[Closed] BACKDOOR.GENERIC.12.OJB affecting MBAM

I have a PC running Windows XP Pro SP2 which has been infected by all sorts of malware. I have AVG and MBAM and have run the files suggested by you guys, ERUNT and ATF cleaner. When I boot up it goes to the Windows User logon screen. I log in and the computer hangs on the wallpaper screen with no icons or task bar. As a workround I ctrl-alt-del and run explorer.exe which then brings up the Desktop icons and task bar. When I try to run MBAM the program starts and shows the GUI, runs for a few seconds and then shuts down. Malware identified by another scan revealed: BAT/SECOFF.A AUTOIT.ZXZ AUTOIT.AETG AUTOIT.ACKG GENERIC.AETZ AUTORUN.FJ BACKDOOR.GENERIC.12.OJB BACKDOOR.GENERIC.11.YAI VB.7.J (WORM) DOWNLOADER.AGENT2.ODM SHEUR2.BVWD DOWNLOADER.GENERIC9.VNC Where to from here??? Thanks Scarab

Hi Scarab, welcome to the forum.

To make cleaning this machine easier

• Please do not uninstall/install any programs unless asked to
  It is more difficult when files/programs are appearing in/disappearing from the logs.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
• Do not attach any logs/reports, etc.. unless specifically requested to do so.
• If you have problems with or do not understand the instructions, Please ask before continuing.
• Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

NEXT

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Download OTL to your desktop.

• Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

• GMER log
• both OTL logs

Thanks

Hi Do you still need help with this? Thanks

Due to inactivity this topic will be closed. If you need help please start a new thread.