What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Freezing & Black Screen - 2 Trojans found - Please help!

60 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

The other day I was on my computer, as usual, when all the sudden my computer froze. I couldn't do anything at all so I shut it down, well, i turned it off. When I turned it back on all I got was a black screen. I tried it a few times but kept getting a black screen. I had "backed up" my computer a couple weeks ago (as i do every couple weeks or so) using Macrium Reflect. When i first used Macrium, about 8 months ago, it had me make a Windows Boot disc. I put in the Windows Boot disc and was able to get my computer back up running but its slow and programs still freeze. I have Spyware Terminator, and I did a virus scan (i do a scan every day or more and it was fine the day before) and it came back telling me that I had a Trojan (I believe it was called GenericFF-1) that looked like it was in a few different places- about 10 or so files, some of which were–, (about 4 files in) System Volume Information\_restore_a bunch of numbers .exe & .rbf, (the rest were in files like) – OS\ROOT\XP_Pro_ENG(D)\I386\System32\SMSS.EXE, cmdcons\System32\SMSS.EXE, Windows\Erdnt\cache\explorer.exe, Windown\$hf_mig$\KB956572\SP3DR\pdh.dll, Desktop\my downloads\openofficeorg32(en-us)Installation files\redist\vcredist_x86.exe, All users\Start Menu\Programs\Accessories\System tools\Activate Windows.Ink and Windows\Installer\14ac6ec.msi. I just remembered that I moved those into Quarantine so I could get on the internet to get some help. I did another scan today and now it says I have 2 Trojans…. the first is "GenericFF-1" (I think its the same one that it said I had in the other scan, the one i put in quarantine) and it looks like its in about 5 of my System Volume Info. _restore files, the other is "Fakesec" and at first it looked like it was in a lot of my Gimp program files, since i don't use the Gimp program to much I decided to uninstall it hoping that would get rid of at least the one Trojan. I went into add/remove programs and removed it that way. Then I did another Spyware Terminator Virus scan and I still have the same 2 Trojans except the Fakesec Trojan that was in the Gimp files now moved into over 100 of my restore files. So, I still have both Trojans. I did a Spybot Search and Destroy scan and also a Malwarebytes scan but neither of them picked up the Trojans and said nothing was found.
I downloaded that DDS to get the reports but when I went to run the scan, it froze and then I couldn't close it. I opened the DDS again (with the other still opened, since it wouldn't close but it wasn't doing anything since it was frozen, I hope that's ok cuz its the only way I could do it) and did the scan but it only gave me 1 report, which is below –

DDS (Ver_10-12-12.02) - NTFSx86
Run by [removed] at 16:38:13.31 on Fri 02/04/2011
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_23
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.565 [GMT -5:00]

