SpywareDoctor can't remove Trogan

[evanesco]

I have Spware Doctor on my PC, and it's picked up a Trogan, but it can't fix it, what should I do?

[Carbon Dudeoxide]

Our Malware Specialists are currently offline but if you could look HERE to get a head start.

[evanesco]

Thanks for that. I've started foloowing the instructions. I've attatched the first log from SAS.

[Saving space - attachment deleted by admin]

[Broni]

Next logs, please.

[evanesco]

Next logs, please.

Sorry, I had to go out, I'm on it now 

[evanesco]

MBAM log attached.

[Saving space - attachment deleted by admin]

[evanesco]

HJT log attatched.

[Saving space - attachment deleted by admin]

[evanesco]

I think I've done everything required. My pc is actually running a lot better, just from the scans I've done, but obviusly I need some help with the complete removal of the trogan. I also wanted to ask which programmes are essential for start up, so I can disable the rest of them from running on start up.

[Carbon Dudeoxide]

If you're talking about the startup in MSCONFIG, the computer will work without any of them checked but I don't think it would stop the Trojan. I would wait until one of our malware specialists to have a look at the logs you've posted.

Don't worry, they will be online soon to give you a tune-up. 

[evanesco]

I'm not sure what MSCONFIG is, so I'll explain a bit more. When I turn on my pc, several programmes start, like nokia connectivity (which is for my phone, so I know I'm good to disable that on start up), things that run in the background that don't really need to and could be run when needed. How do I check what's running so I can disable what I don't need running?

[Carbon Dudeoxide]

Have a look here:

http://www.computerhope.com/tips/wintips.htm#38

[CBMatt]

I'm only going to be on for a little bit longer, but I'll go ahead and get the ball rolling.  It looks like SAS and MBAM cleared out quite a few infections for you, but you're not entirely in the clear just yet.  For now, we're only going to concern ourselves with the infections.  We can worry about your start-up entries later.


Once we start, you won't have access to this post anymore, so I recommend that you print out this post or save it to a Notepad file.  Open HijackThis and scan again.  Check the following entries, but don't do anything to them yet...

O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: (no name) - X$þ - (no file)
O2 - BHO: (no name) - Ø$þ - (no file)
O2 - BHO: (no name) - ˆ$þ - (no file)

O4 - HKLM\..\Run: [BarbieGirlsTray] C:\Program Files\Mattel\Barbie Girls\Mattel.BarbieGirls.Tray.exe

O20 - Winlogon Notify: iifdbaAs - iifdbaAs.dll (file missing)
O20 - Winlogon Notify: tuvvuro - tuvvuro.dll (file missing)

Now, close all windows (including this one) besides HijackThis, then click Fix Checked.  Close HijackThis and reboot into Safe Mode and enable hidden files and folders.

Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following (if present)...

Barbie Girls or Mattel Barbie Girls

Please note any other programs that you dont recognize in that list in your next response.

Navigate to and delete the following folder(s) if present...

C:\Program Files\Mattel\Barbie Girls

Navigate to and delete the following file(s) if present...

C:\WINDOWS\system32\iifdbaAs.dll
C:\WINDOWS\system32\tuvvuro.dll

Once you've done all of this, reboot into Normal Mode and post a new HijackThis log along with new SAS and MBAM logs so we can see if there's any other junk we need to clean up.  And just for the heck of it, also run a scan with SpywareDoctor and tell us the results.  Let me know how everything's running now and if you had any problems following my steps.

Also very important...
I don't see any anti-virus (SpywareDoctor is only anti-spyware) or firewall running on your computer.  This needs to be remedied as soon as possible!

[Carbon Dudeoxide]

Also very important...
I don't see any anti-virus (SpywareDoctor is only anti-spyware) or firewall running on your computer.  This needs to be remedied as soon as possible!

Here are some good Antivirus software:

http://www.computerhope.com/issues/ch000514.htm

Personally, I like AntiVir, AVG and McAfee.

Note, only have one antivirus software.

[evanesco]

Thanks I'm on it now.

[evanesco]

O2 - BHO: (no name) - rsion - (no file)
O2 - BHO: (no name) - X$þ - (no file)
O2 - BHO: (no name) - Ø$þ - (no file)
O2 - BHO: (no name) - ˆ$þ - (no file)

O4 - HKLM\..\Run: [BarbieGirlsTray] C:\Program Files\Mattel\Barbie Girls\Mattel.BarbieGirls.Tray.exe

O20 - Winlogon Notify: iifdbaAs - iifdbaAs.dll (file missing)
O20 - Winlogon Notify: tuvvuro - tuvvuro.dll (file missing)

Done

Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following (if present)...

Barbie Girls or Mattel Barbie Girls I couldn't remove this in safe mode, the installsheild wizard wouldn't start up, so I've removed it in normal mode.

Please note any other programs that you dont recognize in that list in your next response.

Navigate to and delete the following folder(s) if present...

C:\Program Files\Mattel\Barbie Girls Done

Navigate to and delete the following file(s) if present...

C:\WINDOWS\system32\iifdbaAs.dll
C:\WINDOWS\system32\tuvvuro.dll Niether were present.

Once you've done all of this, reboot into Normal Mode and post a new HijackThis log along with new SAS and MBAM logs so we can see if there's any other junk we need to clean up.  And just for the heck of it, also run a scan with SpywareDoctor and tell us the results.  Let me know how everything's running now and if you had any problems following my steps.

Also very important...
I don't see any anti-virus (SpywareDoctor is only anti-spyware) or firewall running on your computer.  This needs to be remedied as soon as possible!

I'm going to do the scans and logs now. I haven't got anti virus, becasue I thought it was in with Spyware Doctor, obviously not, and I thought my windows firewall was enough. I'll get sorted with this and then get me some anti-virus and a better firewall. Thanks =)

Oh, I didn't know how to reboot in safe mode and how to show hidden folders, I figured it out though.

[evanesco]

Actually, I've gone back to the malware removal thread, and realsing I don't have anti-virus, I'm doing that first. Logs will be on when they're done.

[Carbon Dudeoxide]

how to show hidden folders

You don't have to go to Safe Mode to view hidden files and folders.

Another CH link you might want to check out
http://www.computerhope.com/issues/ch000516.htm

We're (I'm?) drifting off topic now. I don't think it's necessary to re-post the logs.

*couch* Chris *cough*

[evanesco]

how to show hidden folders

You don't have to go to Safe Mode to view hidden files and folders. I know that, I was asked to go into safe mode to remove the mattel/barbie girls programme. The hidden folders was a seperate thing.

Another CH link you might want to check out
http://www.computerhope.com/issues/ch000516.htm

We're (I'm?) drifting off topic now. I don't think it's necessary to re-post the logs. Quote "Once you've done all of this, reboot into Normal Mode and post a new HijackThis log along with new SAS and MBAM logs so we can see if there's any other junk we need to clean up.  And just for the heck of it, also run a scan with SpywareDoctor and tell us the results.  Let me know how everything's running now and if you had any problems following my steps."

*couch* Chris *cough*

Do I need the logs?

[Carbon Dudeoxide]

I think the ones you've already posted are ok

[evanesco]

Erm, that's ok, but I don't kow what I'm supposed to be doing now. I thought I had to re-scan with SAS and MBAM, along with SpwareDoctor and post the logs. Now you're telling me I don't have to. So is it just a HJT log that's needed?

[CBMatt]

Sorry about the confusion.  I do want you to post new logs for HJT, SAS, and MBAM.  I think Carbon Dudeoxide has been drinking...




As for Safe Mode and hidden files...he posted a link for the latter above.  Here's a link for Safe Mode:
http://www.computerhope.com/issues/chsafe.htm




I will have to leave in just a minute, but one of the other specialists should come online soon.  If you receive further instructions from Broni or evilfantasy (or anyone else with a Malware Removal Specialist title), you'll be in good hands.  If neither of them instruct you, then I will be back later today to do it myself.

If you want to take care of your anti-virus and firewall first, that is completely acceptable.  In fact, it is encouraged.  For anti-virus, I suggest AVG Free 8.0; for a firewall, I suggest Comodo.  Windows Firewall is good to have, but it does very little to protect you.

[evanesco]

Thank you, I've got Avast, it was recommended on the malware thread. I'm going to get Comodo now, then I'll make a start with the other scans. Maybe Carbon Dudeoxide should take a little water with his =)

[CBMatt]

Heh.  Avast is also a good choice.  Good luck with your scans.  We'll hopefully have everything sorted before the day is over!

[evanesco]

Comodo is scanning right now. Does it take so long because I have my hard drive is at 75% capacity? I need to delete some music, I've got a cd player for heavens sake!

[Carbon Dudeoxide]

  I think Carbon Dudeoxide has been drinking...

I managed to keep it fresh this long. 

Depending on how many files you have and the total used space, it shouldn't take more than a few hours. My computer scans in about 1 hour.

[evanesco]

Jeez, that was a pain, I had to go out, and SAS took 3 hours, then crashed. Luckily it had completed the scan and made a log, which is attached.

[Saving space - attachment deleted by admin]

[evanesco]

Here's the MBAM log.

[Saving space - attachment deleted by admin]

[evanesco]

I ran spyware dotor and it came back clean, so I haven't done a log, and attached is the HJT log. Cheers peeps.

[Saving space - attachment deleted by admin]

[Broni]

I hope Chris won't mind for me to chime in, since he's not here.
I'll check startups as well.

[Broni]

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

- O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
- O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
- *O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
- *O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
- *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
- *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
- *O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
- *O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
- O4 - Global Startup: Event Reminder.lnk = ?
- *O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

4. Click on Fix checked button.

5. Restart computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

7. Delete following files/folders (if present):

- AskSBar folder from C:\Program Files

8. Restart in Normal Mode.

9. Post new HijackThis log.

[CBMatt]

I hope Chris won't mind for me to chime in, since he's not here.
I'll check startups as well.

Nope, I don't mind at all.  With my schedule, the help is appreciated.  I'm going out of town later tonight, so if he doesn't come back within the next few hours, I may need you to wrap this up for me.  But with any luck, there shouldn't be much of anything left to do.



evanesco,
I should note that those O2 and O3 entries are for an IE toolbar that uses the Ask search engine.  Personally, I think you're better off without them, but because they technically don't cause harm, it's up to you to decide whether you want them or not.

[evanesco]

Sorry peeps, I went to bed (I'm in the UK). I'm on it now though.

[evanesco]

Done that, here's the HTJ log.

[Saving space - attachment deleted by admin]

[evanesco]

Anyone???

[SuperDave]

It looks clean but then, I'm not a malware expert YET.

[evanesco]

It looks clean but then, I'm not a malware expert YET.

It does? Woot! I'll wait for comfirmation.

[evilfantasy]

Is this your PC-manufacturer or Internet Provider? www.iqon.ie

Other than that question everything looks fine.

Final steps.

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

To prevent unknown applications from being installed on your computer install WinPatrol 2008
Using Winpatrol to protect your computer from malicious software

Another thing I would suggest installing SiteAdvisor. SiteAdvisor rates sites on business practices and spam.

SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
Using SpywareBlaster to protect your computer from Spyware and Malware

Check out Keeping Yourself Safe On The Web for tips and free tools to keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Stand Up and Be Counted ---> Malware Complaints  <--- where you can make difference!

[evanesco]

Yer, it's an iqon pc, and that's the homepage. I'm just going through what you posted. Thanks everyone. I really hope I don't have to come back to this particular board, but I'll be visiting the rest of the forum =)

[evanesco]

One more question. If I use Spyware Blaster, will this mean that I don't need to renew my subscription for Spyware Doctor?

[evilfantasy]

No Spywareblaster works in a completely different way.

Using SpywareBlaster to protect your computer from Spyware and Malware

[evanesco]

Ok. Thanks. I'm gonna plough through those links you gave me. And keep it clean. Honestly. Thank you so much. I can't believe you guys do this for free, I've been searching for a 'donate' button, alas, there really isn't one!

[evilfantasy]

Glad we could help.

http://www.computerhope.com/donate.htm

[evanesco]

Glad we could help.

http://www.computerhope.com/donate.htm

Done with pleasure. =)

[SuperDave]

Is this your PC-manufacturer or Internet Provider? www.iqon.ie

Other than that question everything looks fine.

I told you so.LOL