one only found tracking cookies...second all clear) *Combofix log *HJT log I am still getting a window titled 'Common' upon restart that contains now 2 files (_helper.dll and _helper.sig). Previously it contained a file titled helper.sig but I believe Combofix deleted that file. Please advise on next suggestions. Thank you again. |
|
#7
12-02-2008
|
|||
|
|||
|
Okay, so I'm a tiny bit impatient so I've tried a few more things.
Based on another thread on this site, I installed and ran BFU to try to get rid of the _helper.dll and helper.sig files and I think it worked as the files no longer show up when I reboot. I also re-ran MBAM, SASW and HJT and have attached logs. WIll someone be so kind as to check and make sure I look all clear. The only (new) thing I'm noticing now is that the icon next to this website (in the IE address bar and tab) is actually the logo for my bank. I'm not sure if that's an indication of something odd going on but it's got me a tad nervous. Thanks in advance. |
|
#8
12-03-2008
|
|||
|
|||
|
Swanny00, your findings are surprising. At the end of this reply, I will use a quote box to highlight findings in the logs. I will ask the tool developer to review the results.
The ‘fixit’ tool cleaned the folder ‘Common’. ‘SecTaskMan’ folder is now being discussed in other forums. ComboFix scan did not discriminate against these folders. As a next step, I suggest updating the tools & repeat scans: MBAM, SAS, ComboFix. HJT. These tools are updated quite frequently. ComboFix log shows the suspect folder modified after the create date. Will look for similar pattern. Quote:
|
|
#9
12-03-2008
|
|||
|
|||
|
I looked thu all an it looks clean Rich did you a good job.
The spelling is OK! The Icon was likely off the screen before. Malware would not put it there to draw your attention. You sound a little paranoid so if you wish run the 2 procedures below and take a look with other eyes. -------------------------------------------------------------------------------------------------------------------------------------- Download SD Fix to Desktop among other things Catchme to look for RootKits. http://downloads.andymanchesta.com/R...ools/SDFix.exe On Desktop run SDdFix It will run (install) then close. Then reboot into Safe Mode As the computer starts up, tap the F8 key several times. On the Boot menu Choose Safe Mode. Click thu all the prompts to get to desktop. At Desktop My Computer C: drive. Double-click to open. Look for a folder called SD Fix. Double-click to enter SD Fix. Double-click to RunThis.bat. Type Y to begin. SD Fix does its job. When prompted hit the enter key to restart the computer Your computer will reboot. On normal restart the Fixtool will run again and complete the removal process then say Finished, Hit the Enter key to end the script and load your desktop icons. Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt. Attach the Report.txt file to your next post. ---------------------------------------------------------------------------------------------------------------------------------- Then.... Download OTScanIt: http://download.bleepingcomputer.com...r/OTScanIt.exe Close all Apps and Browsers Download and save to Desktop and Dbl Click extract the files to an OTScanIt Folder. If Firewall or other Security or Malware protections pop you should allow them to let OTScanit to run. Enter the OTScanit folder and run OTScanit.exe. In Additional Scans select BotCheck, Disabled MS Config Items and Eventviewer Errors/Warnings Top Left click Run Scan. The scan can take some time so allow it time. Then finished a log will open, save log, copy post as an Attachment. Mike |
|
|
#10
12-04-2008
|
|||
|
|||
|
Thanks for the responses and the help Rich and Mike. I ran mbam and sas again along with OTScanIt and SDFix and have attached the logs/reports. Everything seems to be clean and working smoothly. Thanks again for the help.
Should I do any final cleanup? I now have a ton of anti-malware software (and logs) that I presume I don't need anymore. Should I worry about setting a new restore point? Anything else I may be missing? |
|
#11
12-04-2008
|
|||
|
|||
|
Quote:
|
for full text.|
#12
12-04-2008
|
|||
|
|||
|
Correction for above cleanup.
Not OTScanit but OTCleanit as below. Please download OTCleanIt http://download.bleepingcomputer.com.../OTCleanIt.exe Save to desktop. This will remove all the tools we used to clean your computer. These tools update so often they require downloading again later if needed. Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?" Approve all if prompted by Firewall, Widows Defender or other guards or security programs about OTCleanIt attempting access to the Internet, allow all. If prompted to Reboot click Yes. OTCleanit will delete itself when finished, if not delete it by yourself. Mike |
|
| Thread Tools | |
|
|
| Similar Topics | ||||
| Topic | Category | Replies | Last Post | |
| Trojans/helper.dll/helper.sig | Virus & Malware removal | 40 | 12-12-2008 03:30 PM | |
| Helper.dll virus, not sure if it's completely gone | Virus & Malware removal | 6 | 10-27-2008 02:24 PM | |
| A BHO ( Browser helper object) | Virus & Malware removal | 2 | 10-23-2006 07:48 AM | |
All times are GMT -4. The time now is 10:10 AM.