[Resolved] Trojan

Hello McAfee scan said a trojan was detected, repaired and removed. It was called Exploit - PDF.q…… Whenever I run the scan it still says it is detected, repaired, removed. I called McAfee and they told me to go to 'restore' and click remove. I ran the Microsoft scan which says I have no infections. I read that Adobe was having trouble with its reader and flashplayer I think. Could that be the problem and is the reason why it says 'PDF"? I do not know how to trouble shoot this or what I should do next.. Thank you for help

Hi Peter1,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

• Click NO
• In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
• Now click the Scan button.
  Once the scan is complete, you may receive another notice about rootkit activity.
• Click OK.
• GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
• Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

• Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

In your next reply please provide:

• Gmer log
• DDS.txt
• attach.txt

I am pleased to hear such a generous offer to help. To date, I have done some remedial work and have run McAfee's scan along with Windows scanner. I also ran Seunia. Since knocking that trojan out of "restore/remove where McAfee was holding it. I have not had any problems. I am going to dump McAfee and instead of replacing it with Comcast's free Norton, I will set this desktop up like the laptop. I have Microsoft Security Essentials behind a router and also use Zone Alarm. So far all is in synch and running well. I have your offer in my 'inbox' and I will accept your offer if this rascal comes back. Thank you very much.

Peter1,

Please at least run this just as a little check. This is also an awesome program for you to keep in your arsenal and run every month or so anyway.

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

I will and hope to post back asap, thank you for taking the time.

[attachment removed]

Peter1,

Please at least run this just as a little check. This is also an awesome program for you to keep in your arsenal and run every month or so anyway.

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

>>I think I [attachment removed][attachment removed] attached the log by clicking on it.

Peter1,

You need to click on Remove Selected and let Mbam fix those registry entries or you won't get notified if some malware turns off your AV or firewall.

Otherwise, it looks good.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Thank you for all the help. One question if I may; Would you use the new Norton free for Comcast users or Microsoft Security essentials with Zone alarm? I will tune up exploerer and await your opinion.

Peter1, In the 1980's, Peter Norton was a god among geeks. Maybe second only to Bill Gates in some peoples opinions. However, Symantec hasn't done his name any favors in my opinion. To me, it is better than nothing but that's about it. Supposedly the recent iterations are better than what we were seeing from them but… it will take some time to make me a believer. Microsoft Security Essentials is fairly new to the AV game. However, what they have put out there appears to be pretty good. At least they haven't earned a bunch of bad press and they have impressed many. For the above reasons… I would use Microsoft. I suspect that if you asked several people, you would find varied answers for many different reasons.

Thank you again for taking the time. MSE it is and time will tell. Actually, one of the members here led me to it and he has not steered me wrong yet. I cannot think of his user name.

Anything more I can do for you?

Anything more I can do for you?

>>I learned a lot with your help and I am thankful.
Btw, I have been working with Norton on one pc and MSE 'w' Zone Alarm on the other.
I disabled Norton's PC tune up and also Backup, keeping the security features only.
I find no difference in speed but Norton updates quickly. It has a good forum also.
Although Norton is not very difficult it is hard;, MSE is much easier.
It is too soon to tell but I hope to report back when I feel I have decided which functions the better of the two for me.
Again thank you so much, especially for getting that malware out with your Malwarebyte'Anti - Malware program.
Prior to that I was infected without knowing it.
It is a good program to carry in your kit bag.
Thank you, Tom.

Peter1, You are very welcome. Good luck and be well.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.