This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Possible trojan(s)

163 min read

This thread's last reply is from September 10, 2009, 4:09 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

Jack&Jill
August 28, 2009, 1:57 PM UTC
Hi xRavageDx :),

Your Adobe Reader is outdated. Older versions have security vulnerabilities that can be exploited.

Please update your Adobe Reader to the latest.
It is important that you uninstall any previous versions by using Add/Remove programs in your control panel before installing a newer version. Please uninstall:

Adobe Reader 7.0

  • Go to the Adobe download page. Click here.
  • If your OS is not the same as stated, click on Different language or operating system? link, or you can click Download if it is and jump to the last step below.
  • Choose an OS by clicking on Select an OS... box and change the language if you want by clicking English below Select a language title.
  • Press Continue.
  • Click the Download now button and save the file to a convenient location after selecting the latest version. Allow if prompted.
  • Run the downloaded file to continue with the installation.


Your Java Runtime Environment is outdated. Older versions have security vulnerabilities that can be exploited.

Please update JRE to the latest.
It is important that you uninstall any previous versions by using Add/Remove programs in your control panel before installing a newer version. Please remove:

J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 14
Java(TM) 6 Update 7

  • Go to the Java SE download page. Click here.
  • Look for Java SE Runtime Environment (JRE) 6 Update 16. Click the Download button to the right.
  • Select Windows from the drop-down list for Platform.
  • Check I agree to the Java SE Runtime Environment 6u16 with JavaFX 1 License Agreement after reading it, and click Continue. The page will refresh.
  • Under the Windows Offline Installation title, click on the link which says jre-6u16-windows-i586.exe and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Then, from your desktop, double-click on the download to install the newest version. Reboot your computer.


Fix with OTL
  • Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily. They will interfere and may cause unexpected results.
  • If you need help to disable your protection programs see here.
  • Double click on OTL.exe to run it.
  • Copy and paste the following text into the white box below Custom Scans/Fixes:
    :otl
    
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-21-4108422212-1370208996-429472200-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    
O7 - HKU\S-1-5-21-4108422212-1370208996-429472200-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  • Click Run Fix.
  • Please post the contents of the fix log file back here if you are prompted to open the file. It can also be found at C:\_OTL\Moved Files as MMDDYYY_HHMMSS.log where MMDDYYY is date format and HHMMSS is time format.
  • Enable back your security softwares as soon as you completed the OTL fix steps.


Remove LEGACY keys
  • Download RegASSASSIN© from Malwarebytes. Click here.
  • Double click on RegASSASSIN.exe to start it.
  • Read through the License Agreement and click I Agree.
  • Copy and paste the following text into the white box:
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_PHOOKS]
  • Click Delete.
  • Answer Yes to any prompts.


Please post back:
1. the OTL fix log
2. new HijackThis log
3. How did the Firefox reinstallation go?
4. Anymore problems?
xRavageDx
August 30, 2009, 10:08 PM UTC
Firefox is working now, I had to move back to VA and I don't have a steady internet connection for the laptop in question so it may be a couple days before I can get to downloading the updates and fixes.
Jack&Jill
September 3, 2009, 12:25 AM UTC
Hi xRavageDx,

How are things going?
xRavageDx
September 3, 2009, 4:47 AM UTC
Should be able to get it to the local spot for wi-fi in the next couple of days when I go out job hunting. I wound up in SW Va where the internet is a new thing apparently... The connection I'm on now is slower than dial up, it's amazing.
Jack&Jill
September 8, 2009, 1:25 PM UTC
Hi xRavageDx :),

It has been more than 5 days since your last reply. I know you are having some problems getting a good connection, but it is taking too long. If you are unable to follow the topic and reply within 3 days, I suggest we close this topic first. When you have the free time and good internet connection, you may start a new topic to check how is the computer is doing. What do you say?
Shaba
September 10, 2009, 4:09 AM UTC
lack of response