AV: Spyware Terminator *Enabled/Updated* {55EE49A8-16BE-4601-BBE6-607B7F7317DE}

============== Running Processes ===============

G:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
G:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
svchost.exe
G:\WINDOWS\system32\inetsrv\inetinfo.exe
G:\Program Files\Java\jre6\bin\jqs.exe
G:\WINDOWS\system32\lxctcoms.exe
G:\Program Files\CDBurnerXP\NMSAccessU.exe
G:\Program Files\Macrium\Reflect\ReflectService.exe
G:\WINDOWS\System32\snmp.exe
G:\Program Files\Spyware Terminator\sp_rsser.exe
G:\Program Files\System Protect\SysProtect_srv.exe
G:\WINDOWS\system32\svchost.exe -k imgsvc
G:\WINDOWS\system32\SearchIndexer.exe
G:\WINDOWS\system32\igfxtray.exe
G:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
G:\Program Files\System Protect\SysProtect_Tray.exe
G:\Program Files\Lexmark 5400 Series\lxctmon.exe
G:\Program Files\Common Files\Java\Java Update\jusched.exe
G:\Program Files\Lexmark 5400 Series\ezprint.exe
G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
G:\Program Files\Messenger\msmsgs.exe
G:\WINDOWS\system32\ctfmon.exe
G:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
G:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
G:\Program Files\Windows Desktop Search\WindowsSearch.exe
G:\WINDOWS\System32\svchost.exe -k HTTPFilter
G:\Documents and Settings\Administrator\Local Settings\Temp\793.tmp\MBR.DAT
G:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.crawler.com/?tbid=60347
uURLSearchHooks: N/A: {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - g:\progra~1\crawler\toolbar\ctbr.dll
BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - g:\program files\lexmark toolbar\toolband.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - g:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: : {1cb20bf0-bbae-40a7-93f4-6435ff3d0411} - g:\progra~1\crawler\toolbar\ctbr.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - g:\progra~1\spybot - search & destroy\SDHelper.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\roboform.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - g:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - g:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Crawler Toolbar: {4b3803ea-5230-4dc3-a7fc-33638f3d3542} - g:\progra~1\crawler\toolbar\ctbr.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\roboform.dll
TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - g:\program files\lexmark toolbar\toolband.dll
uRun: [SpywareTerminatorUpdate] "g:\program files\spyware terminator\SpywareTerminatorUpdate.exe"
uRun: [OnlineVault] "g:\program files\online vault\OnlineVault.exe" /startup
uRun: [SpybotSD TeaTimer] g:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MSMSGS] "g:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] g:\windows\system32\ctfmon.exe
uRun: [RoboForm] "g:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
mRun: [IgfxTray] g:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] g:\windows\system32\hkcmd.exe
mRun: [SpywareTerminator] "g:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [SystemProtect] g:\program files\system protect\SysProtect_Tray.exe
mRun: [lxctmon.exe] "g:\program files\lexmark 5400 series\lxctmon.exe"
mRun: [Lexmark 5400 Series Fax Server] "g:\program files\lexmark 5400 series\fm3032.exe" /s
mRun: [LXCTCATS] rundll32 g:\windows\system32\spool\drivers\w32x86\3\LXCTtime.dll,_RunDLLEntry@16
mRun: [SunJavaUpdateSched] "g:\program files\common files\java\java update\jusched.exe"
mRun: [EzPrint] "g:\program files\lexmark 5400 series\ezprint.exe"
mRun: [Adobe Reader Speed Launcher] "g:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "g:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: g:\docume~1\alluse~1\startm~1\programs\startup\microsoft works calendar reminders.lnk - g:\program files\common files\microsoft shared\works shared\wkcalrem.exe
StartupFolder: g:\docume~1\alluse~1\startm~1\programs\startup\windows search.lnk - g:\program files\windows desktop search\WindowsSearch.exe
mPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: NoFileAssociate = 0 (0x0)
mPolicies-system: NoDispSettingsPage = 0 (0x0)
IE: Crawler Search - tbr:iemenu
IE: Customize Menu - file://g:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - g:\progra~1\microsoft office\office12\EXCEL.EXE/3000
IE: Fill Forms - file://g:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://g:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://g:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - g:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - g:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - g:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FA32182A-EA44-4583-803B-AA827F0D4E06} - g:\progra~1\online~2\ONLINE~1.EXE
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - g:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - g:\progra~1\spybot - search & destroy\SDHelper.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1275797429265
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - g:\progra~1\crawler\toolbar\ctbr.dll
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - g:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - g:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - g:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\avpujchl.default\
FF - component: g:\documents and settings\administrator\application data\mozilla\firefox\profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\FFExternalAlert.dll
FF - component: g:\documents and settings\administrator\application data\mozilla\firefox\profiles\avpujchl.default\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}\components\RadioWMPCore.dll
FF - component: g:\progra~1\crawler\firefox\components\xcomm.dll
FF - component: g:\progra~1\crawler\firefox\components\xshared.dll
FF - component: g:\progra~1\crawler\firefox\components\xsupport.dll
FF - component: g:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: g:\documents and settings\administrator\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: g:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: g:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: g:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - g:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - g:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - g:\progra~1\crawler\toolbar\firefox
FF - Ext: Java Quick Starter: [removed] - g:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: AI Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - g:\program files\siber systems\ai roboform\Firefox
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: PriceBlink: [removed] - %profile%\extensions\[removed]
FF - Ext: United States English Spellchecker: [removed] - %profile%\extensions\[removed]
FF - Ext: Free TV Bar c3 Toolbar: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3} - %profile%\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
FF - Ext: Amazon Wish List: [removed] - %profile%\extensions\[removed]
FF - Ext: Christmas Boom: [removed] - %profile%\extensions\[removed]
FF - Ext: Surf Canyon - Search Engine Assistant: {75623d5d-4683-402a-b610-ac4bab767c86} - %profile%\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false

