[Resolved] my computer is infected with trojans

I think the .doc problem is due to Office not being there anymore. I'll clean up the tools and give my speech. Then I'll attempt to answer her questions.

Reply

Hi Marli,

Since your malware problem seems to be cleared up, we'll clean up the tools you used and I'll give you a speech. Then I'll try to answer your questions.

From your desktop please delete

• Daft
• RSIT.exe

Next, click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /u

Open OTMOVEIT3 then click the Clean Up button. You may get prompted by your firewall that OTMoveIt wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself.

In windows explorer, delete these

• C:\RSIT

I suggest you keep ERUNT, ATF amd MBAM. Keep MBAM updated and use it as an on demand scanner.

Now that your system has been cleaned, we'll remove all old infected System Restore points.

Turn OFF System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Restart your computer.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check Turn off System Restore.
• Click Apply, and then click OK.

System Restore will now be active again.

* Updates and Upgrades

You have old vulnerable java installed.

• Go to http://java.sun.com/javase/downloads/index.jsp
• Scroll down to "Java Runtime Environment (JRE) 6 Update 11
• Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.

• Select the platform (Windows, in your case), mutli language.
• Accept the license agreement, click continue.

You do not have to install the Java Web Start ActiveX Control

• Scroll down and click on Windows Offline Installation,
• Save the file jre-6u11-windows-i586-p.exe to your desktop;

Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs:

• Uninstall the old versions of Sun Java, Java JRE, or similar. (You have Java™ 6 Update 7)
• Do not uninstall Java TM 6 Update 11 if found!

Reboot your computer.

• Double-click on the saved file to install the update.
• Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Some Recommendations and prevention tips

You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware)

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
  

When all these settings have been made, click on the OK button.

If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.

- Keep your antivirus program updated, as well as any other security programs you have.

- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

And a tip about P2P programs

P2P file sharing programs such as Bearshare and Limewire do not come bundled with malware as some similar programs do, but peer-to-peer file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it. Or you may think you are getting a file called "The Greatest Hits of 08", but instead get "The Meanest Trojans of 08"

Your questions

.doc is the extention for MS Word (part of Office) documents. Works is similar, but doesn't support all of the features that Word has. This may explain the error message you recieved.

If you are refering to Outlook Express, as far as I know MS is still supporting it
http://en.wikipedia.org/wiki/Outlook_Express

However, they have ended being able to use OE to access Hotmail accounts.
http://www.downloadsquad.com/2008/04/18/mi…xpress-support/

The start menu generally has only shortcuts to the program. I'd have to know which programs you are refering to in order to advise you.

Clear as mud?

Hi Marli, Are you still with us?

yes i am still here did i forget to send something marli

Hi Marli, No, I was just wondering how you where making out and if you still had problems.

hi oldman960 i still think my computer is way to slow to load ie explorer and outlook express. i wonder if i should dump outlook and go to another mail program. i also am searching the net for a way to convert those lnk files to something else. i also want to get rid of works and put word back on my computer. my mom has vista and it came with a free trial of ms office which has expired so she cannot send mail from outlook express. can she get ms office for free on the net? i guess i could search for the answer myself, but you are much better at this than me. also how do you get rid of running processes?, I was at my moms and she has 77 running thats like way way too many thanx again for all your help marli

Hi Marli,

When was the last time you did some general disk maintanance such as defrag? A badly fragmented drive can cause programs to respond slowly as all the files are scattered about the hard drive.

To run defrag, double click on "My Computer", right click on C:\, click properties. Click on the tools tab, click "Defragment now".

The defragmenter utility will now open. Click "Analyze" Once it's finished click "Defragment". Depending how badly fragmented your drive is, it could take some time to complete, just let it run.

A good way to improve your system's overall preformance is to add more ram. RSIT shows you to have 256mb. The recommended for xp is 512mb.

Outlook is part of MS Office. The ability to use Outlook Express is not dependant on Office being installed or operational. Office is a paid for program.

The .lnk files are links to the actual message. If you right click one, it may show you the path to the message.

One cause of OE being slow to load is when it's database gets too big. If you have been saving all the mail in OE folders, then this database can grow quite large. Oe is not a good place to store things. It is better to save things in a folder outside of OE.

You good try Thunderbird as a alternate email client.

You can just re-install Word, no need to remove Works first. All files with a .doc extention should open with Word by default.

Here's some optional fixes you can try, they may improve your system preformance. These fixes will not remove the program, they will just stop it from running at startup. I included a line with each so you can see what each does.

To impliment these fixes, open Hijackthis, run a system scan only. Locate the corresponding line from the list below, checkmark it and click "fix checked". Only do this with ones you do not want to have running at startup. Do not fix any other lines, as they are required settings.

O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
http://www.systemlookup.com/lists.php?list…oMgr.exe&s=

O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
http://www.systemlookup.com/lists.php?list…LXCGCATS&s=

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
http://www.systemlookup.com/Startup/9914-Qttask_exe.html

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
http://www.systemlookup.com/Startup/455-Reader_sl_exe.html

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
http://www.systemlookup.com/Startup/8006-msnmsgr_exe.html

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.