Please help. Unable to remove Trojan (Resolved)

Sorry, I missed that part out.
Refresh the page and look at the code box now.
 
Oh. So I already did it without :processes

Sorry for being impatient. Below is the report I obtained:

All processes killed
========== FILES ==========
D:\$RECYCLE.BIN\S-1-5-21-1171192100-3469164339-847101491-1000\desktop.ini moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SR4PIAG2\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYUA34UW\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NHJNGCI9\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AY0OR80\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SR4PIAG2\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYUA34UW\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NHJNGCI9\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AY0OR80\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes

User: James
->Temp folder emptied: 76293068 bytes
File delete failed. C:\Users\James\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 24524431 bytes
->Java cache emptied: 57055012 bytes
->FireFox cache emptied: 48553921 bytes
->Google Chrome cache emptied: 35510766 bytes

User: Public

User: Sabina
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
File delete failed. C:\Windows\DUMP4440.tmp scheduled to be deleted on reboot.
%systemroot% .tmp files removed: 137319958 bytes
%systemroot%\System32 .tmp files removed: 3334776 bytes
Windows Temp folder emptied: 6771209 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 371.39 mb


OTM by OldTimer - Version 3.0.0.5 log created on 07302009_231419

Files moved on Reboot...
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SR4PIAG2\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYUA34UW\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NHJNGCI9\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AY0OR80\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SR4PIAG2\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYUA34UW\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NHJNGCI9\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8AY0OR80\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini scheduled to be moved on reboot.
File move failed. C:\Windows\DUMP4440.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...
 
Where does Spybot find it now ?


Uninstall Combofix
  • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
  • Click START, type RUN into the search box, then click Enter
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
    • CF_Cleanup.png



Uninstall OTMoveIt (OTM.exe)
  • Open OTMoveIt Click Cleanup,
  • When a box pops up click YES.
 
Spybot detects it when I right click on the recycle bin file inside the in D:\ .

I am running a full Spybot scan now to see if it picks it up that way too. I first scanned the recycle bin with Spybot because Avira kept freezing when it reached it and was unable to complete a full scan. When I ran Kaspersky (on your advice) it also froze at this same file. However, Avira and Kaspersky now detect nthing AND complete their scans.

I will follow the instructions you have just posted and will post the results of the full Spybot scan - though I'm not even sure if it is configured to scan the $RECYCLE.BIN folder under the basic 'scan for problems' option.
 
After I uninstalled Combofix, hidden files disappeared. I re-selected 'show hidden files and folders.'

Right-clicking the recycle bin file inside inside the $RECYCLE.BIN folder with Spybot still finds:

Spybot Search & Destroy (Malware)
desktop.ini nothing found

Spybot Search & Destroy (Heuristic)
desktop.ini Win32.Buzus.amit

The 'full' Spybot scan found nothing.

OTM.exe does not appear to have uninstalled. Also, on restarting the computer I get error messages (x7) from ERUNT.
 
What error message do you get from Erunt ?
( I suspect it's due to UAC )

Navigate to D:\ Right click on $RECYCLE.BIN and select Delete.
Click yes to any warnings.
Now delete something from the D: drive so that it gets recreated. (doesn't matter what, you can just create a new text document and delete that)
You may get a couple of error warnings, just click OK/Yes.

Reboot and see if spybot still finds a problem with the folder.
 
I didn't get an eror report this time from Erunt. I was getting something along the lines of 'unable to save, will have to restore manually'

I think I followed your instructions correctly. After re-start, $RECYCLE.BIN reappeared. Right-clicking and scanning with Spybot now looks different, but still finding Trojan:

Spybot Search & Destroy (Malware)
$I5WWNIV.doc Nothing found
$R5WWNIV.doc Nothing found
desktop.ini Nothing found


Spybot Search & Destroy (Heuristic)
$I5WWNIV.doc Nothing found
$R5WWNIV.doc Nothing found
desktop.ini Win32.Buzus.ini
 
There are 2 desktop.ini icons on my desktop.

I scanned both with Spybot.

Results from the first one:

Spybot Search & Destroy (Malware)
$I5WWNIV.doc Nothing found
$R5WWNIV.doc Nothing found
desktop.ini Nothing found
desktop.ini Nothing found


Spybot Search & Destroy (Heuristic)
$I5WWNIV.doc Nothing found
$R5WWNIV.doc Nothing found
desktop.ini Nothing found
desktop.ini Win32.Buzus.ini

The second one:

Spybot Search & Destroy (Malware)
desktop.ini Nothing found


Spybot Search & Destroy (Heuristic)
desktop.ini Nothing found

A scan of both 5 minutes later and they are both clean. !?