============= SERVICES / DRIVERS ===============

R0 pssnap;Paramount Software Snapshot Filter;g:\windows\system32\drivers\pssnap.sys [2010-9-28 15328]
R1 sp_rsdrv2;Spyware Terminator Driver 2;g:\windows\system32\drivers\sp_rsdrv2.sys [2010-6-5 142592]
R2 ReflectService;Macrium Reflect Image Mounting Service;g:\program files\macrium\reflect\ReflectService.exe [2010-9-28 220128]
R2 SP_Service;System Protect Deletion Prevention Service;g:\program files\system protect\SysProtect_srv.exe [2010-6-5 598528]
R3 sp_prot;System Protect Filter Driver;g:\windows\system32\drivers\sp_prot.sys [2010-6-5 12288]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;g:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 cpudrv;cpudrv;g:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
S3 DfSdkS;Defragmentation-Service;g:\program files\ashampoo\ashampoo winoptimizer 2010 advanced\DfSdkS.exe [2010-6-20 406016]
S3 PSMounter;Macrium Reflect Image Explorer Service;g:\windows\system32\drivers\psmounter.sys [2010-9-28 44512]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;g:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================


==================== Find3M ====================

2010-12-13 20:14:51 103720 —-a-w- g:\documents and settings\administrator\GoToAssistDownloadHelper.exe
2010-11-18 18:12:44 81920 —-a-w- g:\windows\system32\isign32.dll
2010-11-12 23:53:06 472808 —-a-w- g:\windows\system32\deployJava1.dll
2010-11-12 21:34:10 73728 —-a-w- g:\windows\system32\javacpl.cpl
2010-11-09 14:52:35 249856 —-a-w- g:\windows\system32\odbc32.dll
2010-11-08 05:13:25 796672 —-a-w- g:\windows\GPInstall.exe

============= FINISH: 16:38:46.78 ===============


I'm not sure if I should take those one's out of quarantine or if I should leave them in there or if I should delete them. Could you please tell me what I should do, please? I had to put them in Quarantine or I couldn't get on the internet but if you give me something to get rid of the viruses I should probably take them out so I can get rid of the viruses in those file, too, right? Are they important files that I really need ( they look like they probably are) but if they aren't should I just delete them? I don't want to do anything without knowing what to do because I don't want to mess my computer up even more. If you could please help me, I would really, really appreciate it.

Thank you very much,

Candi
Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, Candi

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

We are sorry for the late response as the forum helpers are busy. Before we get to use any tools, I need another diagnosis of your computer to get a different view of it.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

—————————————————————————————————

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

—————————————————————————————————
Post #3
Hello again, Thanks so much for getting back to me. I downloaded GMER file, first I did the first one (not the zip one), when I clicked on the GMER icon on my desktop a box would come up and the only option I had was to click "run" so, I did that but it almost seemed like it started to do a scan, then it would stop. I tried to unclick the boxes it asked me to in the directions but then it would freeze and say "Not Responding" at the top and I couldn't get it to do anything at all, including getting it to close. I would have to shut my computer down and reboot it to get it to close or go away. I then downloaded the zip version hoping that would be different, I extracted the file to my desktop, then clicked on the icon, but the same thing happened, it would open it and it would seem like a scan was starting, then it would stop, I would try to uncheck the boxes but when I went to do that, I couldn't and the "Not Responding" came up again at the top. I'm not sure what to do and I'm sorry for all the problems. Oh also, I guess I should have mentioned this before but my hard drive or the places where my programs are stored isn't in the C: drive like most computers, mine is in the G: - I don't know if that makes any difference or not but thought I should let you know. I realized that because when I went to uncheck those couple boxes in that GMER program, the G:\ drive was listed there. Thanks so much for all your help! Candi
Post #4 last edited
Hello,

First of all, thank you for your detailed information.

When you download GMER, you could actually right-click the link above and select save link as to save it on your desktop.

As for getting GMER running, it is actually quite normal for the program to turn to Not Responding on certain computers and there is one another way we can use to have it running before we give another tool a try.

Anyway, you don't have to feel sorry for the problems because we understand the frustrations that you are going through and this is what we are here for. :)

I need you to try and check only both "Sections" and "G:\" ; leaving all others unchecked.

If that fails, please try to run it in Safe Mode and again with the same settings as above.

Reboot your computer in Safe Mode
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Tutorial if you need it How to boot into Safemode
Post #5
Hello again, Thanks for understanding and for all your help! I tried what u said and right clicked the link and saved to my desktop but it still did the same thing. After I right clicked and saved to my desktop, it downloaded, I double clicked on the Gmer icon on my desktop, a box came up and the only option there was to click "run". I clicked "run" and it opened Gmer but as soon as it opened, it started scanning but only for a couple seconds then it stopped, I tried to uncheck the boxes, except for the ones specified, but again as soon as i tried to click on a box, again the "Not Responding" came up and I wasn't able to do anything….. I couldn't uncheck any boxes and I couldn't close out of the program. I also tried Gmer in Safe Mode but the same thing happened, except when Gmer opened and it started scanning it was just a blank page ( a tan colored page with about a half inch blue line across the top ). When it started scanning there were what looked like some files it was scanning thru, but it only lasted a few seconds and stopped just like in regular mode. When it stopped, the Not Responding came up on the top again just like in regular mode and I couldn't do anything there either, but with a blank page i guess there isn't anything to do any way….lol. I couldn't close out of Gmer in Safe Mode either. I think once before when I had a virus, someone there had me use that Gmer program…. because it sounds and looks really familiar, but when I used it before, I was actually able to use it. So, I wonder if the Trojans I have are keeping it from working right. I dunno, just a guess. I'm sorry it didn't work, i wish it would have.
Post #6
Ok, let's use another tool then.

Scan With RootKitUnHooker

  • Please choose one link and download Rootkit Unhooker and save it to your desktop.
    Link 1
    Link 2
    Link 3
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"
Post #7
Ok, finally able to get something to work. I ran the Rootkit Unhooker scan, I unchecked all but Drivers and Stealth (left those checked as directed) but it never asked me to select any disk drives. The scan ran and here is the report………. RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #1 ============================================== >Drivers ============================================== 0x804D7000 G:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2189952 bytes 0x804D7000 RAW 2189952 bytes 0x804D7000 WMIxWDM 2189952 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 G:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xBF06B000 G:\WINDOWS\System32\ialmdd5.DLL 905216 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology) 0xF719E000 G:\WINDOWS\system32\DRIVERS\ialmnt5.sys 811008 bytes (Intel Corporation, Intel Graphics Miniport Driver) 0xF7304000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xF7081000 G:\WINDOWS\system32\drivers\smwdm.sys 548864 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio ) 0xEE005000 G:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xEE10D000 G:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xED527000 G:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBFFA0000 G:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xED036000 G:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xF6FE9000 G:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF7448000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xED647000 G:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF72D7000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xBF03F000 G:\WINDOWS\System32\ialmdev5.DLL 180224 bytes (Intel Corporation, Component GHAL Driver) 0xECA15000 G:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xEE075000 G:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF713E000 G:\WINDOWS\system32\DRIVERS\e1000325.sys 163840 bytes (Intel Corporation, Intel® PRO/1000 Adapter NDIS 5.1 deserialized driver) 0xEE0E5000 G:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF73F2000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xEDFDF000 G:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xF705D000 G:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF7166000 G:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF7107000 G:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xEE0A0000 G:\WINDOWS\system32\drivers\sp_rsdrv2.sys 143360 bytes (-, -) 0xEE0C3000 G:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806EE000 ACPI_HAL 131840 bytes 0x806EE000 G:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF73BA000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF7418000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xBF020000 G:\WINDOWS\System32\ialmdnt5.dll 126976 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver) 0xF72BD000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF73DA000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xEDF9F000 G:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF7391000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF7046000 G:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xEDB52000 G:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF712A000 G:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xF718A000 G:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xEE166000 G:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 G:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF73A8000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF7437000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF7035000 G:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF7587000 G:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF7687000 G:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xF7667000 G:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF76A7000 G:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF7697000 G:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xEDDEF000 G:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF7517000 G:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xBF012000 G:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver) 0xF74D7000 G:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF7657000 G:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF76B7000 G:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF74B7000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF76D7000 G:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF7547000 G:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF7677000 G:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF74A7000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF76C7000 G:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF7497000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF7707000 G:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF74E7000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF76F7000 G:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF74C7000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF7567000 G:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xF7647000 G:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF76E7000 G:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF7537000 G:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xED85C000 G:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF7557000 G:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF77F7000 G:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF77D7000 G:\WINDOWS\system32\drivers\sp_prot.sys 32768 bytes (-, -) 0xF77FF000 G:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver) 0xF779F000 G:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF77A7000 G:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xF7817000 G:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xF7717000 G:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF7727000 pssnap.sys 28672 bytes (Macrium Software, Backup image protection) 0xF7807000 G:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver) 0xF780F000 G:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xF77AF000 G:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF77B7000 G:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF7797000 G:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF77E7000 G:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF77EF000 G:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF771F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF77C7000 G:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF77CF000 G:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF77BF000 G:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF781F000 G:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF795F000 G:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xEDEA3000 G:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xF793B000 G:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xF7268000 G:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver) 0xF78A7000 G:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF7933000 G:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF7264000 G:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xF7943000 G:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF7993000 G:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF79B5000 G:\WINDOWS\system32\drivers\aeaudio.sys 8192 bytes (Andrea Electronics Corporation, Andrea Audio Stub Driver) 0xF79BF000 G:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF799D000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xF79C5000 G:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF79BD000 G:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF799B000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0xF7997000 G:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF79C1000 G:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF79CB000 G:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver) 0xF79C3000 G:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF79B7000 G:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF79B9000 G:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7999000 G:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7BE9000 G:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xF7ACB000 G:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7BC4000 G:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7A5F000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== Thanks again!
Post #8
Hi,

Please read through these instructions to familarize yourself with what to expect when this tool runs


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

    Regarding AVG - Due to recent changes in AVG and how it interacts with ComboFix, before running ComboFix, AVG must be uninstalled via Start>Control Panel>Add or Remove programs panel.

    If you have difficulty uninstalling AVG, download Opswat AppRemover for AVG. The download for the AVG uninstaller can be found here > http://www.appremover.com/appremover/avg/AppRemover.exe

