Help - I Can't Access Hijackthis Forum Anymore

Sorry - I know I shouldn't post this here but every time I try to access hijack this forum via bookmark or google, in firefox or IE, the browser just shuts down, help!!!

http://forums.tomcoyote.org/Could_Trojan_D…all_t80424.html

If you are on the main page of the forum, can you just click on the "HijackThis Logs and Malware Removal" forum, without crashing? If so, you can find the thread where I'm helping you and post some more details

Hi Simon No- I can't. I have tried to access forum from main tomcoyote page and browser terminates. Browser terminates if I go in via a bookmark. I have managed to read a thread on the forum via the most popular post of the day (or something like that) but could not see my thread. Sorry. I tried to send you a message but that was not allowed. I have followed your instructions but cannot get on the forum to post results.

That's not looking good, but I'm actually surprised you can still post here. I'll talk to my teacher and I'll let you know how we're going to fix this

Thanks Simon. Just for info - I have downloaded another firewall program and it has given me the remote address that the winlogon program appears to be connecting to.

Removed. See below

Hi LDTate, Ive posted a reply over at MRU on the SDFix topic , its the worm thats closing the browser if it detects certain keywords in the page title, Im running a variant of it now and Im also unable to open your HJT section as the browser closes instantly, if we can get a sample uploaded then I'll get it added straight away. Thanks Andy

Hi LDTate,

Ive posted a reply over at MRU on the SDFix topic , its the worm thats closing the browser if it detects certain keywords in the page title, Im running a variant of it now and Im also unable to open your HJT section as the browser closes instantly, if we can get a sample uploaded then I'll get it added straight away.

Thanks

Andy

What files do you need Andy?

Hi Artemesia

You have a nasty IM worm on your system that can add alot of restrictions and disable alot of services to lower security settings and also make it difficult for you to remove it, the worm is also capable of terminating processes and this is what your seeing when you attempt to open the Hijackthis area of this site as the worm detects the window title and then closes the browser instantly, SDFix repairs the damage this worm causes but it doesnt detect this variant so the damage is being caused again as soon as the system reboots and the worm is still running.

Please can you upload a sample of the worm so that I can get it added to sdfix then you can update the tool to remove it and reverse the damage it has caused,

Please download the Suspicious file Packer from Safer-Networking.org and unzip it to your desktop.

Run SFP.exe.

Please copy the following lines into the Step 1: Paste Text window:

C:\WINDOWS\system32\vdbezmzs\winlogon.exe

then click "Continue".

This will create a .cab file on your desktop named requested-files[Date/Time].cab

Next please visit the below link

http://www.bleepingcomputer.com/submit-mal….php?channel=27

Add TomCoyote in the link part then click Browse and upload the requested-files.cab archive from your desktop

If you cannot access Bleeping Computer then visit SpyKillers forum here

http://www.thespykiller.co.uk/index.php?board=1.0

Read the instructions for uploading files which is the first topic on the forum then start a new Topic named 'IM Worm for Andy' , please then post a link to this thread and upload the requested files.cab archive from your desktop

Please let me know when its been uploaded and I will get it added as soon as I receive the file and post back on here with the next step

Thanks

Andy

Hi Andy I have uploaded the file created by SFP to the bleepingcomputer site. Thank you for your help.

Thanks,

Can you run SDFix in Normal Mode and type U to update it to the latest version, allow it internet access and extract the new file once its downloaded by following the on screen prompts, to make sure its updated correctly open the SDFix_ReadMe.htm file and it should then show the updated date as 22nd June at 2pm,

If you have any problems updating it then just delete the sdfix.exe you saved earlier and the C:\SDFix folder and download it again from Here

Reboot to safe mode and run the fix again then once its finished you should be able to access the forum you started the topic on and post back the sdfix log and a new HijackThis log so that the helper can continue.

If you have any problems let me know

Cheers

Andy

Andy Thanks so much for your help. I will do it now.

Hi Andy SDFix updated OK. I'm going to run it now in safe mode. Once I can access the main forum again I will post a message here (if I can) or else I'll put a comment on tour web-site to let you know. Once again, thanks for your help. Where would we be without guys like you!

Yeah let us know either way and we can take it from there Thanks

Andy You are a STAR!! I'm back on the HijackThis forum and have posted all the relevant data. Thank you so much. And my apologies to the administrator for using this forum - but I couldn't find another way to contact anyone.