The recycle bin in D still shows as infected though.
 
Let's have a look at those files and see what Spybot is getting upset at

Create A Batch File
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it look.bat Please save it on your desktop.

@echo off
Set "Kfiles=%temp%\Kfile.txt"
Set "Results=%temp%\Kresults.txt"
Echo Searching ..... Please Wait
dir "%Userprofile%\Desktop\*.*" /L /A /B /S|Find "desktop.ini" >> "%Kfiles%"
dir D:\$RECYCLE.BIN\*.* /L /A /B /S|Find "desktop.ini" >> "%Kfiles%"
For /f %%G in (%Kfiles%) do (
Echo %%G >> "%Results%"
Echo. >> "%Results%"
type %%G >> "%Results%"
Echo. ================= >> "%Results%"
Echo. >> "%Results%"
)
Echo Finished
start notepad "%Results%"
del /q %0
exit
Click to expand...
Right click >> Run As Admin on look.bat

Notepad will open, please copy/paste the results here.
 
c:\users\james\desktop\desktop.ini


[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183
[LocalizedFileNames]
Windows Defender.lnk=@%ProgramFiles%\Windows Defender\MsMpRes.dll,-104
Windows Media Player.lnk=@%SystemRoot%\system32\unregmp2.exe,-4
Hearts.lnk=@%SystemRoot%\system32\gameux.dll,-10056
=================

d:\$recycle.bin\s-1-5-21-1171192100-3469164339-847101491-1000\desktop.ini

[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
=================
 
It's a false positive.
I just checked the same folder on my machine and got the same warning.

I will report it to the Spybot team.


Congratulations your logs look clean :)

You can delete any logs we have produced, and empty your Recycle bin.

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.


You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

  • AntiSpyware is not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
  • Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
  • MalwareBytes Anti-malware <<< A New and effective program
  • a-squared Free <<< A good "realtime" or "on demand" scanner
  • superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

  • These programs don't detect malware, they help stop it getting on your machine in the first place.
    Each does a different job, so you can have more than one
  • Winpatrol
    • An excellent startup manager and then some !!
    • Notifies you if programs are added to startup
    • Allows delayed startup
    • A must have addition
  • SpywareBlaster 4.0
    • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
  • SpywareGuard 2.2
    • SpywareGuard provides real-time protection against spyware.
    • Not required if you have other "realtime" antispyware or Winpatrol
  • ZonedOut
    • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
  • MVPS HOSTS
    • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
    • For information on how to download and install, please read this tutorial by WinHelp2002.
    • Not required if you are using other host file protections

Internet Browsers

  • Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
    Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

  • Temporary Internet Files are mainly the files that are downloaded when you open a web page.
    Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
    It is a good idea to empty the Temporary Internet Files folder on a regular basis.

    Tracking Cookies are files that websites use to monitor which sites you visit and how often.
    A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
    CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

    Both of these can be cleaned manually, but a quicker option is to use a program
  • ATF Cleaner
    • Free and very simple to use
  • CCleaner
    • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'
 
Thank you so much! My computer runs better now - scans are able to complete and system seems faster. I really appreciate it a lot. Just a few questions:

1) Can I delete Erunt?

2) Is Malwarebytes Anti-malware safe for beginners to use? (I suppose it is since you recommend it in your post)

3) Can I delete the itms from Malwarebytes' Quarantine?

4) (This is probably for a new thread) - You must have noticed 'jetico personal firewall disabled' in my logs. When I first bought the laptop I installed Jetico, found it wasn't for me, then tied to uninstall it which messed up the computer totally. Someone managed to recover my system but they couldn't remove Jetico. Should I bother trying to get rid of it?

Once again - thank you very much for al you have done.
 
1) ....
You can uninstall Erunt if you like, but it's a wise idea to backup the registry every so often.

you can stop it from running at startup if you like..


Fix With HJT
Please note:- Due to the restrictions on Vista, all tools should be started by Right-Click >>> Run As Administrator
Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
Click to expand...
- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis


----------------------------------------------------------------------------------------

2) MalwareBytes is safe to use regardless of your computer knowledge.
3) Yes :)

----------------------------------------------------------------------------------------

4) let's see what we can do .....

First let's find out what is left.


Download and Run SystemLook

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    Code: 
    :dir
C:\Program Files\Jetico /s
:filefind
BCUnInstall.exe
bcfilter.sys
bcftdi.sys
bc_hash_f.sys
bc_ip_f.sys
bc_ngn.sys
bc_pat_f.sys
bc_prt_f.sys
bc_tdi_f.sys 
:folderfind
Jetic*
:regfind
Jetic
jpf.exe 
:comment
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
 
How long should the SystemLook Scan take, approximately? It has been scanning for just over 1 hour now. At least I think it is still scanning...
 
Have a look for SystemLook.txt on your desktop.

If you find it, open it and post the contents here.
 
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 15:41 on 31/07/2009 by James (Administrator - Elevation successful)

========== dir ==========

C:\Program Files\Jetico - Unable to find folder.

========== filefind ==========

Searching for "BCUnInstall.exe"
C:\Windows\BCUnInstall.exe --a--- 212992 bytes [04:24 02/03/2007] [06:21 24/10/2006] EEC14514BA65C309564C231EAAD47F7C

Searching for "bcfilter.sys"
C:\Windows\System32\DriverStore\FileRepository\netsf_xp.inf_80145407\DriversXP_i386\bcfilter.sys --a--- 23656 bytes [04:24 02/03/2007] [05:58 26/01/2007] AD4F5C4D4CE453EBB5D3C26FD2DED790
C:\Windows\System32\DriverStore\Temp\{53c98c82-a91f-4c2c-a8a5-d737a35fc361}\Package\DriversXP_i386\bcfilter.sys --a--- 23656 bytes [04:24 02/03/2007] [05:58 26/01/2007] AD4F5C4D4CE453EBB5D3C26FD2DED790

Searching for "bcftdi.sys"
C:\Windows\System32\drivers\bcftdi.sys --a--- 37096 bytes [04:24 02/03/2007] [09:20 28/02/2007] 582F02A46866EB7F16962E1186660F10

Searching for "bc_hash_f.sys"
C:\Windows\System32\drivers\bc_hash_f.sys --a--- 13800 bytes [04:24 02/03/2007] [12:09 27/02/2007] 645976A39D311AE42D8569BB55D85CBE

Searching for "bc_ip_f.sys"
C:\Windows\System32\drivers\bc_ip_f.sys --a--- 27624 bytes [04:24 02/03/2007] [12:09 27/02/2007] 9283A2440A0898C010AE816F75B8EA4C

Searching for "bc_ngn.sys"
C:\Windows\System32\drivers\bc_ngn.sys --a--- 17640 bytes [04:24 02/03/2007] [12:03 31/01/2007] 1641F391D6EC7884B086EF7CD66CF5D0

Searching for "bc_pat_f.sys"
C:\Windows\System32\drivers\bc_pat_f.sys --a--- 13928 bytes [04:24 02/03/2007] [12:09 27/02/2007] 32605E59C20BA87C7F1EE0FAC060C974

Searching for "bc_prt_f.sys"
C:\Windows\System32\drivers\bc_prt_f.sys --a--- 13672 bytes [04:24 02/03/2007] [12:10 27/02/2007] 6AC80F18246E8FE3CC4B0BD5E6B02791

Searching for "bc_tdi_f.sys "
No files found.

========== folderfind ==========

Searching for "Jetic*"
No folders found.

========== regfind ==========

Searching for "Jetic"
 
You can exit System Look now, and delete it.

Download a fresh copy of Combofix and do the following ...

ComboFix.exe

Custom CFScript
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Code: 
    File::
C:\Windows\BCUnInstall.exe
C:\Windows\system32\drivers\bcfilter.sys
C:\Windows\system32\drivers\bcftdi.sys
C:\Windows\system32\drivers\bc_hash_f.sys
C:\Windows\system32\drivers\bc_ip_f.sys
C:\Windows\system32\drivers\bc_ngn.sys
C:\Windows\system32\drivers\bc_pat_f.sys
C:\Windows\system32\drivers\bc_prt_f.sys
C:\Windows\system32\drivers\bc_tdi_f.sys
Folder::
Driver::
bc_hash_f
bc_ip_f
bc_pat_f
bc_prt_f
bc_tdi_f
bcftdi
bcfilter
bcfilterMP
bc_ngn
bc_proto_f
Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Jetico\Personal Firewall]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\jpf.exe]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Jetico Personal Firewall]
[-HKEY_CURRENT_USER\SOFTWARE\Jetico\Personal Firewall]

ADS::
  • Save this as CFScript.txt and place it on your desktop.


    CFScriptb.gif


  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
 
Last edited:
You must log in or register to reply here.
Back
Top