    **********************************************
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #9
Hello again, I disabled my Spyware Terminator Virus protection and I downloaded the ComboFix from the first link. It downloaded to my desktop. I double clicked on the ComboFix and a message box came up telling me that there was a newer or updated version of ComboFix and asked me if I would like to use that. I clicked no because I wasn't sure what to do and there wasn't anything in the directions about that. It then opened a smaller blue screen with white writing and another box (a long tan box) came up and it looked like it started scanning. There were 2 bars that started to fill as it was scanning, the top got about half way and the bottom got a little over half way (I think it said something like 9 out of 11 files on the bottom one) then it seemed to just stop and that long tan box went away. In the box with the blue screen with white writing it said it was scanning and that it shouldn't take more than 10 minutes but on badly infected computers it could take twice as long. It didn't look or sound like it was doing anything but I let it sit there for over a half hour. It still wasn't doing anything another half hour later (over an hour now) so I clicked on the X to close it but it wouldn't close. It was frozen. It seemed to do the same thing or almost the same thing as that Gmer program, it would start but only do a little then freeze. I had to shut my computer down to be able to do anything and to get ComboFix to close/go away. I booted back up and tried the ComboFix scan again, the same thing happened. I shut down and tried again but this time I did the update for ComboFix but that didn't do any good because it still did the same thing, would start and then freeze. I was going to try and download the ComboFix from the second link but wasn't sure if I needed to uninstall or delete the ComboFix I have on my desktop now or what I should do. I figured, I better not do anything and let you know what happened and check with you as to what I should do next. I'm really sorry about all the problems!
Post #10
To update Combofix, all you have to do is to delete the exiting copy of it (i.e. the icon) and download a new one and try running it again. When you got it to run, try leaving it for a few hours or so or even overnight. Let me know how it turns out.
Post #11
Hi, Ok, I deleted the ComboFix on my desktop I downloaded from the first link. I downloaded ComboFix from the second link but that didn't do any good. It did the same thing. It opened and started to scan and then just stopped. After a little bit the "Not Responding" came up at the top. I let it sit over night just to be sure but it didn't do anything else. I'm sorry! I was hoping it would work but it didn't. Not sure what to do. Thanks again for all your help and sorry that my computer is being so difficult. Is there something else that might work or am I doing something wrong? Thanks again.
Post #12
Ok, let's try this.

Please read carefully and follow these steps.
Post #13
Ok, I downloaded TDSSKiller, extracted to desktop and followed the rest of the directions but when it did the scan (and it actually went all the way thru the scan, I can't believe it….lol) but it didn't find anything. And I guess since it didn't find anything, I didn't have to do anything. But, when I turned my Spyware Terminator Virus protection back on and it did a full scan, those 2 Trojans still showed up ( they were the Trojan.GenericFF-1 & Trojan.Fakesec-310) And now there is another one and that one is Trojan.Agent-194410 and it looks like that one is in a file in my Program Files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\rmchart.dll. Thanks again!
Post #15
Hello,

I hope you had a nice weekend! I did as you asked and redownloaded the CF and renamed it conspirecf but I had the same problem, it would start to do the scan and then just stop & freeze. I tried leaving it overnight again but it wouldn't do any more, just stayed frozen and not finish. After trying to run Combofix or conspirecf and leaving it overnight, I tried closing it but again it wouldn't close, I was going to shut down my computer to get it to close but I got called out of the room. When I came back in, I was thinking that I rebooted my computer and I opened ComboFix/conspirecf again. The other one was minimized and I didn't see it, but it was stopped/frozen any way. When ComboFix opened it started to scan and this time it went thru the whole scan……. I couldn't believe it. I included the report/log below.
After ComboFix/conspirecf finished and closed I looked over the report but didn't see anything about those viruses/trojans (GenreicFF-1 & Fakesec-310) or any of the system volume info/restore files that were infected. So, I turned my Spyware Terminator Virus protection back on and did another scan. The scan showed that the GenericFF-1 and Fakesec-310 trojans/viruses are still there. The other one, that Agent trojan/virus one that was in one file was gone but the other one's are still showing there. They are all in system volume info./restore files ending with .exe or .dll. There is also whats called a threat level with 5 boxes in a row in the upper right corner of the Spyware Terminator virus protect. scan report, I guess to show how much of a threat the virus is. For both the GenericFF-1 & Fakesec-310 – 3 of those 5 boxes are colored in red. I'm not sure if this is anything you needed to know but I thought I would tell you in case. Also I'm not sure why that Kapersky (sp?) scan and Combofix didn't find them. When I ran the Spybot search & destroy and Malwarebytes nothing came up on those scans either. It seems only the Spyware Terminator Virus protection is the only one finding them.
Any way, here is the ComboFix/conspirecf report ……………………..

