[Resolved] Trojan Horse Dropper Agent GIT amongst others

Please let me know how this evolves

Hi Simon the pc seems to be working fine today when you looked at the last HijackThis log, did it give me a clean bill of health ? Just a couple more queries; 6) if this virus has attack reg keys and i re-install the software/hardware, will this replace the missing reg keys or is there another way to attain the reg keys ? 7) is it ok for me to continue with AVG anti-virus and Spyware Terminator, or would you recommend better protection for my pc ? many thanks for your assistance and your time its much appreaciated cheers Jon

Hi

when you looked at the last HijackThis log, did it give me a clean bill of health ?

Yes.

6) if this virus has attack reg keys and i re-install the software/hardware, will this replace the missing reg keys or is there another way to attain the reg keys ?

Reinstalling is the only way.

7) is it ok for me to continue with AVG anti-virus and Spyware Terminator, or would you recommend better protection for my pc ?

Here is my usual prevention speech (you can also keep using Malwarebytes' Anti-Malware):

Click Start then Run….

• Type Combofix /u in the runbox and click OK. (Note: The space between the x and the /u needs to be there)
  
  [external image: Posted Image]
  
  
• This will uninstall Combofix.

Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
• Change the Download signed ActiveX controls to Prompt.
• Change the Download unsigned ActiveX controls to Disable.
• Change the Initialise and script ActiveX controls not marked as safe to Disable.
• Change the Installation of desktop items to Prompt.
• Change the Launching programs and files in an IFRAME to Prompt.
• Change the Navigate sub-frames across different domains to Prompt.
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

• Next press the Apply button and then the OK to exit the Internet Properties page.

Use a Firewall - Without a firewall your computer is susceptible to being hacked and taken over. The Windows firewall isn't sufficient as it only monitors incoming connections.

Here are a few (free) firewalls, please download and install one of them:

• Kerio Personall Firewall
• Comodo Free Firewall

Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install WinPatrol - An excellent startup manager, notifies you if programs are added to startup, allows delayed startup, … A must have! An installation guide can be found here: http://www.winpatrol.com/download.html

Install Spybot - Search and Destroy - You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here (do not install TeaTimer): http://www.bleepingcomputer.com/tutorials/tutorial43.html

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A tutorial can be found here: http://www.bleepingcomputer.com/tutorials/tutorial49.html

Install IE-Spyad - IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here: http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD

Update All Your Security Programs Regularly - Make sure you update all your security programs (Anti-Virus, Firewall, Anti-Spyware) regularly (once a weak, at least). Without regular updates you WILL NOT be protected when new malicious programs are released.

You can also read this excellent article by TonyKlein: So how did I get infected in the first place?

Follow this list and your potential for being infected again will reduce dramatically.

Stand Up and Be Counted! - Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints: Malware Complaints. You have to be registered to post. After registering just find your country room and register your complaint. The infection you had was Vundo (Virtumundo).

I use Firefox as my web browser but i will beef that up accordingly. I'll remove terminator and use Spybot and Spyware Blaster instead. 8) If i install a firewall, do i disable Windows Firewall permanently ? cheers Jon

Hi Some third party firewalls automatically disable the Windows one, but yes, you should check to be sure it is disabled. General rule: Never have two anti-virus programs or two firewalls installed at the same time, as they could conflict with each other.

Most things are running ok, but others are not functioning as before.

For example, Itunes will not connect to the Itunes store nor can it connect to the server to update the software on my Ipod.

I fully uninstalled and re-installed the application.

Actually when im browsing i regularly get the "server not found" error page like this one 🖼Click to load external image (Posted Image)

Im using a router connected via ethernet and i often have to hit the 'try again' button 3 or 4 times before a web page connects.

Actually I realise im going off topic now so you can close off this thread if you prefer.

Thanks again,

Jon

Hello again i've been trying to install Spybot and other stuff you'd recommended but im having problems connecting to their servers. "a connection with the server could not be established" Dont know if this is because of my router… :-(

Hello again

i've been trying to install Spybot and other stuff you'd recommended but im having problems connecting to their servers.

"a connection with the server could not be established"

Dont know if this is because of my router…

:-(

I'm still searching for a solution - will get back to you when I know more.

Hi

Please try the following:

Download WinsockXPFix: http://www.snapfiles.com/download/dlwinsockxpfix.html

Double-click on WinsockxpFix.exe to run the program, click on ReG-Backup, then OK. When that's finished, click Fix. The program should reboot your system automatically. If it does not, reboot manually and let me know how it went.

Hi Simon ive downloaded WinsockXPFix, but when i click ReG-Backup it says "Warning! Error saving file C:\ERDNT\SECURITY ! Continue with next file? " is this normal, shall i keep hitting 'yes' ? cheers

Hi Simon

ive downloaded WinsockXPFix, but when i click ReG-Backup it says "Warning! Error saving file C:\ERDNT\SECURITY ! Continue with next file? "

is this normal, shall i keep hitting 'yes' ?

cheers

Hmm, try this instead:

Please download ERUNT.

• Save it to your desktop. Install the program, then run it.
• In the box that opens place a check next to all items, then click OK. It may take a minute. Just let it go until it's done.
• Click OK again when it's finished.
• Close ERUNT.

This is so the registry can be restored to this point if we need it.

Success, ok done that. Im crossing fingers and toes. What next ?

Success, ok done that.

Im crossing fingers and toes.

What next ?

Let me know whether the internet connection is stable after running WinsockXPFix.

Howdy still the same, am unable to install Spybot as described earlier, it hangs for 10 seconds or so and i get that error. same for other things, like Ipod and Itunes i was directed to an article about DNS servers and ive changed to open DNS servers as opposed to my ISP and the internet seems to be running well and i am able to download most files, just problems with some could it be the router stopping this ? maybe i need to open a particular port ?

Please let me know what programs are still giving problems after switching to open DNS servers.