LDTate
Let it run. It takes awhile depending on how many programs you have on the pc. It can take up to 1/2 hr.
Spyware / Malware / Virus Removal
Trojan Found: Perfc000.dat
63 min read
ZenToR
but until now, my experience with the trojan is that a program or an action that i lunch, first starts to run until i press 16 times the AntiVir message…
But now, while it's scanning, the trojan appears immidediatly after i pressed the 16 windows away each second, without any longer brake… So maby the scan program is not even able to run because of the trojan?
LDTate
Can you try ALT/CTRL/DEL and end the process for the trojan file?
LDTate
If the combo scan doesn't work, lets try this.
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)
It's normal after running ATF cleaner that the PC will be slower to boot the first time.
Next:
Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)
It's normal after running ATF cleaner that the PC will be slower to boot the first time.
Next:
Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
- Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
and double-click it to launch the set up program. - Once the setup is complete you will need run ewido and update the definition
files. - On the main screen select the icon "Update" then select the "
Update now" link.- Next select the "Start Update" button, the update will start and a
progress bar will show the updates being installed.
- Next select the "Start Update" button, the update will start and a
- Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab. - Once in the Settings screen click on "Recommended actions" and then
select " "Quarantine" .". - Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"
- Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.
Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess: - Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
- Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan". - ewido will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following: - If you have any infections you will prompted, then select "Apply all
actions" - Next select the "Reports" icon at the top.
- Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important). - Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
results of the AVG Anti-Spyware report scan along with a new HijackThis log.
ZenToR
Can you try ALT/CTRL/DEL and end the process for the trojan file?
I already tried this but it doesn't work… there are 16 processes of the trojan, and the proccesses are not really the trojan, there are reports of AntiVir who blocks the trojan…
If i would disable antivir, the scan would probably work, but then the trojan would destroy the computer even more, would't it?
LDTate
Forget the combo scan for now and do the fix I just posted.
Don't disable your antivirus.
ZenToR
there is a error message when i want to install AVG Anti-Spyware
? maby i need another version of AVG Anti-Spyware ?
64-Bit edition of Windows is not supported
? maby i need another version of AVG Anti-Spyware ?
LDTate
We need to look at a file you have.
Go to – link removed since I already received this file for a couple of times –
Enter the url of this thread in the first field.
Where it says, browse to the file that you want to submit,C:\WINDOWS\system32\perfc000.dat, click the browse button next to it and browse to next file, select it and click ok:
Then click the Send File button below.
Let me know when you've done that.
Go to – link removed since I already received this file for a couple of times –
Enter the url of this thread in the first field.
Where it says, browse to the file that you want to submit,C:\WINDOWS\system32\perfc000.dat, click the browse button next to it and browse to next file, select it and click ok:
Then click the Send File button below.
Let me know when you've done that.
ZenToR
On the Hompage of AVG Anti-Spyware the following requirement is written:
What does this Bit mean?
Operating Systems: Developed for Windows 2000 and XP (32-Bit)
What does this Bit mean?
LDTate
It looks like you have a 64 bit pc and the avg anti-spyware won't run on your systemOn the Hompage of AVG Anti-Spyware the following requirement is written:
Operating Systems: Developed for Windows 2000 and XP (32-Bit)
What does this Bit mean?
ZenToR
ok i have sent it
LDTate
Backup Your Registry with ERUNT
Note: to restore your registry, go to the folder and start ERDNT.exe
Next:
Unplug your internet connection.
Next:
Restart your computer in Safe Mode.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.
Next:
Click "Start"> "Run"> type in Regedit tap Enter Key
Make sure "My Computer" is highlighted
Click "Edit"> "Find"
Type in perfc000.dat tap Enter Key.
Right Click on the file if found and select "Delete"
Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.
Close Regedit.
Empty Recycle Bin
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
- Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php - For version with the Installer:
Use the setup program to install ERUNT on your computer - For the zipped version:
Unzip all the files into a folder of your choice.
Note: to restore your registry, go to the folder and start ERDNT.exe
Next:
Unplug your internet connection.
Next:
Restart your computer in Safe Mode.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.
Next:
Click "Start"> "Run"> type in Regedit tap Enter Key
Make sure "My Computer" is highlighted
Click "Edit"> "Find"
Type in perfc000.dat tap Enter Key.
Right Click on the file if found and select "Delete"
Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.
Close Regedit.
Empty Recycle Bin
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
ZenToR
Thx LDTate for all your help and time 
This trojan gives me the chill… Now i have to go sleeping
good n8
i will work on fighting the trojan tomorrow
THX
This trojan gives me the chill… Now i have to go sleeping
good n8
i will work on fighting the trojan tomorrow
THX
LDTate
OK. We'll tackle it tomorrow 
ZenToR
Aww, what a nasty trojan… I followed all your steps and i have deleted the perfc000.dat file like 4 times until it finished searching.
With no luck: After the reboot the trojan behaves usual as always…
I forgot to say one thing about the behaviour of the trojan: When i lunch a file or a program, my computer is loading about 15 seconds until the AntiVir Trojan messages appears. The file will start then after i pressed all the AntiVir reports away.
I wonder if "1Techwreck" solved the problem with the perfc000.dat file
http://forums.tomcoyote.org/Help_Hijackthi….html&st=15
With no luck: After the reboot the trojan behaves usual as always…
I forgot to say one thing about the behaviour of the trojan: When i lunch a file or a program, my computer is loading about 15 seconds until the AntiVir Trojan messages appears. The file will start then after i pressed all the AntiVir reports away.
I wonder if "1Techwreck" solved the problem with the perfc000.dat file
http://forums.tomcoyote.org/Help_Hijackthi….html&st=15
Logfile of HijackThis v1.99.1
Scan saved at 09:01, on 07-05-05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\hijackthis\HijackThis.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C:\Programme\Siemens\Gigaset USB Adapter 54\PRISMSVR.EXE" /APPLY
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - Global Startup: Gigaset WLAN Adapter Monitor.lnk = C:\Programme\Siemens\Gigaset USB Adapter 54\GigasetUSBMonitor.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Knowledge Base Suche - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra 'Tools' menuitem: Knowledge Base Suche - {8b2d996f-b7d1-4961-a929-414d9cf5ba7b} - http://support.microsoft.com/default.aspx?scid=FH;EN-US;KBHOWTO (file missing)
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/german/partner/de/kavwebscan_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exeAsk AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI