| | |
Trojan Problem
Thread Solved |
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
More, weasel... fix your exe associations keys in registry with this reg file:
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as fixkey.reg, as type "all files", to your desktop; dclick it to run... agree; if it opens in notepad instead rclick the icon [file], choose Open with, Registry editor....
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as fixkey.reg, as type "all files", to your desktop; dclick it to run... agree; if it opens in notepad instead rclick the icon [file], choose Open with, Registry editor....
Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"
[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"
[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"
[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"
[HKEY_CLASSES_ROOT\exefile\shell]
[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00
[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"
[HKEY_CLASSES_ROOT\exefile\shell\runas]
[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"
[HKEY_CLASSES_ROOT\exefile\shellex]
[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"
[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}" Deep, deep in the woods, but walking about.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
Hello weasel... Okay, thanks...lessee, do you have this file by any chance?:
C:\Windows\System32\Drivers\tdssserv.sys
-delete it. There may be others like this:
C:\Windows\System32\tdsss?.dll ..where the ? represents other letters.
==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=You must restart your computer in Safe Mode:
- Log in by using the Administrator account.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
C:\Windows\System32\Drivers\tdssserv.sys
-delete it. There may be others like this:
C:\Windows\System32\tdsss?.dll ..where the ? represents other letters.
==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=You must restart your computer in Safe Mode:
- Log in by using the Administrator account.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
Last edited by gerbil; Oct 1st, 2008 at 10:14 am.
Deep, deep in the woods, but walking about.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
It cannot be policy blocking the exes from running because you would get a warning about it, although you could check in the Event Viewer [under admin tools], Software, to see if there have been any block events. I cannot figure what could block some system exes like sfc.exe, but not regedit.exe; still allow you to run some third party software app exes, eg.? CCleaner, Unlocker but not others such as those I have requested or activeX's. How did Clam get by it? There must be a blacklist file of exes in your sys in some malware....
In the zipped file is a list of "cohort" files that are associated with the trojans you had. Just open a cmd window and paste in each of the two lines, making sure wordwrap is not checked in notepad.
And if that does not help then perhaps there is nothing for it but to follow one of two restoration plans depending on whether the pc has valuable data/files/applications.
If it does then the aim would be to Repair windows, which would keep all data and most applications intact, including any malware which could simply break the new installation.
Copying off data is an option, with fingers crossed that the problem is not due to a worm or virus.
Reinstalling windows without a formatting of the partition would expose the new OS to the same risk.
Personally, I'd go for the Repair cos it takes but an hour or so. It's always possible that this is just a sys problem... pity no-one else has dropped in with some ideas.
In the zipped file is a list of "cohort" files that are associated with the trojans you had. Just open a cmd window and paste in each of the two lines, making sure wordwrap is not checked in notepad.
And if that does not help then perhaps there is nothing for it but to follow one of two restoration plans depending on whether the pc has valuable data/files/applications.
If it does then the aim would be to Repair windows, which would keep all data and most applications intact, including any malware which could simply break the new installation.
Copying off data is an option, with fingers crossed that the problem is not due to a worm or virus.
Reinstalling windows without a formatting of the partition would expose the new OS to the same risk.
Personally, I'd go for the Repair cos it takes but an hour or so. It's always possible that this is just a sys problem... pity no-one else has dropped in with some ideas.
Last edited by gerbil; Oct 2nd, 2008 at 9:33 am.
Deep, deep in the woods, but walking about.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
VIRUS ALERT!... yeah, weasel, I did notice that the header of your Hijackthis log was modified to include that [your sys clock has been affected]. Virus Alert! is relatively easy to fix, our problem is something that came in alongside it and appears to have blacklisted a lot of removal tools which would remove Virus Alert and perhaps this other infection.
Let's try this now:
==Download SmitfraudFix (by S!Ri) from http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Immediately rename the file to SMFix.zip, then extract the content (a folder named SmitfraudFix) to your Desktop.
- Open the SmitfraudFix folder and rename smitfraudfix.cmd to SMFix.cmd; double-click SMFix.cmd, select option #1 - Search [type 1 and Enter]; a text file will appear which lists infected files (if present). It will also create a log named rapport.txt in the root of your drive, eg: Local Disk C:\ ..
Please paste the report in your next reply. DO NOT RUN OPTION 2 YET!!!
==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
or here: http://www.bleepingcomputer.com/resources/link252.html
and save it to your desktop. Rename SDFix.exe to MySD.exe; dclick MySD.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=Please clean with CCleaner.
=You MUST restart your computer in Safe Mode.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
May get thru the gate, may not.
Let's try this now:
==Download SmitfraudFix (by S!Ri) from http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Immediately rename the file to SMFix.zip, then extract the content (a folder named SmitfraudFix) to your Desktop.
- Open the SmitfraudFix folder and rename smitfraudfix.cmd to SMFix.cmd; double-click SMFix.cmd, select option #1 - Search [type 1 and Enter]; a text file will appear which lists infected files (if present). It will also create a log named rapport.txt in the root of your drive, eg: Local Disk C:\ ..
Please paste the report in your next reply. DO NOT RUN OPTION 2 YET!!!
==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
or here: http://www.bleepingcomputer.com/resources/link252.html
and save it to your desktop. Rename SDFix.exe to MySD.exe; dclick MySD.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=Please clean with CCleaner.
=You MUST restart your computer in Safe Mode.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
May get thru the gate, may not.
Deep, deep in the woods, but walking about.
![]() |
Similar Threads
- Trojan Problem - Hijackthis log posted (Viruses, Spyware and other Nasties)
- Probable Trojan Problem (Viruses, Spyware and other Nasties)
- Possible trojan problem: Hijack this log (Viruses, Spyware and other Nasties)
- wdm.dll backdoor.trojan (Viruses, Spyware and other Nasties)
- Trojan Problem (Viruses, Spyware and other Nasties)
Other Threads in the Windows NT / 2000 / XP Forum
- Previous Thread: Strange File in Win XP
- Next Thread: Reading guide line
| Thread Tools | Search this Thread |
.net 64bit 2007 2010 a.exe activedirectory address android apache appstore automatically black blue bsod bulletin canonical chinese chkdsk codeplex combofix cursor deployment deployments desktop dns drive dual eartlink error explorer fax features fontmanagers format framework freeze hardware home internet interoperability laptop laptops lcd linux login mac markshuttleworth memory microsoft monitor motionle1600 netbooks novell nvidia open opensource operatingsystems options oracle osinstallationproblem osx palm partition printer program proxy reformat remotedesktop repair replacingraiddrive retail retrieve screen security sharepoint simplifiedchinese sitetositevpn slowperformance sp3 spyware studios technology ubuntu uninstall update upgrade videodrivers videogames virus vista visual vpn win win32/heur windows windows7 windowsxp windowsxpnotstartingup. xp xpde






