I have tried every possible effort to remove this pain in my behind trojan and it keeps coming back. I have used Malare removal, spybot, torjan removal, super anti spyware. Still it keeps poping up on the screen every 5 minutes (please see attachment). Any help getting rid of this once and for all would be very much appreciated.
In the right panel, you will see several boxes that have been checked. Uncheck the following …
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 10/21/2008 4:19:24 AM
System Uptime: 12/24/2009 2:00:48 AM (3 hours ago)
Motherboard: Dell Inc. | | 0UW306
Processor: Intel® Core™2 Duo CPU T7300 @ 2.00GHz | Microprocessor | 2000/200mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 70 GiB total, 35.286 GiB free.
D: is FIXED (NTFS) - 79 GiB total, 53.312 GiB free.
E: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0011
Manufacturer: Microsoft
Name: Microsoft ISATAP Adapter
PNP Device ID: ROOT\*ISATAP\0011
Service: tunnel
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Microsoft ISATAP Adapter
Device ID: ROOT\*ISATAP\0050
Manufacturer: Microsoft
Name: isatap.{07B4E5D3-9A8C-4D08-9AB1-DE121D61B83D}
PNP Device ID: ROOT\*ISATAP\0050
Service: tunnel
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco AnyConnect VPN Virtual Miniport Adapter for Windows
PNP Device ID: ROOT\NET\0000
Service: vpnva
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0001
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0001
Service: CVirtA
==== System Restore Points ===================
No restore point in system.
==== Installed Programs ======================
µTorrent
1Click DVD Copy [removed]
32 Bit HP CIO Components Installer
Adobe Acrobat 7.0 Standard - English, Français, Deutsch
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Advanced Audio FX Engine
Advanced Video FX Engine
AIO_Scan
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Athan Basic 3.6
Auslogics Disk Defrag
avast! Antivirus
BitTorrent 6.0.2
Bonjour
Broadcom 440x 10/100 Integrated Controller
BufferChm
C6200
C6200_Help
Cards_Calendar_OrderGift_DoMorePlugout
CCleaner
Cisco AnyConnect VPN Client
Cisco Systems VPN Client 5.0.05.0290
Compatibility Pack for the 2007 Office system
Conexant HDA D330 MDC V.92 Modem
Copy
CustomerResearchQFolder
DealAssistant
Dell Resource CD
Dell Touchpad
DELL Webcam Center
DELL Webcam Manager
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DNA
DocProc
DocProcQFolder
Domino Video Converter Pro V1.0.620
DVD-CLONER V4.70 Build 926
eSupportQFolder
Fax
Google Toolbar for Internet Explorer
GPBaseService
Highlight Viewer (Windows Live Toolbar)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Customer Participation Program 10.0
HP Imaging Device Functions 10.0
HP Photosmart All-In-One Driver Software 10.0 Rel .2
HP Photosmart Essential 2.5
HP Smart Web Printing
HP Solution Center 10.0
HP Update
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPPhotoSmartPhotobookWebPack1
HPProductAssistant
HPSSupply
Intel Matrix Storage Manager
Internet Telephone 4.60
iTunes
Java™ 6 Update 15
Junk Mail filter update
Laptop Integrated Webcam Driver (1.04.01.1011)
Live! Cam Avatar Creator
Live! Cam Avatar v1.0
LiveTV_ Toolbar
LogMeIn
Map Button (Windows Live Toolbar)
MarketResearch
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook Connector
Microsoft Office Professional Edition 2003
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
MobileMe Control Panel
MP3 RM Converter 1.30
MSN Toolbar
MSVCRT
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nokia Connectivity Cable Driver
Nokia Lifeblog 2.1
Nokia MTP driver
Nokia PC Connectivity Solution
Nokia PC Suite
Nokia Software Launcher
NVIDIA Drivers
OCR Software by I.R.I.S. 10.0
OGA Notifier 2.0.0048.0
PanoStandAlone
PS_AIO_02_ProductContext
PS_AIO_02_Software
PS_AIO_02_Software_Min
PSSWCORE
QuickTime
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio Express Labeler
Roxio Update Manager
Safari
Scan
Shop for HP Supplies
SigmaTel Audio
Smart Menus (Windows Live Toolbar)
SmartWebPrintingOC
SolutionCenter
Sonic Activation Module
Status
SUPERAntiSpyware Free Edition
Toolbox
Tracks Eraser Pro v8.0 build 1001
TrayApp
UnloadSupport
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VideoToolkit01
VLC media player 0.9.8a
WebReg
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Favorites for Windows Live Toolbar
Windows Live ID Sign-in Assistant
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live OneCare safety scanner
Windows Live Photo Gallery
Windows Live Sync
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Upload Tool
Windows Live Writer
WinZip
Yahoo! Install Manager
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Software Update
Yahoo! Toolbar
==== End Of File ===========================
DDS.Txt
DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 5:12:54.08 on Thu 12/24/2009
Internet Explorer: 8.0.6001.18865
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2045.839 [GMT 3:00]
Hi,
Please try renaming GMER to svchost.exe and run it in safe mode. make sure you close all other programs including the internet. Disable all your security programs. Allow it to run uninterrupted. If you still have trouble running it, try running it in safe mode.
Hi,
I give up. The application won't launch in the safe mode. I hate these Trojans. If anyone have any fix on this, please let me know. If not, i will have to reload windows again cause it is a nightmare for me every 5 minutes the message pops up.
Thanks
You don't need to give up that easily, we have other tools to use.
Please do the following:
Download Combofix from either of the links below, and save it to your desktop.
Link 1 Link 2
**Note: It is important that it is saved directly to your desktop**
——————————————————————– IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–
Double click on ComboFix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.
![[external image: Posted Image]](http://i266.photobucket.com/albums/ii277/sUBs_/Gmer_initScan.gif){kind=link}