Unsolved
This post is more than 5 years old
16 Posts
0
46141
May 19th, 2004 18:00
3 Undeletable Trojan Horses
I ran AVG 7.0 yesterday, found 3 viruses, 2 are in the virus vault, I deleted one of them. I ran a complete test today and it found 3 more viruses that are undeletable, because they are compressed archive files. Here are the test results:
OBJECT: C:\_RESTORE\ARCHIVE\FS1874.CAB:\A0135951.CPY RESULT: Trojan horse Downloader.Realtens.D STATUS: Infected, embedded object
OBJECT: :\_RESTORE\ARCHIVE\FS2455.CAB:\A0155182.CPY RESULT: Trojan horse Downloader.Dyfica.AJ STATUS: Infected, embedded object
OBJECT: C:\RESTORE\ARCHIVE\FS2557.CAB:\A0167504.CPY RESULT: Trojan horse Downloader.Realtens.D STATUS: Infected, embedded object
Also, we have SpyHunter, and AVG found a virus located in a folder in a SpyHunter backup folder! I deleted the entire folder. Obviously I don't want to go deleting stuff that I know nothing about, as was recommended by technical support when I spoke with them on the phone just a few minutes ago, he recommended deleting our entire AVG program as well as the SpyHunter program.I don't want to further complicate the situation by deleting those programs.
Please HELP!!!
CherylAF
16 Posts
0
May 19th, 2004 19:00
ChrisRLG
2 Intern
•
3.9K Posts
0
May 19th, 2004 19:00
You do not say if you have win ME or XP - I has assumed XP.
http://www.bay-wolf.com/dk.htm#4a
That is the instructions for system restore.
Turn it off, then reboot, and then turn it back on.
Then use the following instuctions to post a hijackthis log for me to check.
============================
A post of a hijackthis log for the experts to advise.
HijackThis From Here
or one of these other links:-
http://www.merijn.org/files/hijackthis.zip
http://www.aluriasoftware.com/tools/hijackthis.zip
http://mjc1.com/mirror/hjt/
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Unzip HijackThis into this folder. (See this link for graphical instructions)
Then run, scan, save log, then in notepad copy the FULL log by copy and paste as a reply to this post and an expert with HijackThis Knowldge, will have a go at giving advice. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste
Please note the list of experts names below, very few forum regulars here have had this training.
DO NOT FIX ANYTHING WITH HIJACKTHIS WITHOUT EXPERT ADVICE, most of what it finds you need for normal MS Windows tasks.
Known Spyware HijackThis fighters in DellTalk - If you are, and are not on the list please PM Me.
TomCoyote (of http://tomcoyote.org/forums/index.php fame)
YoKenny (Expert at TomCoyotes, Trusted Advisor Spywareinfo)
baskar1234 (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
ChrisRLG (Classroom Coordinator at TomCoyotes, Trusted Advisor Spywareinfo)
Tuxedo Jack (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
Yellowhammer (Trusted Advisor at Net-Integration, First Responder at Computer Cops)
tashi (Teaching Assistant at TomCoyotes, Trusted Advisor Spywareinfo)
therock247uk (In Training at TomCoyotes and Spywareinfo)
irelynmisses (In Training at TomCoyotes and Spywareinfo)
Texruss (Spyware Fighter at Wildersecurity, In Training at TomCoyotes)
PGPhantom (Trusted Advisor at Spywareinfo)
You could also go to one of the more specalist forums where more experts will be able to help.
http://tomcoyote.com/forums/index.php
http://forums.spywareinfo.com/index.php
http://www.net-integration.net/cgi-bin/forum/ikonboard.cgi (Home of Spybot S&D)
http://boards.cexx.org/index.php
http://www.wilderssecurity.com/index.php
Do read the sites FAQ before posting, and advise your problem and what steps you have already done to try to cure your problem.
I, and the other hijack experts mentioned above, are in all those sites (and more) with the same login names. You might get one of us at those sites also to anwser your log, but other experts will also be available.
CherylAF
16 Posts
0
May 19th, 2004 20:00
ChrisRLG
2 Intern
•
3.9K Posts
0
May 19th, 2004 20:00
If so have you already run spybot and ad-aware - if not run them first
Spybot S&D and Ad-aware using the settings and links provided
Here
they may trim down the size of that log.
CherylAF
16 Posts
0
May 19th, 2004 22:00
Midnight Star
4.8K Posts
0
May 19th, 2004 22:00
I'm just curious, have you checked to see what the actual file size for the HiJackthis log is? As opposed to what internet explorer is saying? Just right click on the log file and select properties, it'll tell you the actual file size. This might help to determine if the file is being 'jacked' during transmission, if internet explorer is corrupted somehow, if the file really is that big, if something has interferred with HiJackThis or if something is appended to it.
Let us know.
Mike.
CherylAF
16 Posts
0
May 19th, 2004 23:00
Jim...re: "The log file for HijackThis isn't in the ZIP file! When HijackThis runs, click on "Save Log""...i don't understand what you mean actually...i'm not very good at this stuff, so specifically, where is "Save Log" located?? and how do i access the ZIP file??
CherylAF
16 Posts
0
May 19th, 2004 23:00
Midnight Star
4.8K Posts
0
May 19th, 2004 23:00
That's the nice thing about being a computer owner, it's put you in good company. ChrisRLG and TexRuss are much better at diagnosing spyware and malware problems than myself, i'm a system analyst from a mainframe background. But I can tell you that the software running on your computer is complex and interrelated. Malware, spyware and other such programs do not take into consideration the current state or health of your machine when they infest it nor when their eventually removed. They could cause an improper change of simply one character in a data file, registry, library or program in one are of your system and this could, in turn, effect the entire system causing a major disruption in other seemingly unrelated areas - which could escalate into complete harddrive corruption. Usually their main goal is jump on your system unnoticed while performing their intended actions. They usually target a certain group of people who are not always able, nor have the resources, to fend them off.
Good luck.
Mike.
CherylAF
16 Posts
0
May 19th, 2004 23:00
Jim...re: "The log file for HijackThis isn't in the ZIP file! When HijackThis runs, click on "Save Log""...i don't understand what you mean actually...i'm not very good at this stuff, so specifically, where is "Save Log" located?? and how do i access the ZIP file?? what do i do?? i do see what you are saying about the zip file, i just need to know how to get it to you! thanks
CherylAF
16 Posts
0
May 19th, 2004 23:00
jwatt
4.4K Posts
0
May 19th, 2004 23:00
I think I know what's going wrong. The log file for HijackThis isn't in the ZIP file! When HijackThis runs, click on "Save Log". This will offer the file name hijackthis.log in the directory from which HijackThis was run as the default. Click on "Save".
After the file has been saved, its contents will be loaded into "Notepad". In Notepad, click on "Edit" and "Select All". Then click on "Edit" again, but select "Copy" this time. That's what you want to paste into the reply.
Jim
jwatt
4.4K Posts
0
May 19th, 2004 23:00
Cheryl,
See if this information from Texruss helps clarify things.
Please unzip Hijackthis.zip into a new folder you create in the root level of the C: drive. Name this folder C:\HJT for best and safest results. (don't put in a temp folder, or the desktop, etc...as it needs a safe folder to keep backup logs).
See this link for graphical instructions:
http://russelltexas.com/spywareinfo/createhjtfolder.htm
Run Hijackthis, click on the 'scan' button and then 'save log' button. Copy and paste the contents of the text file you save into a reply to this message. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste at http://www.tomcoyote.com/hjt/
Important! Do not fix anything in HJT log screen without assistance. Many items are normal for Windows operation. Your Hijackthis log should identify the vast majority of your problems and enable us to help you clean them off your system.
(edit) The reason I suspect you'd pasted something from the ZIP file is this comment you made:
"when i unzipped the hjt log and copied and pasted onto notepad, it's actually in symbols..."
Jim
Message Edited by jimw on 05-19-2004 05:57 PM
Message Edited by jimw on 05-19-2004 05:59 PM
jwatt
4.4K Posts
0
May 20th, 2004 00:00
1. Unzip the file "hijackthis.zip" into a new directory, best named c:\hjt. Double-click on the file "hijackthis.zip" to open the file. If you're using WinZIP, click on "Extract", and enter "C:\hjt" into the "Extract" window that appears. Then click on "Extract". Close WinZip after the file has been extracted.
2. The new directory will contain exactly one file - "hijackthis.exe".
3. With the Windows Explorer, navigate to the directory c:\hjt, and double-click on "hijackthis.exe"
4. That will result in a new window, labelled "HijackThis - v1.97.7". Click on the button labelled "Scan" in the lower left corner of that window.
5. After the scan has completed, the "Scan" button will change to "Save log". Click on that button.
6. Save the file in the "Save logfile..." window that opens by clicking on "Save".
7. After the file is saved, Notepad will pop up. Its window will contain the log file.
8. Click on "Edit", then click on "Select All". A "shortcut" for this is the key combination "Ctrl A".
9. Again click on "Edit", but this time select "Copy".
10. In the Dell Forum, paste the information into a reply. Select "Paste" from the "Edit" window to do that.
Please post back if you have more questions.
Jim
CherylAF
16 Posts
0
May 20th, 2004 00:00