Thread Solved

Join Date: Oct 2007
Posts: 48
Reputation: weasel7711 is an unknown quantity at this point 
Solved Threads: 0
weasel7711 weasel7711 is offline Offline
Light Poster

Re: Trojan Problem

 
0
  #21
Sep 30th, 2008
Download signed ActiveX controls is set to prompt, still wont show up.
And I tried running combofix and also spybot search and destroy from the desktop as well as from the flash drive. Nothing has worked. I still get the hourglass for a split second and then nothing.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: Trojan Problem

 
0
  #22
Sep 30th, 2008
What happens if you use TM to stop the explorer.exe process, and then use it to start one of your problem .exe pgms? You can try this in Safe mode.
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: Trojan Problem

 
0
  #23
Sep 30th, 2008
More, weasel... fix your exe associations keys in registry with this reg file:
==Please copy the text in the box to a notepad [format/wordwrap unchecked] and save as fixkey.reg, as type "all files", to your desktop; dclick it to run... agree; if it opens in notepad instead rclick the icon [file], choose Open with, Registry editor....
Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

[HKEY_CLASSES_ROOT\.exe\PersistentHandler]
@="{098f2470-bae0-11cd-b579-08002b30bfeb}"

[HKEY_CLASSES_ROOT\exefile]
@="Application"
"EditFlags"=hex:38,07,00,00
"TileInfo"="prop:FileDescription;Company;FileVersion"
"InfoTip"="prop:FileDescription;Company;FileVersion;Create;Size"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
@="%1"

[HKEY_CLASSES_ROOT\exefile\shell]

[HKEY_CLASSES_ROOT\exefile\shell\open]
"EditFlags"=hex:00,00,00,00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shell\runas]

[HKEY_CLASSES_ROOT\exefile\shell\runas\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\exefile\shellex]

[HKEY_CLASSES_ROOT\exefile\shellex\DropHandler]
@="{86C86720-42A0-1069-A2E8-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers]

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PEAnalyser]
@="{09A63660-16F9-11d0-B1DF-004F56001CA7}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\PifProps]
@="{86F19A00-42A0-1069-A2E9-08002B30309D}"

[HKEY_CLASSES_ROOT\exefile\shellex\PropertySheetHandlers\ShimLayer Property Page]
@="{513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8}"
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Oct 2007
Posts: 48
Reputation: weasel7711 is an unknown quantity at this point 
Solved Threads: 0
weasel7711 weasel7711 is offline Offline
Light Poster

Re: Trojan Problem

 
0
  #24
Sep 30th, 2008
Ill try and do that tomorrow morning before classes. Thanks gerbil.
Reply With Quote Quick reply to this message  
Join Date: Oct 2007
Posts: 48
Reputation: weasel7711 is an unknown quantity at this point 
Solved Threads: 0
weasel7711 weasel7711 is offline Offline
Light Poster

Re: Trojan Problem

 
0
  #25
Oct 1st, 2008
Ok. I killed explorer.exe then tried to run the files, still didnt work.

Then I ran the regfix file, which was successful. Then I moved the files I wanted to run to the desktop and tried to run them, still no luck. I also tried running from the flash drive afterwards, same result.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: Trojan Problem

 
1
  #26
Oct 1st, 2008
Hello weasel... Okay, thanks...lessee, do you have this file by any chance?:
C:\Windows\System32\Drivers\tdssserv.sys
-delete it. There may be others like this:
C:\Windows\System32\tdsss?.dll ..where the ? represents other letters.
==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
and save it to your desktop. Dclick SDFix.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=You must restart your computer in Safe Mode:
- Log in by using the Administrator account.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
Last edited by gerbil; Oct 1st, 2008 at 10:14 am.
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Oct 2007
Posts: 48
Reputation: weasel7711 is an unknown quantity at this point 
Solved Threads: 0
weasel7711 weasel7711 is offline Offline
Light Poster

Re: Trojan Problem

 
0
  #27
Oct 1st, 2008
Dont have any of those files.

Same issue with SDFix as with other exe files.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: Trojan Problem

 
0
  #28
Oct 2nd, 2008
It cannot be policy blocking the exes from running because you would get a warning about it, although you could check in the Event Viewer [under admin tools], Software, to see if there have been any block events. I cannot figure what could block some system exes like sfc.exe, but not regedit.exe; still allow you to run some third party software app exes, eg.? CCleaner, Unlocker but not others such as those I have requested or activeX's. How did Clam get by it? There must be a blacklist file of exes in your sys in some malware....
In the zipped file is a list of "cohort" files that are associated with the trojans you had. Just open a cmd window and paste in each of the two lines, making sure wordwrap is not checked in notepad.
And if that does not help then perhaps there is nothing for it but to follow one of two restoration plans depending on whether the pc has valuable data/files/applications.
If it does then the aim would be to Repair windows, which would keep all data and most applications intact, including any malware which could simply break the new installation.
Copying off data is an option, with fingers crossed that the problem is not due to a worm or virus.
Reinstalling windows without a formatting of the partition would expose the new OS to the same risk.
Personally, I'd go for the Repair cos it takes but an hour or so. It's always possible that this is just a sys problem... pity no-one else has dropped in with some ideas.
Last edited by gerbil; Oct 2nd, 2008 at 9:33 am.
Attached Files
File Type: zip zlob.zip (440 Bytes, 3 views)
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Oct 2007
Posts: 48
Reputation: weasel7711 is an unknown quantity at this point 
Solved Threads: 0
weasel7711 weasel7711 is offline Offline
Light Poster

Re: Trojan Problem

 
0
  #29
Oct 3rd, 2008
One other thing I didnt mention, is that the next to the clock on the start bar, it says VIRUS ALERT. I will try the zip file and if that doesnt work ill tell my neighbor he may have to just shell out 200 bucks and take it to best buy.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: Trojan Problem

 
0
  #30
Oct 4th, 2008
VIRUS ALERT!... yeah, weasel, I did notice that the header of your Hijackthis log was modified to include that [your sys clock has been affected]. Virus Alert! is relatively easy to fix, our problem is something that came in alongside it and appears to have blacklisted a lot of removal tools which would remove Virus Alert and perhaps this other infection.
Let's try this now:
==Download SmitfraudFix (by S!Ri) from http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Immediately rename the file to SMFix.zip, then extract the content (a folder named SmitfraudFix) to your Desktop.
- Open the SmitfraudFix folder and rename smitfraudfix.cmd to SMFix.cmd; double-click SMFix.cmd, select option #1 - Search [type 1 and Enter]; a text file will appear which lists infected files (if present). It will also create a log named rapport.txt in the root of your drive, eg: Local Disk C:\ ..
Please paste the report in your next reply. DO NOT RUN OPTION 2 YET!!!

==Download SDFix from here: http://downloads.andymanchesta.com/R...ools/SDFix.exe
or here: http://www.bleepingcomputer.com/resources/link252.html
and save it to your desktop. Rename SDFix.exe to MySD.exe; dclick MySD.exe and choose Run to extract it to %systemdrive%, which commonly will be C:\
=Please clean with CCleaner.
=You MUST restart your computer in Safe Mode.
=Open the extracted SDFix folder, C:\SDFix and double click RunThis.bat to start the script. Type Y to begin the cleanup.
You will be prompted to press any key to Reboot - the pc will then restart.
The tool will run again and complete the removal process then display Finished; press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Restart the pc in normal mode. Post the contents of the file Report.txt here, along with the log of a fresh hijackthis scan run in normal mode.
May get thru the gate, may not.
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Reply

This thread has been marked solved.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the Windows NT / 2000 / XP Forum
Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC