Printable View
Hello forum,
Since a couple of days my laptop seems te be infected by a trojan Horse. I get numerous reports form my Kaspersky Internet Security that IP 94.75.234.35 wants to get access. Also IE starts everytime with sites I don't want. Can you please help me? I have added a scan from the removal tool as recommended.
greets,
Frank[URL="file:///D:/Download/Kaspersky%20virus%20removal%20tool%207/Virus%20Removal%20Tool/is-CDFQD/LOG/avptool_syscheck.zip"]
[/URL]
Welcome!
Run this script in removal tool(remember to launch the tool with right click as administrator)
[code]
begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
Clearquarantine;
QuarantineFile('C:\Users\frank\svchost.exe','');
QuarantineFile('C:\Windows\System32\dtu10032.dll','');
QuarantineFile('C:\Windows\System32\dsound32.dll','');
BC_ImportAll;
BC_Activate;
RebootWindows(true);
end.[/code]
Computer will reboot. This script will change nothing, it just for making a copy of some files.
Now, we need to see them. In order to do that, please execute this script right after reboot:
[code]
begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]
Upload file C:\quarantine.zip, only by red link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] in the top of this thread.
Let us know, when you will done!
Hello Drongo,
Thanks for the quick response!
I followed your procedure and I have uploaded the zip-file as requested.
Success!
Frank
Just one file is exist in quarantine, i think it is a new trojan. Hope, kaspersky lab will add it soon :)
Meantime, please execute this script(in order to clean up your system):
[code]
begin
clearquarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\Program Files\Google\Chrome\Application\3.0.195.27\rlz.dll','');
QuarantineFile('C:\Windows\System32\dtu10032.dll','');
DeleteFile('C:\Users\frank\svchost.exe');
DeleteFile('C:\Windows\System32\dtu10032.dll');
DeleteFile('C:\Windows\System32\dsound32.dll');
DelBHO('{18042A66-9538-4D6E-8453-08E5EDFE68Cf}');
DelBHO('{0D5CE3BC-187E-44F2-9685-7367257E886f}');
DelBHO('{0C021533-9538-4D6E-8453-08E5EDFE68Cf}');
DelBHO('{06AE71DE-187E-44F2-9685-7367257E886f}');
DelBHO('{06010A99-9538-4D6E-8453-08E5EDFE68Cf}');
BC_ImportAll;
BC_Activate;
ExecuteSysClean;
RebootWindows(true);
end.[/code]
After reboot, please execute this:
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.[/code]
Upload a new quarantine by red link.
Please make set of logs according to rules: [url]http://virusinfo.info/showthread.php?t=9184[/url] Do attach them to next post.
Hello Drongo,
I think you' ve done a great job. No more messages from KAV and IE has stopped starting unrequested!
As you asked, I attached the 2 extra files. Hope you can use the extra information.
Regards,
Frank
quarantine.zip you must send only by red link from top of the theme.[COLOR="Red"][B] Upload quarantined files[/B][/COLOR]
Always remember: quarantine by red link, logs ->to attach, ok?
Now, please make a log from Hijack this( [url]http://www.whatthetech.com/hijackthis/[/url] ) and attach it, because it is log and not a quarantine. :)
Hello Drongo,
I have uploaded the quarantine.zip file the way you said and created a Hijack logfile and attached it to this mail.
What is it you want to investigate. Do you still suspect some routines?
Greetings
Frank
The log seems to be OK. Have you got any problem more?