Internet Security 2010 trojan/virus

My post for help started at http://forums.whatthetech.com/index.php?sh…mp;#entry726468

I am trying to fix my mother's laptop. Her problems began the other day, as she tried to open IE a security warning popped up saying something about "XP Internet Security 2010." She clicked on the "X" to close the pop up box. IE wouldn't load after wards…every attempt caused the security warning to pop up. My mom ran AVG and it reported the system was "clean". She opened FF googled the security warning and found something about "Troj-BNK.Win32.keylogger.gen". She checked the registry and found registry key referencing to app\data\gng.exe and hkcr\exefile\shell\open\command\\. She ran AVG again and it found the Trojan and quarantined it. Then her computer froze. She tried rebooting the computer but it never shut down completely. The screen went black but the green light remained on. She removed the battery pack and replaced it after 30 seconds. When the computer would only boot to a black screen she inserted disc 1 of her rescue discs. The computer is now up and running at and Avg virus scanned the system but didn't find any infections. The system is getting hung up whenever we reboot. Please help me figure out if the computer is clean or infected. Any help is very much appreciated.

Her computer info: HP Compact NC6400 Manager's Edition, XP Pro SP2

http://forums.whatthetech.com/index.php?sh…18213&st=15

Is the issue fixed?

..I do not know if the virus is gone. AVG has not shown anything in the virus scans, however, I have noticed that the tray icons are a bit pixelated…could this be caused by a virus?

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.


Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.


If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.



Please do not delete anything unless instructed to.


I've been seeing some Java infections lately.

Go here and follow the instructions to clear your Java Cache
http://www.java.com/en/download/help/plugin_cache.xml


Next:
Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  [external image: Posted Image]
• When the scan is complete, click OK, then Show Results to view the results.
• [external image: Posted Image]
• Then click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".

I can't print the instructions as I no longer have any drivers or anything recognizable by the system for the printer/scanner Epson Stylus NC200. I went to their website, dwnld the newest file of the complete drivers, etc…installed it…but nothing.. I no longer even show a Java folder in the Control panel… (thanks for your help)

Just run the MBAM scan then.

OK

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6446 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 4/26/2011 1:47:57 AM mbam-log-2011-04-26 (01-47-57).txt Scan type: Quick scan Objects scanned: 131600 Time elapsed: 2 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

It didn't take but a few seconds to reboot, the computer seems to be running OK. Question: Windows updates want to install Service Pack 3. Has there been any reported issues by those who have?

It didn't take but a few seconds to reboot, the computer seems to be running OK.

Question: Windows updates want to install Service Pack 3. Has there been any reported issues by those who have?

You need to update to SP3. Support for SP2 ended some time ago.

Ok..thank you..I will update to SP3. Unless there is something else..I guess this issue can be called "resolved" and you can close this thread. Thank you for your help and assistance!

You're more than welcome. Glad we were able to help Peace be with you

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.