Trojan attack

Hi touranagram

Please do the following...

Open Notepad!
Copy and Paste everything from the Quote box into Notepad:

del \\.\C:\Program Files\Windows NT\com4.exe
del \\.\C:\Program Files\Common Files\Services\com4.exe

Go to File > Save As
Save File name as "Fix.bat" (including quotes)
Save the file to your desktop.

Close Notepad, and double-click Fix.bat on your Desktop. A window will open and close. This is normal.

Reboot the computer and check that those files are gone.

Did as you said and they are still there.. mmm strange they are write protected files which I cannot change

What is the File System of the computer - FAT32 or NTFS?

Please do the following...

Download Fixgrom.zip from any of the locations below and unzip it to your desktop. (do not run from within the archive)

http://aknow.prevx.com/zeroL/FixGrom.exe
http://pcalsicuro.phpsoft.it/FixGrom.exe

1. Doubleclick FixGrom.exe
2. Click Scan.
3. If you get a warning that the Rootkit Component was not found on the system, answer YES to the question if you want to continue removal anyway.
4. Prevx will ask you to reboot, click OK.
5. After reboot, Prevx will scan your system, this might take a couple of minutes, please be patient.
6. When done, click Exit.
7. Answer No to the question if you want to download and install Prevx1 now.
8. A log will be created named C:\gromozon_removal.log, please post that back here.

Hi touranagram!

It seems like you have a nasty infection which is preventing those files from deleting. I hope we can get your computer fully cleaned up with help from other experts.

Sorry been away yesterday. the file system is NTFS. Do you still want me to do the Fixgrom.exe?

As requested

Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Program Files\Common Files


Trojan.Gromozon does not exist - your system is clean.

Hope that helps

Hi touranagram! Sorry for the delay. Lets try this.

Download http://images.malwareremoval.com/Kimberly/cleanme.zip

Unzip to your desktop.
Boot into Safe Mode.
Double-click cleanme.bat
The cacls command will ask for confirmation, anwser Y (Yes)
Notepad will open with c:\log.txt, I will need that later on.
Reboot in Normal Mode and double-check if the files are still present.
Please post the content of c:\log.txt

The log file only has..

checking files

It ran in a dos window ok and stopped. Have I not waiting long enough (5 mins maybe). there was NO disc activity ongoing...

The files are still there as well. Do I need to leave it for ages?

Sorry I have done it wrong..

I will get back to you on that, but for now can I get you to do this please...

Start > Run > type control userpasswords2 and hit enter. Post all accounts you don't recognize as a reply

Thanks!

3 users I do not see normally

Administrator

which is not on the normal start up page but on the safe mode. I assume that is OK

Then we have these two administrator passwords which I have never seen

YePV
yKAPYJTjVdj

That looks pretty bad to me, shall I delete these?

I'm waiting to hear back from the expert assisting me with this. Shouldn't be too long.

Hi touranagram! Here we go...

You may want to print this out as the Internet will not be available once in Safe Mode

1. Lets delete those bad accounts...

Go to Start > Control Panel > User Accounts

Select these Accounts, one by one, and click on Delete Account

YePV
yKAPYJTjVdj

2. Reboot the computer back in Safe Mode.

3. Once in Safe Mode, Double-click cleanme.bat
When you start the batch file, you will see this message :

Cacls command will ask for confirmation, press Y
Press any key to continue ...

Press any key, the batch will now run the cacls command. It will popup with a message "Are you sure ?". Type "Y" and hit enter on the keyboard.
This will happen twice.
The DOS window should now close and notepad will pop up. If the DOS window does not close, close it yourself.
*Notepad will be saved to c:\log.txt*
Reboot in Normal Mode and double-check if the com4.exe files are still present. Let me know!
Please post the content of c:\log.txt

OK here goes.

Could not find the 2 user accounts within the control panel they were not listed so I used the control userpasswords2 and I deleted them there.

Rebooted into safe mode and tried to run the batch file again but the same happened the dos window opened and lots of commands/info wizzed by and it closed. the Logfile opened and froze at

checking files

The files are still there and they are read only still so I cannot delete them manually.

The batch file seems not to work correctly what am I doing wrong?

Hope that helps and thanks for you help so far its been much appreciated

Hi touranagram

Please do the following...

Go to C:\Documents and Settings and look for these Folders:

YePV
yKAPYJTjVdj

If they are found, right-click on them and select Delete.
______________________________

Please download The Avenger by Swandog46 to the Desktop.
http://swandog46.geekstogo.com/avenger.zip
Click on Avenger.zip to open the file
Then, extract avenger.exe to the Desktop

Next, copy all the blue text below to the Clipboard by highlighting it and pressing Ctrl+C:

Files to delete:
C:\Program Files\Windows NT\com4.exe
C:\Program Files\Common Files\Services\com4.exe

Start The Avenger program by clicking its icon on the Desktop.
Under: Script file to execute, select: Input Script Manually
Now click on the Magnifying Glass icon
It opens a new window titled: View/edit script
Paste the text copied to clipboard into this window by pressing Ctrl+V.
Click Done

Next, click on the Green Light to begin the execution of the script
Answer Yes twice when prompted.

The Avenger automatically does following:
Restarts the computer.
On reboot, briefly opens a black command window on the Desktop. This is normal.

After the restart, it creates a log that opens with the results of Avenger’s actions.
This log is located at C:\avenger.txt

Please provide C:\avenger.txt in your reply.