What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] TrojanDownloader

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi sorry, attach log below, sorry for the mistake UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 13/06/2007 11:57:53 System Uptime: 07/10/2009 13:11:16 (-2132 hours ago) Motherboard: MTC | | MTC Processor: Intel® Core™2 CPU T7200 @ 2.00GHz | CPU | 1992/667mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 144 GiB total, 60.418 GiB free. E: is CDROM () F: is CDROM (CDFS) ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP612: 08/07/2009 19:13:24 - Removed Java™ 6 Update 5 RP613: 08/07/2009 19:18:20 - Removed Java™ 6 Update 5 RP614: 08/07/2009 19:19:42 - Removed Java™ 6 Update 7 RP615: 08/07/2009 19:33:37 - Installed Java™ 6 Update 14 RP616: 09/07/2009 14:47:27 - Windows Update RP617: 10/07/2009 17:11:04 - Scheduled Checkpoint ==== Installed Programs ====================== 32 Bit HP CIO Components Installer Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Flash Player ActiveX Adobe Reader 8.1.2 Adobe Reader 8.1.2 Security Update 1 (KB403742) AIO_Scan Apple Mobile Device Support Apple Software Update µTorrent AVG Free 8.5 BufferChm Command & Conquer Red Alert 2 Copy CustomerResearchQFolder Destination Component DeviceDiscovery DeviceManagementQFolder DJ_AIO_ProductContext DJ_AIO_Software DJ_AIO_Software_min DVD Decrypter (Remove Only) DVD Flick DVD Shrink 3.2 eSupportQFolder ExtractNow F2100 F2100_doccd F2100_Help Football Manager 2009 G-Force Blue Google Toolbar for Internet Explorer Hazard Perception 2005/6 HDAUDIO Soft Data Fax Modem with SmartCP HP Customer Participation Program 9.0 HP Deskjet All-In-One Software 9.0 HP Imaging Device Functions 9.0 HP Photosmart Essential 2.01 HP Photosmart Essential2.01 HP Smart Web Printing HP Solution Center 9.0 HP Update HPProductAssistant HPSSupply iTunes Java™ 6 Update 14 K-Lite Codec Pack 3.8.0 Basic MagicDisc 2.7.105 Malwarebytes' Anti-Malware MarketResearch Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB929729) Microsoft Office Professional Edition 2003 Microsoft Visual C++ 2005 Redistributable MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) Nero 7 Essentials PowerDVD PSSWCORE QuickTime RealPlayer Realtek High Definition Audio Driver Rosetta Stone V3 SAGEM F@st 800-840 Scan Shockwave SolutionCenter Status Steam Synaptics Pointing Device Driver Toolbox TrayApp UnloadSupport VideoToolkit01 WebReg Westwood Shared Internet Components Windows Live Messenger Windows Live Sign-in Assistant Windows Live Toolbar WinZip 12.1 ==== Event Viewer Messages From Past Week ======== 10/07/2009 12:02:44, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service. 10/07/2009 12:02:44, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23). 10/07/2009 12:01:12, Error: EventLog [6008] - The previous system shutdown at 11:59:20 on 10/07/2009 was unexpected. 09/07/2009 18:24:45, Error: EventLog [6008] - The previous system shutdown at 18:22:57 on 09/07/2009 was unexpected. 09/07/2009 15:51:58, Error: EventLog [6008] - The previous system shutdown at 15:50:45 on 09/07/2009 was unexpected. 07/07/2009 18:21:30, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user Hunter-PC\Hunter SID (S-1-5-21-766821314-846978118-226274047-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool. 06/07/2009 18:51:38, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PEVSystemStart service to connect. 06/07/2009 18:51:37, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 05/07/2009 19:22:53, Error: EventLog [6008] - The previous system shutdown at 18:27:05 on 05/07/2009 was unexpected. 05/07/2009 18:12:59, Error: EventLog [6008] - The previous system shutdown at 18:11:35 on 05/07/2009 was unexpected. 05/07/2009 18:00:39, Error: Service Control Manager [7034] - The Volume Shadow Copy service terminated unexpectedly. It has done this 1 time(s). 05/07/2009 14:10:00, Error: EventLog [6008] - The previous system shutdown at 14:08:25 on 05/07/2009 was unexpected. 04/07/2009 22:36:44, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AvgLdx86 AvgMfx86 spldr Wanarpv6 04/07/2009 22:36:44, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 04/07/2009 22:33:26, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 04/07/2009 22:32:51, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89} 04/07/2009 22:32:51, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E} 04/07/2009 22:32:51, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF} 04/07/2009 22:32:48, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 04/07/2009 22:32:39, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 04/07/2009 17:34:05, Error: Service Control Manager [7023] - The Secure Socket Tunneling Protocol Service service terminated with the following error: The RPC server is unavailable. 04/07/2009 17:34:05, Error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Secure Socket Tunneling Protocol Service service which failed to start because of the following error: The RPC server is unavailable. 04/07/2009 11:36:56, Error: EventLog [6008] - The previous system shutdown at 11:07:14 on 04/07/2009 was unexpected. 03/07/2009 18:53:03, Error: EventLog [6008] - The previous system shutdown at 18:40:22 on 03/07/2009 was unexpected. 03/07/2009 12:47:25, Error: Service Control Manager [7000] - The General Purpose USB Driver (adildr.sys) service failed to start due to the following error: The system cannot find the file specified. ==== End Of File =========================== thanks hunterberg
Post #17
Hello.