ComboFix 11-02-12.02 - Administrator 02/13/2011 10:14:46.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.564 [GMT -5:00]
Running from: g:\documents and settings\[removed]\Desktop\conspirecf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

g:\documents and settings\Administrator\g2mdlhlpx.exe
g:\documents and settings\Administrator\GoToAssistDownloadHelper.exe

.
((((((((((((((((((((((((( Files Created from 2011-01-13 to 2011-02-13 )))))))))))))))))))))))))))))))
.

2011-02-13 08:01 . 2011-02-13 15:09 ——– d—–w- G:\conspirecf
2011-02-10 00:20 . 2011-02-10 00:20 ——– d—–w- g:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2011-02-07 18:56 . 2011-02-07 18:56 ——– d—–w- g:\documents and settings\Administrator\Application Data\Apple Computer
2011-02-07 16:48 . 2011-02-07 16:48 ——– d—–w- g:\documents and settings\All Users\Application Data\Apple Computer
2011-02-07 16:48 . 2011-02-07 16:48 ——– d—–w- g:\program files\Common Files\Apple
2011-02-07 16:47 . 2011-02-07 16:47 ——– d—–w- g:\documents and settings\Administrator\Local Settings\Application Data\Apple
2011-02-07 16:47 . 2011-02-07 16:47 ——– d—–w- g:\program files\Apple Software Update
2011-02-07 16:47 . 2011-02-07 16:47 ——– d—–w- g:\documents and settings\All Users\Application Data\Apple
2011-02-07 16:47 . 2011-02-07 16:47 ——– d—–w- g:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2011-01-30 19:57 . 2011-01-30 19:57 103864 —-a-w- g:\program files\Mozilla Firefox\plugins\nppdf32.dll
2011-01-30 19:57 . 2011-01-30 19:57 103864 —-a-w- g:\program files\Internet Explorer\PLUGINS\nppdf32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-03 05:29 . 2010-06-12 22:54 15104 —-a-w- g:\windows\system32\drivers\usbscan.sys
2010-12-20 23:09 . 2010-08-25 03:34 38224 —-a-w- g:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2010-08-25 03:34 20952 —-a-w- g:\windows\system32\drivers\mbam.sys
2010-11-29 22:38 . 2010-11-29 22:38 94208 —-a-w- g:\windows\system32\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 —-a-w- g:\windows\system32\QuickTime.qts
2010-11-18 18:12 . 2010-06-05 04:33 81920 —-a-w- g:\windows\system32\isign32.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpywareTerminatorUpdate"="g:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2010-06-05 3037696]
"OnlineVault"="g:\program files\Online Vault\OnlineVault.exe" [2010-05-28 2459136]
"SpybotSD TeaTimer"="g:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"RoboForm"="g:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-10-29 160328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="g:\windows\system32\igfxtray.exe" [2006-05-25 155648]
"HotKeysCmds"="g:\windows\system32\hkcmd.exe" [2006-05-25 126976]
"SpywareTerminator"="g:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-06-05 2176512]
"SystemProtect"="g:\program files\System Protect\SysProtect_Tray.exe" [2010-06-05 1223680]
"lxctmon.exe"="g:\program files\Lexmark 5400 Series\lxctmon.exe" [2007-03-19 291760]
"Lexmark 5400 Series Fax Server"="g:\program files\Lexmark 5400 Series\fm3032.exe" [2007-03-19 304048]
"LXCTCATS"="g:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll" [2006-11-21 106496]
"SunJavaUpdateSched"="g:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"EzPrint"="g:\program files\Lexmark 5400 Series\ezprint.exe" [2007-03-19 82864]
"Adobe Reader Speed Launcher"="g:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="g:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="g:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

g:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Works Calendar Reminders.lnk - g:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-6-29 24633]
Windows Search.lnk - g:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "g:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKLM\~\startupfolder\G:^Documents and Settings^Administrator^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]
path=g:\documents and settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
backup=g:\windows\pss\ERUNT AutoBackup.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"g:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"g:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"g:\\WINDOWS\\system32\\lxctcoms.exe"=

