View Single Post
Old 08-06-2008, 12:20 AM   #6 (permalink)
alba
Analyst, Security Team
 
alba's Avatar
 
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04


Re: Trojan Vundo, Downloader, Agent, and Starpage

Hi julie1989


Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.


Sorry there is a bug in your version of ComboFix, so it didn,t run properely please do the following first then carry on with th rest of the instructions:


Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK:

ComboFix /u




===================

Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

===============================================

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

===============================================

Open notepad and carefully copy/paste all the text in the code box below into it:


Code:

File::
C:\Documents and Settings\Owner\My Documents\My Pictures\alliswellss.exe 
C:\Program Files\Common Files\aolback\Comps\toolbar\toolbr.exe
C:\WINDOWS\system32\baqmxan.exe
C:\Program Files\swin32.dll

Folder::
C:\WINDOWS\system32\kBin15
C:\temp\epr1

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\dc5768a6-b80e-45c6-8b1d-072eead5f313]
Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


=================

Please Run a scan with HiJackThis and save the log

=================

In your next post, please include fresh logs from:
  • ComboFix.txt
  • HiJackThis
Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now
__________________


Member of UNITE

If I have helped you in anyway, please DONATE to TSF Go raibh maith agat
alba is offline