« previous next »
Pages: 1 [2]   Go Down

Author Topic: Trojan horse infections  (Read 17288 times)

0 Members and 1 Guest are viewing this topic.

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Trojan horse infections
« Reply #15 on: July 29, 2012, 06:19:25 PM »
Keep your antivirus disabled and...

Open notepad and copy/paste the text present inside the code box below:


Code: [Select]
Folder::
c:\windows\Installer\{22f5016a-7768-1103-2177-7e62b23e0fa5}
c:\program files\BabylonToolbar
c:\programdata\Babylon
c:\users\Steve\AppData\Roaming\Babylon

ClearJavaCache::

KillAll::

FCopy::
c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe|c:\windows\System32\services.exe

RegLock::
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0012\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0013\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0014\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000


Save this as CFScript.txt



Close all browser windows and refering to the picture above.

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will will re-run. When finished, it will produce a log for you.
Attach the contents of the log in your next reply. (typical location: C:\ComboFix.txt )
Logged

whads354

  • Guest
Re: Trojan horse infections
« Reply #16 on: July 30, 2012, 01:54:55 PM »
Log attached
Logged

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Trojan horse infections
« Reply #17 on: July 30, 2012, 02:07:24 PM »
Please check if you have this notepad
 C:\Qoobox\cfscript_used_30.07.2012@12:26.txt

Please attach that here.
Logged

whads354

  • Guest
Re: Trojan horse infections
« Reply #18 on: July 30, 2012, 02:27:25 PM »
File attached
Logged

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Trojan horse infections
« Reply #19 on: July 30, 2012, 02:48:55 PM »
Please ensure that cfscript_used_30.07.2012@12:26.txt log are saved in the ANSI format


Please, attach it again.
Logged

whads354

  • Guest
Re: Trojan horse infections
« Reply #20 on: July 30, 2012, 03:16:12 PM »
File attached, I've made sure it's in ANSI format
Logged

Offline magna86

  • Anti Malware Fighter
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 4235
    • Ambulanta MyCity Forum - ASAP Member
Re: Trojan horse infections
« Reply #21 on: July 30, 2012, 03:28:13 PM »


Manual delete thouse folders:
c:\program files\BabylonToolbar
c:\programdata\Babylon
c:\users\Steve\AppData\Roaming\Babylon




It is necessary to uninstall the ComboFix :
  • Click Start (or ) then Run.


    On Windows7 or Vista you may use Start Search field if Run is not available.

  • In the line of text type in (Copy) the following:
Code: [Select]
ComboFix /Uninstall
    Note that there is a space between " ComboFix " and " /Uninstall " .

    • then click OK (or press Enter ).
    Wait for the uninstall process is complete.




    >> How's your computer behaving now ?
    Logged

    whads354

    • Guest
    Re: Trojan horse infections
    « Reply #22 on: July 30, 2012, 03:45:02 PM »
    I couldn't delete all of c:\program files\BabylonToolbar, I was told I didn't have permission to delete some of the files. I deleted what I could. The second one deleted ok but I couldn't find c:\users\Steve\AppData\Roaming\Babylon. There is no Appdata folder in c:\users\steve. I haven't deleted the combo fix yet as I thought I'd wait for your views on these points before I did. The computer appears to be working fine.

    Logged

    Offline magna86

    • Anti Malware Fighter
    • Avast Evangelist
    • Massive Poster
    • ***
    • Posts: 4235
      • Ambulanta MyCity Forum - ASAP Member
    Re: Trojan horse infections
    « Reply #23 on: July 30, 2012, 03:55:24 PM »
    No, be free to uninstall Combofix.

    Re run OTL , press QuickScan and attah here fresh OTL.txt log.
    Logged

    whads354

    • Guest
    Re: Trojan horse infections
    « Reply #24 on: July 30, 2012, 05:39:48 PM »
    Log attached
    Logged

    Offline magna86

    • Anti Malware Fighter
    • Avast Evangelist
    • Massive Poster
    • ***
    • Posts: 4235
      • Ambulanta MyCity Forum - ASAP Member
    Re: Trojan horse infections
    « Reply #25 on: July 30, 2012, 11:20:07 PM »
    Quote from: whads354 on July 30, 2012, 03:45:02 PM
    The computer appears to be working fine.

    We are finalizing:  :)

    download & run this utility.
    http://download.bleepingcomputer.com/sUBs/CF_UNINST.EXE

    Re-run OTL and click CleanUp!

    and finally...

    • Download AdwCleaner (by Xplode) on your desktop.


    • Launch it, click on [Search] and wait for the scan.
    • When the scan ends, a report appears.
    • Close the report
    • Click on [Delete].

      Wait until the program deletes entries
      The program will launch two pop-up window.
    • On both windows click Ok
      The second pop-up will ask for restart machine.
    ************


    I recommended to you to use MCShield if you will.
    It will prevent infection by computer via USB flash drive, mobile phone or any other memory card.
    And not only will prevent infection, but will immediately clean Memory card or external HDD

    MyCity -  Official download link
    Softpedija - Mirror download link

    That would be all  ;)



    Logged

    whads354

    • Guest
    Re: Trojan horse infections
    « Reply #26 on: July 31, 2012, 03:54:37 PM »
    Magna86, I've done all you said and all seems to be fine. Thank you very much for your time and patience. It's been a great pleasure dealing with you, your responses have been very quick and very effective. I will be upgrading to the paid for avast product very soon and I'm sure I will be a subscriber to avast for many years to come, thanks to your support. It's great to have my computer back working normally again. Thanks again.
    Regards, Steve
    Logged

    Offline magna86

    • Anti Malware Fighter
    • Avast Evangelist
    • Massive Poster
    • ***
    • Posts: 4235
      • Ambulanta MyCity Forum - ASAP Member
    Re: Trojan horse infections
    « Reply #27 on: July 31, 2012, 05:56:47 PM »
    Glad to help.  :)
    Best Regards  ;)
    Logged
    Pages: 1 [2]   Go Up
    « previous next »