Lots of Trojans

Status
Not open for further replies.
M

marygg

Posts: 123   +0
This computer has been partially cleaned. I suspect there are more problems than I can see. Attached are 2 logs. AVG anti spyware log is huge. I will send it later. Sorry I can't do it right now. Panda didn't find anything.
 
First I want you to go to Start -> Control Panel -> Add/remove Programs -> remove:
*All versions of Java or JRE
*ShoppingReport <-If there

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
File::
C:\WINDOWS\BMc732a25e.xml
C:\WINDOWS\pskt.ini
C:\Documents and Settings\john garcia\remote.exe
C:\WINDOWS\system32\msjava32.dll
C:\WINDOWS\system32\4659CBFC12.sys

Folder::
C:\Program Files\RcvSystem
C:\Program Files\Java
C:\Program Files\Common Files\Java

Registry::
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{43F7497C-7687-4DEA-A057-F21BD81BC896}]
2007-04-16 07:52 108032 --a------ C:\WINDOWS\system32\msjava32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
Click to expand...

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Boot into Safe Mode
  • Restart your computer and start pressing the F8 key on your keyboard.
  • Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.

Run Hijackthis and Select Do A System Scan Only
Put a check mark next to the following entries if there:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = %3clocal%3e:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: BndBlock5 BHO Class - {82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B} - C:\Program Files\QdrDrive\QdrDrive10.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O8 - Extra context menu item: &Search - ?p=ZCfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - (no file)
O23 - Service: SystemSuite Task Manager - Unknown owner - C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe (file missing)

Reboot into Normal Mode


Update your Java Runtime Environment
  • Click the following link
    Java Runtime Environment 6 Update 4
  • The 4th option down is the one you want
  • After the download locate and double click the installer jre-6u4-windows-i586-p-iftw.exe
  • Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions

Run Hijackthis one last time and post the log along with combofix.txt
 
I still can't uninstall
J2SE Runtime Environment 5.0 Update 9 and
JAVA (TM) SE Runtime Environment 6 Update 1
from add/remove prgrams.

The combofix and hjt logs are included.

I really appreciate your help.
 
Run System Scan only with Hijackthis and fix this entry:

O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - (no file)


I don't see the combofix log, and we will work on Java after I see the combofix log, it should be gone, just have to remove it from add/remove list. Did you already install java 6 update 4
 
We removed Java already, so you can take it off of add/remove list by clicking remove, a box should pop that says the program no longer exist, would you like to remove it from add/remove list, click YES. If it doesn't give you that option let me know and we can remove them with Hijackthis

But first
CFScript

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [ ]
Click to expand...

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post a fresh HJT log.

Update your Java Runtime Environment
  • Click the following link
    Java Runtime Environment 6 Update 4
  • The 4th option down is the one you want
  • After the download locate and double click the installer jre-6u4-windows-i586-p-iftw.exe
  • Go to Start-> Control Panel-> add/remove programs (Programs and features), and uninstall any old versions in your case Java 6 Update 3
 
These two files won't uninstall: Java SE Runtime Environment 6 update 1 and J2SE Runtime Environment 5.0 Update 9. When I try to uninstall I get and error message "Fatal error duing instalation."

Sorry, I accidently deleted the combofixlog. Is there any way to retrieve it? It's not in recycle. Here's the hijackthis. Sorry I screwed it up.
 
marygg,

Launch Hijackthis

Open the misc Tools section

Open Uninstall manager

Select those versions of Java then click Delete this entry

We deleted the uninstallers with the programs.

check add/remove to verify they are gone.

Disable Teatimer
  • Right click the Spybot -SD Resident Icon located in your system tray, Select Exit Spybot - S&D Resident
  • Open Spybot S&D
  • Click on Mode at the top and make sure that Advanced is checked
  • Expand the Tools tab in the left pane
  • Single click on the Resident Icon also in the left pane
  • Uncheck Resident "TeaTimer" (Protection of over-all system settings) Active
  • Close spybot

Run Hijackthis and check these entries
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll (file missing)
O23 - Service: PC Tools Spyware Doctor (SDhelper) - Unknown owner - (no file)

Select Fix Checked

Now to enable teatimer
  • Expand the Tools tab in the left pane
  • Single click on the Resident Icon also in the left pane
  • check Resident "TeaTimer" (Protection of over-all system settings) Active
  • Close spybot

Nayeem39,

If you are having problems can you please start your own thread in our security forums found https://www.techspot.com/vb/menu28.html. These instructions are specifically for Marygg
 
Status
Not open for further replies.

Similar threads

Cal Jeffrey
Cyberpunk 2077 gets big send off with one last update that includes a working metro
Replies
18
Views
508
erickmendes
erickmendes
J
Inactive Admin rights are revoked
Replies
18
Views
2K
Broni
Broni
midian182
Mystery of LG washing machine using 3.6GB of data daily could have a simple explanation
2
Replies
37
Views
744
ZedRM
ZedRM

Latest posts

Back