Need help removing tr\crypt.xdr.gen trojan!

Excellent, let me know how you make out with those scans.

damnit… i just got back and saw the results of my avira scan.. it found 5 things, here they are:

http://img444.imageshack.us/img444/2372/recentavirascan.jpg

and i tried to run a kaspersky scan before this, and it wouldnt scan. gave me some error after downloading all the definition files.. im gonna hit apply now which should delete these in avira, but something tells me its not gonna work… so ill wait for you to tell me what to do. in the mean time ill keep trying the kaspersky to see if i can get that to work.

damnit… i just got back and saw the results of my avira scan.. it found 5 things, here they are:

No need to panic. If you look closely at those files, the first 3 we took care of with OTM, and are likely in the OTM quarantine, which we'll clear out at the end. The 4th file has a .vir extension, so one of the Anti-Malware tools you've run renamed it and it's harmless. It should be deleted though. And the last is one of the HijackThis backups from when you must have done an earlier fix. That can be removed too.

So, nothing to worry about there I don't think.

ahhh!!! thats great news! also, here is the error i am getting from kaspersky. i dont know why its doing this now. i was able to run the scan first try with no problems. any ideas why its doing this?

http://img64.imageshack.us/img64/6259/kasp…cannererror.jpg

Not sure why it won't update? You are online right?

We can try another scanner.

Eset Online Scanner
Run with Internet Explorer

• Place a check mark in the box YES, I accept the Terms Of Use
• Click the Start button.
• Now click the Install button, or click the notification bar at the top of the window and choose to install.
• Click Start. The scanner engine will initialize and update.
• Do Not place a check mark in the box beside Remove found threats.
• Click the Scan button. The scan will now run, please be patient.
• When the scan finishes click the Details tab.
• Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

heres the log from the ESET online scanner. C:\System Volume Information\_restore{66ABE82F-A2AB-447C-86AE-FD32BF3D1C4C}\RP1\A0000181.dll a variant of Win32/Cimag.CV trojan C:\System Volume Information\_restore{66ABE82F-A2AB-447C-86AE-FD32BF3D1C4C}\RP1\A0000182.exe Win32/Agent.QNF trojan C:\System Volume Information\_restore{66ABE82F-A2AB-447C-86AE-FD32BF3D1C4C}\RP1\A0000183.exe a variant of Win32/Cimag.CV trojan C:\System Volume Information\_restore{66ABE82F-A2AB-447C-86AE-FD32BF3D1C4C}\RP1\A0000184.dll Win32/Adware.PCProtector.D application C:\System Volume Information\_restore{66ABE82F-A2AB-447C-86AE-FD32BF3D1C4C}\RP1\A0000200.dll a variant of Win32/Adware.Lifze.M application C:\_OTM\MovedFiles\07012010_115724\C_WINDOWS\system32\tjxrt.dll a variant of Win32/Adware.Lifze.M application

Nothing too bad there. Uninstalling combofix will clear the restore points, and we'll remove OTM's files too.

Uninstall Combofix

• Click START then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.

The above procedure will:

• Delete the following: ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

Uninstall OTM and related files/folders

• Make sure you have an Internet Connection.
• Double-click OTM.exe to run it.
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTM to rech the Internet, please allow the application to do so.
• Click Yes to beging the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Download Security Check by screen317 from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Give me an update on how it's running too please.

ok, just uninstalled both the combofix and OTM with no problems. as far as how my computer is running, it is running a billion times better! but i am still nervous about logging into my online banking/facebook/other websites until i can be sure my computer is 100% clean. here is my checkup scan results:


Results of screen317's Security Check version 0.99.4
Windows XP Service Pack 3
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
Avira AntiVir Personal - Free Antivirus
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Ad-Aware
Malwarebytes' Anti-Malware
HijackThis 2.0.2
Java™ 6 Update 14
Out of date Java installed!
Adobe Flash Player
Adobe Reader 9.1
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

I would suggest you run Windows Update and let it install all important updates.

Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!

Just need to check and make sure the service is running and set to start properly. It may be fine.

Click Start the Run…
Type in services.msc
Scroll down the list until you find Security Center, and make sure the start up type is Automatic (delayed)
If it is not started, then please start it.

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "Java Runtime Environment (JRE) 6u20 allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.

Adobe Reader needs updating too.

http://www.adobe.com/support/downloads/detail.jsp?ftpID=4607

*******************

but i am still nervous about logging into my online banking/facebook/other websites until i can be sure my computer is 100% clean

I'm not sure you can ever be 100 percent sure. I think maybe 99%+ is about is good as it gets and I think you're pretty much there. Certainly in much better shape then when you came here.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure.

In addition to updating and using what you currently have you may want to consider the following:

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some free and evalutation versions that provide
better security than the Windows Firewall.Online-Armor
Outpost Firewall
For a tutorial on Firewalls and a listing of some other available ones see the link below:
Understanding and Using Firewalls

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install Winpatrol -
Use Winpatrol to take control of your PC and provide another layer of security.
Help file and tutorial can be found Here

Block unwanted parasites with a custom hosts file -
http://www.mvps.org/winhelp2002/hosts.htm

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Keep your applications up to date -
Use Secunia Personal Software Inspector to help stay on top of application updates that could leave your PC vulnerable to attack.

I'll leave the thread open a few days in case you have questions or issues.

Regards,
Dave

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.