js.downloader-blr (trojan)

Viruses and worms
21

Before I proceed, I don’t understand this part of your instructions.

or insert your slipstreamed Windows XP (matching the Service Pack level of your system.)
System Restore core files will be reinstalled.

I don’t know what slipstreamed is. I have the installation discs provided with the computer. The Service Pack is either SP1 or SP2. I will have to check to see which. The computer has been updated to SP3. Do I need to acquire a “slipstreamed” media before proceeding, just in case I am prompted to do so?

I did check to see if your run command would reveal results. When I clicked OK I was greeted with an error message.

Windows cannot find ‘C:\WINDOWSINF’. Make sure you have typed the name correctly, and then try again. To search …

What do I need to do from here?

22

No as you have updated windows to sp3 then if it asks for any files point the programme to the service pack files on the system

Location of the service pack %Windir%\ServicePackFiles

Windows cannot find 'C:\WINDOWSINF'. Make sure you have typed the name correctly, and then try again. To search ...
The location is C:\windows\inf it is a subfolder of windows
23

Is %Windir%\ServicePackFiles the same as C:\WINDOWS\ServicePackFiles? If so, this is what I have found:

  • I located sr.inf.
  • The ServicePackFiles folder is not to be found. I also searched in SYSTEM and SYSTEM32 subfolders and did not find ServicePackFiles.

When attempting to install sr.inf according to your instructions, a new window opened. It said

The file ‘sr.sys’ on Windows XP Service Pack 3 CD is needed. Type the path where the file is located and then click OK.

In the drop down menu, there are two choices–> C:\Windows\inf\i386 and D:\ with no path shown in D drive. I believe this is where I use the CD. However, there is a hiccup. The Lady of the House thought she was doing me a favor by filing the installation discs somewhere. Now she cannot remember where she filed them. When she files stuff; it disappears, usually for months (if not forever).

To proceed from here, I will have to either find the discs or use an alternative source. Is there an alternative source I can use? (something like Digital River for Win7?)

24

I have a service pack 3 folder on my VM system

I am currently compressing it for uploading … Not sure where yet

Once done I will give you the link and if you could download it and unzip to the Windows directory you should be good to go

25

I’ll be on the look out for it. Will there be a different instruction set?

26

No just extract the entire set of folders within the zip to the subdirectory C:\windows\servicepackfiles (you may need to create the main folder)

Just uploading to dropbox now … Back in a bit

27

OK download link https://dl.dropbox.com/u/73555776/ServicePackFiles.zip

28

Thanks. At our sloooow internet speed, the download is showing one hour for completion. I may have to complete the task after work.

I have edited the start ups. I also created a new image backup in case something goes foul. I really don’t have a lot of trust in the XP Operating System at present. It has been somewhat quirky for a couple of years.

29

No problem, took me an hour to upload ;D But, I have no limits

30

Hmm… still no system restore…

I am including everything I did to help you troubleshoot.

I created the new folder → C:\windows\servicepackfiles . Then I extracted the zip file to the new folder and explored the folder to ensure that the files did, in fact, extract. I rebooted the computer. Upon reboot I attempted the three methods I know for creating a restore point.
[ol]- start>all programs>accessories>system tools>system restore → After clicking system restore, the computer returned to the desktop without executing. I had task manager running (on top) at the time. Task manager did not indicate any activity in the applications tab.

  • right click my computer and choose properties → There is no system restore tab in the window.- Control Panel>system → There is no system restore tab in the window.[/ol]
    This was all done in an administrator account.

What do we do next? I am exercising care to not attempt things not included in the instructions. I know that I could inadvertently screw something up that way.

drpepper

31

Now you have the files in the service pack folder do the initial part again. Locate SR.inf and right click select install
When it asks for the location of SR.SYS or any other file then in the dropdown for location select C:\windows\servicepackfiles

32

I am wondering if the OS problems are deeper than just System Restore issues.

Following your instructions, I selected install (sr.inf). The dropdown did not offer anything different than the previous post. I manually entered servicepackfiles in the C:\windows\ path and proceeded. After reboot the Control Panel and right click My Computer>properties methods returned the same results as before. When attempting to use System Restore under all programs>…>system tools the results were the same as before except task manager displayed

SysFader running
for about one second before going blank and returning to the desktop.

What are your thoughts?

33

Sysfader is something I have come across before so I had some references for that http://beyondteck.blogspot.co.uk/2006/05/how-to-stop-sysfaderexe-error.html

it is a part of Windows XP that provides all the so called "cool animation effects". These include fading menus in and out. Animating windows and so on. However, the fact is that you don't need sysfader on your computer. You're better off without it, especially if you're getting a lot of 'Sysfader.exe has crashed' errors or if your computer is running slow. Even if you don't think it's slow I recommend you read the whole article below.

Would you consider a repair install ? There is a description of it here along with how to do it http://www.geekstogo.com/forum/topic/138-how-to-repair-windows-xp/

34

I was preparing to do a repair install before the downloader issue. However, the installation discs I mentioned earlier still have not been found. Until I can find them I am pretty well stuck. I am going to search for an XP iso similar to the Win 7 iso available from Digital River. I have used the Win 7 iso successfully a couple of times. Other users can still use the XP computer for now. I am keeping everyone off my Win 7 machine!!!

Can I safely empty the Avast Virus Chest and enable real time protection for MBAM pro now? Is there anything else by way of cleanup?

drpepper

35

I will remove my tools now then, but there is one final option you may like to try. I will post at the end

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands [resethosts] [emptytemp] [CLEARALLRESTOREPOINTS] [Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done

Remove ComboFix
[*]Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
[*]In the Run box, type in ComboFix /Uninstall
(Notice the space between the “x” and “/”)
then click OK

http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg

[]Follow the prompts on the screen
[]A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that
[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.

http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:
[] Go to this site and click Do I have Java
[] It will check your current version and then offer to update to the latest version

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes.

Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?Keep safe :wave:

Possible help

Download Windows Repair (all in one) from this site

Install the programme then run

https://dl.dropbox.com/u/73555776/waio%20start.JPG

Go to step 3 and allow it to run SFC

https://dl.dropbox.com/u/73555776/waio%20step3.JPG

On the start repairs tab click start

https://dl.dropbox.com/u/73555776/waiostart%20rep.JPG

Select the following items and tick restart system when finished

https://dl.dropbox.com/u/73555776/waio%20rep%20list.JPG

36

Sorry for the delayed reply.

The extreme heat has been taking a toll on the aging infrastructure in our neighborhood. We have been experiencing frequent and unpredictable brown outs and total power failures. I don’t dare to perform any changes to the XP machine until I can be assured that I will not lose power before completing a task. I will perform tasks and reply after reliable electrical power has been restored.

drpepper

37

No problem I am subscribed to this thread