R0 pssnap;Paramount Software Snapshot Filter;g:\windows\system32\drivers\pssnap.sys [9/28/2010 9:40 AM 15328]
R1 sp_rsdrv2;Spyware Terminator Driver 2;g:\windows\system32\drivers\sp_rsdrv2.sys [6/5/2010 3:09 AM 142592]
R2 ReflectService;Macrium Reflect Image Mounting Service;g:\program files\Macrium\Reflect\ReflectService.exe [9/28/2010 9:40 AM 220128]
R2 SP_Service;System Protect Deletion Prevention Service;g:\program files\System Protect\SysProtect_srv.exe [6/5/2010 3:21 AM 598528]
R3 sp_prot;System Protect Filter Driver;g:\windows\system32\drivers\sp_prot.sys [6/5/2010 3:21 AM 12288]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;g:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 12:16 PM 130384]
S3 cpudrv;cpudrv;g:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 9:58 AM 11336]
S3 DfSdkS;Defragmentation-Service;g:\program files\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\DfSdkS.exe [6/20/2010 3:53 AM 406016]
S3 PSMounter;Macrium Reflect Image Explorer Service;g:\windows\system32\drivers\psmounter.sys [9/28/2010 9:40 AM 44512]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;g:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 12:16 PM 753504]
.
Contents of the 'Scheduled Tasks' folder

2011-02-10 g:\windows\Tasks\AppleSoftwareUpdate.job
- g:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2011-02-12 g:\windows\Tasks\WGASetup.job
- g:\windows\system32\KB905474\wgasetup.exe [2010-06-06 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.crawler.com/?tbid=60347
IE: Crawler Search - tbr:iemenu
IE: Customize Menu - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - g:\progra~1\Microsoft Office\Office12\EXCEL.EXE/3000
IE: Fill Forms - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://g:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
IE: {{FA32182A-EA44-4583-803B-AA827F0D4E06} - g:\progra~1\ONLINE~2\ONLINE~1.EXE
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - g:\progra~1\Crawler\Toolbar\ctbr.dll
FF - ProfilePath - g:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\avpujchl.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - g:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - g:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - g:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - g:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - g:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - g:\progra~1\Crawler\Toolbar\firefox
FF - Ext: Java Quick Starter: [removed] - g:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: AI Roboform Toolbar for Firefox: {22119944-ED35-4ab1-910B-E619EA06A115} - g:\program files\Siber Systems\AI RoboForm\Firefox
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: PriceBlink: [removed] - %profile%\extensions\[removed]
FF - Ext: United States English Spellchecker: [removed] - %profile%\extensions\[removed]
FF - Ext: Free TV Bar c3 Toolbar: {3ee8d0be-f450-4ef2-97b9-ac2222d14db3} - %profile%\extensions\{3ee8d0be-f450-4ef2-97b9-ac2222d14db3}
FF - Ext: Amazon Wish List: [removed] - %profile%\extensions\[removed]
FF - Ext: Christmas Boom: [removed] - %profile%\extensions\[removed]
FF - Ext: Surf Canyon - Search Engine Assistant: {75623d5d-4683-402a-b610-ac4bab767c86} - %profile%\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.blink_allowed - true
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-02-13 10:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCTCATS = rundll32 g:\windows\System32\spool\DRIVERS\W32X86\3\LXCTtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Environment*]
"Licence0"="04F0D21-79D8-7A25-D702-433F"
.
Completion time: 2011-02-13 10:22:25
ComboFix-quarantined-files.txt 2011-02-13 15:22

Pre-Run: 88,284,971,008 bytes free
Post-Run: 88,276,373,504 bytes free

- - End Of File - - ACB93F0DD0A7CA4BEC762F256BC06556


P.S. Also, I was wondering if I still need all those other things you had me try like that Gmer, DDS, Rootkit unhooker or something like that) and Tdss killer. If I don't need them any more, since they didn't work any way, can I delete or uninstall them? If I can, do I just delete them or do I have to uninstall them thru the add and remove program files?

Thanks so much again for all your help, I really do appreciate it!!! And, I'm really sorry my computer had been so stubborn.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI