Req Help: Possible Trojan

Ahero · 11-02-2009, 02:36 AM

Hey,
For the past 2 days or so i've been having a problem.

It started when i had an alert warning me my firewall was off (it was on before) and that i have security alerts on my computer, and that i should click on something to fix it (I didn't), I head to my firewall, see that's it's somehow turned off, and turn it back on.

I immediatly head to my anti virus and malware bytes programs and try and run scans, however they will not open, i get a message saying

"Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item."

I also notice thatm when browsing the internet (firefox) random websearches will be redirected to shopping/banking websites such as ebay (which i do not use on this computer).

So first thing i've done so far, was try and re-install malware bytes, renaming it and trying to run it, i got up to the stage of starting a scan, but then the program turned itself off and could not be accessed, Also - I tried SuperAntiSpyware, Managed to get a full scan which showed up things such as, from memory:
Trojan.Agent
Trojan.Unknown Origin
Trojan.Gneric etc.
something to do with Win32

So the scan finishes, asks that i restart for changes to take effect, i do so - and when it restarts i get a message saying:

RUNDLL
Error loading pgrs.tmo
the specified module could not be found.

And now SuperAntiSpyware will not work either, and it seems the scan was not completed fully.

I have tried running your dds Program which stops the moment it starts.
and i tried the GMER scan which carries out, then cancels when it reaches the end.

I'd also like to mention i cannot start the computer up in safe mode either.
I'm not the most computer savvy person but will follow the best i can.

I'm at a loss now and would appreciate any help, Thankyou.

Ahero · 11-05-2009, 08:10 AM

Bump, Please.

Ahero · 11-07-2009, 05:55 PM

And another..

Ried · 11-11-2009, 10:23 PM

Hello Ahero,

If you still require assistance, download this tool and save it directly to your desktop - not a folder on the desktop. We'll use it shortly.

Next, please save this file to your desktop. Click Start->Run, and copy-paste the following bolded text into the Run box, and click OK.

"%userprofile%\desktop\win32kdiag.exe" -f -r

When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents in your next reply.

========================

Next, drag dds.scr into the Inherit.exe. Now run dds.scr again. Repeat the procedure with gmer, and post the logs for review.

Ahero · 11-12-2009, 08:35 AM

Hello,

Well it seems things have gotten worse since the first post, The Laptop no longer starts at all, it goes straight to a screen which gives me options for
'Safe mode'
'Safe mode with networking'
'Last known good configurations'
etc.

I can select one, it'll start to boot up, and then just restarts and takes me back to this screen in some vicious cycle.

I've no idea whether this is going to be treatable now or whether it's just a lost cause, so let me know if there's anything at all that could work for this now it's in such a state, if not i appreciate you stopping by to help.

I've already changed all passwords and such on a safe system.

Thanks.

Ried · 11-12-2009, 08:30 PM

Please tell me what version of Windows you have installed. XP, XPPro, SP1, SP2, SP3 ?

11-02-2009, 02:36 AM	#1 (permalink)
Ahero Registered User Join Date: Nov 2009 Posts: 4 OS: XP	Req Help: Possible Trojan Hey, For the past 2 days or so i've been having a problem. It started when i had an alert warning me my firewall was off (it was on before) and that i have security alerts on my computer, and that i should click on something to fix it (I didn't), I head to my firewall, see that's it's somehow turned off, and turn it back on. I immediatly head to my anti virus and malware bytes programs and try and run scans, however they will not open, i get a message saying "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item." I also notice thatm when browsing the internet (firefox) random websearches will be redirected to shopping/banking websites such as ebay (which i do not use on this computer). So first thing i've done so far, was try and re-install malware bytes, renaming it and trying to run it, i got up to the stage of starting a scan, but then the program turned itself off and could not be accessed, Also - I tried SuperAntiSpyware, Managed to get a full scan which showed up things such as, from memory: Trojan.Agent Trojan.Unknown Origin Trojan.Gneric etc. something to do with Win32 So the scan finishes, asks that i restart for changes to take effect, i do so - and when it restarts i get a message saying: RUNDLL Error loading pgrs.tmo the specified module could not be found. And now SuperAntiSpyware will not work either, and it seems the scan was not completed fully. I have tried running your dds Program which stops the moment it starts. and i tried the GMER scan which carries out, then cancels when it reaches the end. I'd also like to mention i cannot start the computer up in safe mode either. I'm not the most computer savvy person but will follow the best i can. I'm at a loss now and would appreciate any help, Thankyou.

11-05-2009, 08:10 AM	#2 (permalink)
Ahero Registered User Join Date: Nov 2009 Posts: 4 OS: XP	Re: Req Help: Possible Trojan Bump, Please.

11-07-2009, 05:55 PM	#3 (permalink)
Ahero Registered User Join Date: Nov 2009 Posts: 4 OS: XP	Re: Req Help: Possible Trojan And another..

11-11-2009, 10:23 PM	#4 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: Req Help: Possible Trojan Hello Ahero, If you still require assistance, download this tool and save it directly to your desktop - not a folder on the desktop. We'll use it shortly. Next, please save this file to your desktop. Click Start->Run, and copy-paste the following bolded text into the Run box, and click OK. "%userprofile%\desktop\win32kdiag.exe" -f -r When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents in your next reply. ======================== Next, drag dds.scr into the Inherit.exe. Now run dds.scr again. Repeat the procedure with gmer, and post the logs for review. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

11-12-2009, 08:35 AM	#5 (permalink)
Ahero Registered User Join Date: Nov 2009 Posts: 4 OS: XP	Re: Req Help: Possible Trojan Hello, Well it seems things have gotten worse since the first post, The Laptop no longer starts at all, it goes straight to a screen which gives me options for 'Safe mode' 'Safe mode with networking' 'Last known good configurations' etc. I can select one, it'll start to boot up, and then just restarts and takes me back to this screen in some vicious cycle. I've no idea whether this is going to be treatable now or whether it's just a lost cause, so let me know if there's anything at all that could work for this now it's in such a state, if not i appreciate you stopping by to help. I've already changed all passwords and such on a safe system. Thanks.

11-12-2009, 08:30 PM	#6 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 27,112 OS: WinXP and Vista	Re: Req Help: Possible Trojan Please tell me what version of Windows you have installed. XP, XPPro, SP1, SP2, SP3 ? __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."