[Resolved] win32Trojan-gen help plz

Hi lisafunkypants,

Let's try this provided you haven't used System Restore after you used it the one time you told me about.

Click your Start button, click run. Copy and paste this line into the run box and click Ok

%systemroot%\System32\restore\rstrui.exe

This will open system restore. On the System Restore Welcome page you should have this option

Undo my last restoration,

Check mark it and click Next. Follow the prompts from there.

Hopefully this will restore your computer to the state it was in after you installed SP3. We will deal with that problem afterwards.

Let us know how you make out.

I only did a SR that time i told you about, and my screen looks a whole lot healther now, the pc is staying on rather than going straight into black screen, i had to do it through my daughters account as this one failed to do the restore, I can run Malwarebytes now, and all my icons have come back on the Start menu

Hi lisafunkypants, That sounds good. Since the OTL log you posted was from when the computer wasn't quite right, the OTL log you posted may be full of inacuraccies. Please run it again and post the new log. You said you were able to run MBAM, please post that log also if it found any thing. Thanks

hi the malwarebytes came up clear 📎OTL2.Txt

Hi lisafunkypants, There doesn't appear to be anything nasty in the OTL log. Looking at the Avast chest files, it looks like avast removed a file from drive F: Is F: the ipod in question?

The F: is the ipod because when it was plugged it in on the 18th the avast came on straight away and said virus found it moved it to the chest thats when i saw it was this Autorun. if its clear then i'm happy and would like to thank you for helping me again ive learnt to uninstall properly before doing a restore lol. I will have a look at those links you sent me last time now with regards to the front usb ports as they arnt working at all, last time that happened a technician who looked at the pc said it was a software issue (story of my life) So thanks Oldman Your A Star

Hi lisafunkypants,

With the autorun removed whatever it was pointed at won't run. We can find out a little more about it and see what it was pointed at.

No worry about the file being accidentally executed, as files can't be ran from within the chest.

Open the avast chest, right click on the Autorun.inf and select properties. Please post the file size.

Thanks

📎avast_auto.JPG I have to post like this as i dont know how to get the file info any other way

Hi lisafunkypants,

Let's see if we can get a look inside the file.

First right click on a blank spot on your desktop.

• Select New
• Click Folder
• On your keyboard type suspect
• Left click near the folder to make sure the name is correct

Open the avast chest

• Right click on the Autorun.inf file
• Click Extract
• A window will open, locate the suspect folder (it will most likely be at the bottom of the list)
• Click on it and click ok.

You should get a confirmation window, close it and the chest.

Please download ZipIt from here:
Download 1
Download 2

• Double-click ZipIt! to run it.
• Then copy the content of the following codebox into the textfield:
  Do not copy the word Code
  

  "%userprofile%\Desktop\suspect\ Autorun.inf"

• Then, just click the Zip button.
• When finished, and if successful, a new file will have been created on your Desktop. You will be notified of what the file name is when the process has been completed.

Please attach the zip file to your next reply.

Thanks

Hi i did what you said but the zip said the path did not exist but it created this anyway. 📎bailey.zip

Hi lisafunkypants,

The folder was empty. Try this in ZipIt


D:\Documents and Settings\bailey.048919120306\Desktop\suspect\Autorun.inf

Thanks

Okay so this is getting difficult did what you said then when ipressed zip it i got a avast warning saying the virus was there and the zipit wouldnt do anything so i copied the window to see if you can make sense of it. 📎zip_problem.JPG

Hi lisafunkypants,

Well we will have to tell avast to mind it's own business.

Either do this while you are here at the forum or you may need to do it again when you attach it.

Right click the "a" icon near the clock, highlight Pause Provider and click Standard shield.

Make the zip file and attach it.

Resume the provider you previously paused.

Right click the "a" icon near the clock, highlight Resume Provider and click Standard shield.

I'll remove the attachment after you post.

well that seemed to go better hope its right

Hi lisafunkypants,

Can you use the edit function to remove the attachment from your previous reply? It's not really harmful without the associated file but will trigger some antivirus programs.

I tried but am unable to.



Empty the Recycle Bin in every User account on the computer.

If you don't still have Flash Drive Disinfector, download it again from the link below. Plug in the Ipod then run FDD.

Download Flash_Disinfector.exe by sUBs and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

What drive letter is the Ipod recognized as?