Download trojan blocker??? Ruining my life

[Cawndor]

Does anyone know anything about this trojan? When I try to download something (for example, netflix viewer or quicktime) I am immediately prompted with a Security Alert that reads "Your current security settings do not allow this file to be downloaded". I've tried everything such as; lowering all internet sec. settings and even turning off all my firewalls. The guy from dell said it sounds like malware and that it is a 'download trojan blocker'. He offered to help, but for a fee of $130. Anyone who has any info on how to remove this or what exactly this is, would be greatly appreciated. Thanks

[Cawndor]

p.s. I've tried to download Deckard's System Scanner, but I can't because of this security warning.

[Cawndor]

I want to apologize for not posting all of this info in my original post, I did not find the 5 STEPS BEFORE LOGGING until afer posting, and I apologize. Hopefully someone can still help with the following info provided.

I am using a Dell Notebook INSPIRON E1505.

STEP 1: I removed all malware listed on my computer from the 'add/remove programs'.

STEP 2: I ran 3 Panda Active Scans on MY COMPUTER. The FIRST scanning stopped (although the progress bar was only 1/4 of the way complete)at 39367 Filesscanned on the file "ers\video\onboard\oemdspif.dll". It found 6 viruses and 41 spyware (I have listed the report below). The SECOND and THIRD scans both quit unexpectedly at 81358 Files scanned on the file "C:\ntldr". This caused all of my IE windows to close.

STEP 3: I could not complete STEP 3. I can not download the recommended SPYWARE BLASTER or IE Spybad due to the 'SECURITY ALERT'.

STEP 4: I have SERVICE PACK 2 and when I clicked on the direct link to download SP1a I got the 'SECURITY ALERT' again. I WAS able to update from MICROSOFT WINDOWS UPDATE PAGE these 2 critical updates: Windows Genuine Advantage Validation Tool (KB892130) and Microsoft .NET Framework 2.0 Service Pack 1 (KB110806).

I just restarted my computer after installing CRITICAL UPDATES.

Here is the 1st PANDASCAN REPORT (the program quit on the 2nd and 3rd scans preventing me from getting the report):

Incident Status Location
Adware:adware/outerinfo Not disinfected Windows Registry
Adware:Adware/Yazzle Not disinfected C:\1F1.tmp
Virus:Trj/Downloader.RQM Disinfected C:\1F2.tmp
Virus:Trj/Downloader.OBC Disinfected C:\1F3.tmp
Adware:Adware/Yazzle Not disinfected C:\31F.tmp
Adware:Adware/Adband Not disinfected C:\321.tmp
Virus:Trj/Downloader.QDR Disinfected C:\324.tmp
Adware:Adware/Yazzle Not disinfected C:\85.tmp
Adware:Adware/Adband Not disinfected C:\86.tmp
Virus:Generic Trojan Disinfected C:\87.tmp
Adware:Adware/Yazzle Not disinfected C:\B5.tmp
Adware:Adware/InternetSpeedMonitor Not disinfected C:\B8.tmp
Virus:Trj/Downloader.MDW Disinfected C:\BC.tmp
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.ad.yieldmanager.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.com.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.targetnet.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.belnk.com/]
Spyware:Cookie/CentrPort Not disinfected C:\Documents and Settings\Steve\Application Data\Mozilla\Firefox\Profiles\4n4ls77i.default\cookies.txt[.centrport.net/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Steve\Cookies\steve@doubleclick[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Steve\Cookies\steve@tribalfusion[2].txt
Virus:Trj/Agent.HYH Disinfected C:\Documents and Settings\Steve\Local Settings\Temp\ismtpa9.exe

[Pancake]

Please download HijackThis to your desktop.. http://www.trendsecure.com/portal/en...HJTInstall.exe

Alternate link
http://download.bleepingcomputer.com...HJTInstall.exe

This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

======================


Please download SDFix from here and save it to your desktop


Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.


Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Post that log in your next reply.


=========================================


Download Combofix from any of the links below, and save it to your desktop. For further information regarding this download you can see this on this Information Page

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Caution...Never run and remove files using ComboFix without being supervised by a security analyst.

[Cawndor]

Pancake, I appreciate your response but unfortunately I cannot download anything. This includes HijackThis, SDfix or Combofix. When I click on the provided links, I am immediatly given the Security Alert that reads "Your current security settings do not allow this file to be downloaded". I can see the download box behind the warning, but I cannot access it. Is there anything else that I can try in order to give you the reports that you need, without downloading anything? My McAfee is expired and outdated, I would like to uninstall the version I have and update to a newer version, but I don't think I will be allowed to download it, due to this problem that I'm having. Thanks again for the rapid response. Greatly appreciated.

-Steve

[Pancake]

Try this and then see if you can download.

1. Start Internet Explorer
2. Click Tools, and then click Internet Options.
3. In the Internet Options dialog box, click the Security tab.
4. Click Local intranet, and then click Custom Level.
5. Under Reset Custom Settings, click Medium in the Reset to list.
6. Click OK two times.
==============================

This will help remove Mcafee

http://service.mcafee.com/FAQDocumen...107083&lc=4105

[Cawndor]

I have tried numerous times (and again recentlyas suggested) changing my security settings within IE. No dice. I am still unable to download anything. Also in regards to Mcafee, I can UNINSTALL it, but I was going to download the newest version from comcast.com (which would be free), and I am afraid, and pretty confident that this virus will prevent me from downloading it, therefore leaving my computer with ZERO anti-virus protection. I've been getting suggestions from friends about actions to take, but most suggestions involve reinstalling my OS or going back a few months to a system restore point previous to when I first noticed the virus. I am holding off on all that unless it is something that you guys feel would work. Thanks again for your time.

-Steve

[Pancake]

Try the System Restore before you think of reinstalling windows.

[Cawndor]

Just finished System Restore to 11/15/07. No luck. Still having the same problem.

[Pancake]

Ok I'm not sure why you cant download.You can always try one of our other forums as this is more in their line than mine.

[Cawndor]

ok. Is their any specific forum that deal with this type of virus?? I dont want to go invading every forum with my problem if there is a specific one that can help me. Thanks again for your time.

-Steve

[Pancake]

Its not a virus you have it has to be a configuration problem.Try here..

http://www.techsupportforum.com/micr...ws-xp-support/

[Cawndor]

ok I will, thanks again for you time.

Steve