2 replies to this topic

[vanillacokeit]

Dell desktop runs windows XP, can't open many programs including hijackthis and the mcafee. When accessing the internet it directs me to ads instead of the webpages I try to go to. Tried opening in safe mode to access this page and hopefully download a program that could help but couldn't get into any webpages, just was directed to different ads, like yellowpages. Another computer on our network has recently been infected with police pro. This computer didn't show police pro but came up with a warning about artidmedis trojan virus (spelled something like that). I plan to try and transfer one of the programs I used on my sisters computer from this website through the usb drive. Was able to get these programs (same one's I was told to use on the comp infected with police pro) onto the computer via usb and run them: exehelper, win32kdiag.exe here are the logs:

Attached Files

•  exehelperlog.txt   548bytes   202 downloads
•  Win32kDiag.txt   6.48KB   271 downloads

Edited by vanillacokeit, 02 October 2009 - 09:28 AM.

[Raktor]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

• Absence of symptoms does not always mean the computer is clean
• Please do not run any scans or fixes without my direction.
• Finally, stay with this topic until I give you the final 'All clear' post.

1) DDS

Please download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  
  • DDS.txt
  • Attach.txt
• Save both reports to your desktop.

2) RR
Please download RootRepeal.zip.
Save it to your Desktop. Alternate download links here or here.
Please print these instructions, you will not have an Internet connection!
If you have a 3rd party "unzipping" program...use it to open the zipped file...then skip to Step 5. Otherwise...

• Right click on RootRepeal.zip and select "Extract All"....
• Click Next on the "Welcome to the Compressed (zipped) Folders Extraction Wizard."
• Click on the Browse...button, then click on Desktop, then click OK.
• Once done, check (tick) the Show extracted files box and click Finish.
• Before running RootRepeal:
  • Disconnect from the Internet as your system will be unprotected while using this tool.
    Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
• Open the RootRepeal folder and double-click on RootRepeal.exe to launch it.
• When the program opens, click the Report tab at the bottom, then click the Scan button.
• In the Select Scan, dialog which asks What do you want to include in the scan?, check ALL the boxes.
  
• Click OK.
• In the Select Drives, dialog Please select drives to scan: select all drives showing, then click OK.
  The scan can take some time to finish. Do not use the computer while the scan is running.
  When the scan has completed, a list of files will be generated in the RootRepeal window.
• Click on the Save Report button and save it as "rootrepeal.txt" to your desktop.
• Close and exit RootRepeal
• Double-click on the file rootrepeal.txt... Notepad will open... copy/paste the file contents in your next reply.

Make sure to enable your anti-virus, Firewall and any other security programs you disabled.
Note: If RootRepeal cannot complete a scan and results in a crash report, try repeating the scan in "safe mode".

3) What You Will Need To Post:

• DDS logs
• RR log

[Raktor]

Due to inactivity this topic will be closed. If you need help please start a new thread.