Tech Support Forum - View Single Post

fredmh · 02-06-2007, 01:15 PM

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding.
Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this
webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

----------------------------------------

Now we get rid of the Keylogger and see what may be hiding in your system.

----------------------------------------

CLEAR AVG A/S QUARANTINE

Launch AVG A/S
Click on Show Quarantine
Click on Select All
Click on Remove Finally
Close AVG A/S

----------------------------------------

DOWNLOADS

ComboFix

1. Download this file - You MUST save it to your desktop

COMBOFIX

2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

SYSTEM REPAIR ENGINEER

Please download this tool >http://www.kztechs.com/sreng/sreng2.zip]System Repair Engineer

Extract it to it's own folder & double click SREng.exe to run it
Select 'Smart Scan' & tick "Verify Digital Signatures"
Click on the [Scan] button
When finished, click on the [Save Reports] button & save the log to Desktop
Attach the log in your next reply. Dont post it

Note: You may have to rename SREngLog.log to SREngLog.txt before attaching

----------------------------------------

DISABLE ANTI-SPYWARE APPLICATIONS

Please disable these Anti-Spyware programs as they may interfere with this fix. You may re-enable them after we clean your system.

----------------------------------------

SAFE MODE RE-BOOT

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

----------------------------------------

FIXES AND DELETIONS

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

BPK

----------------------------------------

UNHIDE HIDDEN FILES

Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.

----------------------------------------
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

c:\program files\BPK

C:\WINDOWS\system32\Sys\winlogin.006>>>Delete any files of similar format
C:\WINDOWS\system32\Sys\winlogin.007

C:\Documents and Settings\Administrator\Cookies\administrator>>>Delete the CONTENTS of folder. Leave folder intact

E:\Program Files\BitComet\Downloads\Blazingtools Perfect Keylogger 1.6.5.0

E:\Program Files\BPK

----------------------------------------

SYSTEM RE-BOOT

Reboot into Normal Mode.

----------------------------------------

ON-LINE SCANS

Kaspersky - Extended

If you have the log from Kaspersky-Extended, please post that. Otherwise, please run the program

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
- Scan using the following Anti-Virus database:
  - Extended
- Scan Options:
  - Scan Archives
  - Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect.
We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

----------------------------------------

FOLLOW-UP

Please return and post these items in the order listed:

c:\combofix.txt
SREng log (attached)
Kaspersky scan

02-06-2007, 01:15 PM	#7 (permalink)
fredmh Analyst, Security Team ; TSF Supporter Join Date: May 2006 Location: Phila,Pa Posts: 2,335 OS: XP	Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. ---------------------------------------- Now we get rid of the Keylogger and see what may be hiding in your system. ---------------------------------------- CLEAR AVG A/S QUARANTINE Launch AVG A/S Click on Show Quarantine Click on Select All Click on Remove Finally Close AVG A/S ---------------------------------------- DOWNLOADS ComboFix 1. Download this file - You MUST save it to your desktop COMBOFIX 2. Double click combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall SYSTEM REPAIR ENGINEER Please download this tool >http://www.kztechs.com/sreng/sreng2.zip]System Repair Engineer Extract it to it's own folder & double click SREng.exe to run it Select 'Smart Scan' & tick "Verify Digital Signatures" Click on the [Scan] button When finished, click on the [Save Reports] button & save the log to Desktop Attach the log in your next reply. Dont post it Note: You may have to rename SREngLog.log to SREngLog.txt before attaching ---------------------------------------- DISABLE ANTI-SPYWARE APPLICATIONS Please disable these Anti-Spyware programs as they may interfere with this fix. You may re-enable them after we clean your system. ---------------------------------------- SAFE MODE RE-BOOT Please reboot your computer in Safe Mode by doing the following: 1) Restart your computer 2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8. 3) Instead of Windows loading as normal, a menu should appear 4) Use the up arrow key to highlight Safe Mode and press Enter. 5) Login with your usual account. Make sure to close any open browsers. ---------------------------------------- FIXES AND DELETIONS Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist: BPK ---------------------------------------- UNHIDE HIDDEN FILES Go to My Computer->Tools->Folder Options->View tab: * Under the Hidden files and folders heading, select Show hidden files and folders. * Uncheck the Hide protected operating system files (recommended) option. * Also make sure there is no checkmark beside Hide file extensions for known file types * Click Yes to confirm and then click OK. ---------------------------------------- Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist. c:\program files\BPK C:\WINDOWS\system32\Sys\winlogin.006>>>Delete any files of similar format C:\WINDOWS\system32\Sys\winlogin.007 C:\Documents and Settings\Administrator\Cookies\administrator>>>Delete the CONTENTS of folder. Leave folder intact E:\Program Files\BitComet\Downloads\Blazingtools Perfect Keylogger 1.6.5.0 E:\Program Files\BPK ---------------------------------------- SYSTEM RE-BOOT Reboot into Normal Mode. ---------------------------------------- ON-LINE SCANS Kaspersky - Extended If you have the log from Kaspersky-Extended, please post that. Otherwise, please run the program Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component. The program will then begin downloading the latest definition files. Once the files have been downloaded click on NEXT Locate the Scan Settings button & configure to: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Bases Click OK & have it scan My Computer Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply * Turn off the real time scanner of any existing antivirus program while performing the online scan ---------------------------------------- FOLLOW-UP Please return and post these items in the order listed: c:\combofix.txt SREng log (attached) Kaspersky scan __________________ Last edited by fredmh : 02-06-2007 at 01:21 PM.