Logs look good. One warning on p2p programs.

Peer-to-Peer Programs Warning

Your log shows that you are using so called peer-to-peer or file-sharing programs (in your case UTorrent). These programs allow to share files between users as the name(s) suggest. In today's world cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: File-Sharing, otherwise known as Peer To Peer and Risks of File-Sharing Technology.

It is also important to note that sharing entertainment files and proprietary software infringes the copyright laws in many countries over the world and you are putting yourself at risk of being indicted through organizations watching over the rights of the authors of such files (i.e. the RIAA for music files, or the MPAA for movie files in the USA) or the authors of the files themselves.

Naturally there are also legal ways to use these services, such as downloading Linux distributions or office suites such as "Open Office."

It is your decision whether or not you wish to keep your program(s) but I suggest you remove it via add/remove. However, please refrain from using them until your computer has been declared clean.


Please follow/read the steps below to remove the tools we used and for some more information. :)

Uninstall ComboFix

Remove Combofix now that we're done with it.
  • Click on your Start Menu, then Run….
  • Now type combofix /u in the runbox and click OK. Notice the space between the "x" and "/".
    [external image: Posted Image]
  • You will then recieve a message letting you know that Combofix was uninstalled Successfully.

This will remove files/folders assoicated with combofix and uninstall it.

Download and Run OTC

We will now remove the tools we used during this fix using OTC.



System A bit Slow? Try StartupLight

You may wish to try StartupLite. Simply download this tool to your desktop and run it. It will explain any optional auto-start programs on your system, and offer the option to stop these programs from starting at startup. This will result in fewer programs running when you boot your system, and should improve preformance.

If that does not work, you can try the steps mentioned in Slow Computer/browser? Check Here First; It May Not Be Malware.


Congratulations! You now appear clean! :D :woot:

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.

Vist the WindowsUpdate Site Regularly

I recommend you regularly visit the Windows Update Site!
  • Lots of Hacking/Trojans use the methods found (plugged by the updates) that have not been stopped by people not updating.
  • Update ALL Critical updates and any other Windows updates for services/programs that you use.
  • If you wish to turn on automatic updates then you will find here is a nice little article about turning on automatic updates.
  • Note that it will download them for you, but you still have to actually click install.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Update all programs regularly - Make sure you update all the programs you have installed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.
Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet


If you have no more questions, comments or problems please tell us, so we can close off the topic.

Thanks :)

With Regards,
Extremeboy
Post #18
That's absolutely brillant i can't thank you enough for your excellent help, I have to agree with your comments about the peer to peer sites i used them to download the office an american workplace season 4 and 5 after waiting two years for it to be shown on tv here in the UK i finally gave up and downloaded it but i have taken what you have said about peer to peer sites on board. Once again thanks a million :wavey: Hunterberg
Post #20
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI