system
January 28, 2009, 2:06am
1
hello i am having a virus problem with my computer and came here looking for some help i found one infected file using avast which it said was a win32:fasec[trj] in a file named matrix34112.exe, i googled sed virus and wound up here. Upon reading through various threads i decided to try out spyware terminator, and hopefully remove the file with that, well i ran the scanner and it did not find this same virus instead it found trojan.inject.aed in file C:\windows\system32\KMDNIns.exe
i am wondering if anybody would be able to help with with the removal of the virus i am pretty sure it was aquired when i tryed to download a licensing program on windows mediaplayer called aquaplay, i have sinced uninstalled said program. any help will be greatly appreciated . i am also wondering if these are the same thing.
system
January 28, 2009, 5:00am
2
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.ca.acer.yahoo.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://en.ca.acer.yahoo.com http://favorites.live.com/quickadd.aspx @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
system
January 28, 2009, 5:01am
3
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab http://www.blackberry.com/devicesoftware/AxLoader.cab http://download.bitdefender.com/resources/scan8/oscan8.cab Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
system
January 28, 2009, 8:50am
4
Welcome to the forums, needsgetridsofvirus.
Your HJT log does not show a firewall. Are you using one?
There is only one entry from the log that is questionable …
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
[ This entry is related to Windows Live Messenger but has been deactivated. Did you have this at one time? ]
I could not find info about matrix34112.exe nor KMDNIns.exe but I would suggest that these are parts of these malwares :
http://virscan.org/report/984963de82fea4a9510ece0137a76a37.html
trojan.inject.aed …
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_INJECT.JG
At this point, I suggest you use malwarebytes antimalware (MBAM) to be sure you are rid of this fake program. Please download the free MBAM from the link below, update it, and then run a scan with MBAM.
http://www.malwarebytes.org/mbam.php
Please let us know the results.
where did you get the fake crack/keygen containing the matrix34112.exe file? our network shield blocks access to the domains, which are distributing this family of malware… and why do you think you need to use any 3rd party tool? avast is able to deal with Win32:Fasec afaik…
system
January 28, 2009, 6:43pm
6
thank you for the replys they are much appreciated. when i first did a virus scan with avast i quarintined the file, but after that i was still having problems with the internet, which was happening before i did this. the crack/keygen came from mininova.org . the link for (mbam) is not working for me either.
system
January 28, 2009, 7:56pm
7
hi Maxx -
I only suggested MBAM since it appeared that avast! had gotten it but the OP seemed to still be having problems. So, I thought maybe something else might be in the mix.
hi needsgetridsofvirus -
system
January 28, 2009, 7:58pm
8
I got the internet explorer cannot display the page message, same thing when i tried to download it yesterday
system
January 28, 2009, 8:02pm
9
needsgetridsofvirus post:8:
I got the internet explorer cannot display the page message, same thing when i tried to download it yesterday
Try here
http://www.filehippo.com/download_malwarebytes_anti_malware/
system
January 28, 2009, 8:55pm
10
thanks for the link, after downloading (mbam) and running the scanner should i now remove it with (mbam)
Malwarebytes’ Anti-Malware 1.33
1/28/2009 12:54:58 PM
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
DavidR
January 28, 2009, 9:39pm
12
OK now you need to run MBAM again and select all those detections and click the Remove Selected button, see image, as according to your log file you didn’t take any action.
system
January 29, 2009, 7:03pm
13
hi needsgetridsofvirus -
I hope you have followed David’s advice above.
It would also be helpful if you could answer Maxx’s question that I have quoted below.
CharleyO: it has been answered already…
system
January 29, 2009, 7:50pm
15
Ok, Maxx … sorry but I some how missed it.
