[Resolved] Trojan-BNK.Win32.keylogger.gen -HELP TO REMOVE?

Hi.

Please can you assist with this.

I have switched on my laptop and found that there is a Trojan-BNK.Win32.keylogger.gen on there. It mentioned Antispyware XP 2010 security or something similar
on there. My sister then clicked on this link too.

I have tried to read up on how to remove however the pages on the internet are not so clear.

Hope you can help.

I am using a friend's laptop as the infected one will not allow access to IE. I cannot do anything and have loads of essays etc to write up.

Hope to hear from you very very soon.

Best Wishes

Hello cheekymonkey1882 and

My name is patndoris. I will be glad to take a look at your log and help you with solving any malware problems. It will be very helpful if you follow these guidelines:

• Malware logs are often lengthy and can take a lot of time to research and interpret. Please be patient while I review your logs.
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
• Please make sure to carefully read any instruction that I give you. If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
• Please follow my instructions carefully and in the order they are posted. You may also find it helpful to print out the instructions you receive.
• Please do not run any scans or install/uninstall any applications or delete anything without being directed to do so.
• Remember, absence of symptoms does not mean the infection is all gone. Please stick with me till you're given the "all clear".
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
• Please reply within 3 days. If I do not hear back from you in that time frame, I will post a reminder for you. Topics with no reply in 4 days are closed!

Please be advised I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
This may cause a delay in response time, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.

Thanks Patnoris. I look forward to hearing from you.

Boot your computer in Safe Mode

• Turn the computer on or Restart the computer
• As soon as BIOS is loaded, start tapping the F8 key.
• The Windows Advanced Options Menu appears.
  If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Use the arrow keys to select the Safe Mode with Networking menu option.
• Press Enter.
• The computer then begins to start in Safe mode.
• Log in to your usual account

Try to access the internet while in Safe Mode. If you are able. please do the following:

Note: If you are using Vista or Windows 7, when running programs please be sure to right-click the exe and choose Run as Administrator instead of double clicking.

Download and Run OTL

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scan box paste this in:
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  nvstor32.sys
  ahcix86s.sys
  nvrd32.sys
  symmpi.sys
  adp3132.sys
  mv61xx.sys
  /md5stop
  %systemroot%\*. /mp /s
  CREATERESTOREPOINT
  %systemroot%\system32\*.dll /lockedfiles
  %systemroot%\Tasks\*.job /lockedfiles
  %systemroot%\system32\drivers\*.sys /lockedfiles
  %systemroot%\System32\config\*.sav
  
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
  Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

If you have CDEmulation drivers installed (such as Daemon Tools, Alcohol120) please follow the instructions below to run DeFogger prior to and after running GMER. If you do not have any CDEmulation drivers installed, you do not need to run DeFogger and you can go right to the instructions to run GMER.

Download DeFogger

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
• Click the Disable button to disable your CD Emulation drivers
• Click Yes to continue
• A 'Finished!' message will appear
• Click OK
• DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Download and Run GMER

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked.
  Uncheck the following …
  
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file.
  
• Save it where you can easily find it, such as your desktop, and copy/paste the results in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you are still unable to access the internet, can you please let me know if you will be able to use another computer to download some tools onto a flash drive and tell me if your operating system is XP, Vista or Windows 7?

Hi. Thank you for the information. I cannot access safe mode with networking. I have an IBM T32 laptop with embedded security chip. This does not let me go past that at all. When it eventually loads for the CTrl+Alt+Delete login- it does not give me access to the password section. Is there any way around this? Thanks

Hi Again.

Update: It won't load up as normal anymore either.

I am just getting the embedded security chip stuff but not getting past that stage. Please help me with this as I am totally worried now. I have so many files that I hadnt backed up but are seriously so important.

Thanks.

I am trying to find out some information regarding the security chip. In the mean time, hopefully you can use your friend's computer to burn a CD.

Hopefully you have access to a computer that can burn CD's

We will need to make a BOOT CD

Print these instruction out so that you know what you are doing.

Two programs to download

First

Please downloadISOBurner and save it to your desktop. This program will allow you to burn OTLPE.ISO to make a bootable CD.

• Double click the ISOBurner set up icon to install the program, from there on in it is fairly automatic.
• There are Instructions for the iso burner here if you need them.

Second

• Download OTLPE.iso save it to your desktop. Now burn OTLPE.iso to a CD using ISO Burner. {NOTE: This file is 276.7 MB in size so it may take some time to download.)
• When downloaded double click OTLPE.iso > this will then open ISOBurner to burn the file to CD
  
  
• Reboot the infected system using the boot CD you just created.
  Note : If you do not know how to set your computer to boot from CD follow the steps here
• Your system should now display a REATOGO-X-PE desktop.
• you will find an icon on the desktop called OTLPE > Double-click on the OTLPE icon.
• When asked "Do you wish to load the remote registry", select Yes
• When asked "Do you wish to load remote user profile(s) for scanning", select Yes
• Ensure the box "Automatically Load All Remaining Users" is checked and press OK
• OTL should now start. Change the following settings
  
  • Change Drivers to Safe List
  • Under the Custom Scan box paste this in
    /md5start
    iaStor.sys
    nvstor.sys
    atapi.sys
    nvata.sys
    iastorv.sys
    /md5stop
• Press Run Scan to start the scan.
• When finished, the file will be saved in drive C:\OTL.txt
• Copy this file to your USB drive if you do not have internet connection on this system
• Please post the contents of the C:\OTL.txt file in your reply.

Just checking to see if you have any questions about making the boot CD. Please let me know if you don't understand or are having trouble with any of the instructions.

Reminder: Threads with no replies after 4 days are closed.

Hi there.

My apologies for the slow response- study and other commitments meant that I couldn't get back to you earlier than this.

A friend of mine managed to sort it all for me 1st by making me a boot cd and also managing to access past the security login for my ibm. thereafter,using
http://www.precisesecurity.com/popup/troja…2-keyloggergen/

and some other things to ensure it was properly removed.

Thankfully, it has worked and my laptop is back to normal.

Could I just take this opportunity to say a big thank you for all your help.

I'm glad you were able to get the machine booted and working. While following the directions you linked to may have removed the immediate problem, there could be some remaining files hanging around, or the infection could have also dropped other malware on your machine that may not have been addressed. Absence of symptoms does not mean the machine is free from malware. I would be more than happy to take a look at an OTL and GMER log to make sure there doesn't appear to be anything else that needs to be addressed. If you wish for me to do this, you may follow the original OTL and GMER instructions, and run them in normal mode (not safe mode). If I don't hear from you in 2 days, the thread will be closed.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.