Resolved: This computer had a trojan on it please help

hi i avast how is it going on this fine day. i have a small problem the person who owns this computer told me today that the connection was really slow on this computer and that to go into programs on this computer it was really slow for the program to come up so i did a full system scan with avast free lasted program version and lasted definitions.

on completing the full virus scan avast did find a trojan and it deleteed it here are the details below;

c;\windows\softwareDistrion.…trzC4EA.tmp
Risk HIGH
Status; Threat; win32;Adware-BQN (TRJ)
action Delete
Result; action successful

So i will provide logs
i did a malwarebytes scan and nothing came up so their will be no log for malwarebytes free

operating system: Windows home premium

Monitoring. Await my reply. :slight_smile:

Hi Diddy,<$1alt=“” title=“” onresizestart=“return false;” id=“smiley__$2” style=“padding: 0 3px 0 3px;” />

My name is Valinorum and I will be the acolyte today. Before we proceed, please, acknowledge yourself the following(s):

  • Please do not create any new threads on this while we are working on your system as it wastes another volunteer’s time. If you are being helped/have solved the issue/no longer wish to continue, notify me in your reply and I will quickly close this thread. Failing to comply will result in denial of future assistance.
    • Please do not install any new software while we are working on this system as it may hinder our process.
    • Malware removal is a complicated process so don’t stop following the steps even if the symptoms are not found. Keep up with me until I declare you clean.
    • Please do not try to fix anything without being ask.
    • Please print or save the instructions I give you for quick reference. We may be using Safe mode which will cut you off from internet and you will not always be able to access this thread.
    • Back up your data. I will not knowingly suggest your any course that might damage your system but sometimes Malware infections are so severe that only option we have is to re-format and re-install the operating system.
    • If you are confused about any instruction stop and ask. Do not keep on going.
    • Do not repeat the steps if you face any problems.
    • I am not an omniscient. There are things even I cannot foresee. But what I know took years to learn and perfect the skill. This site is run by volunteers who help people in need in their own free time. I would ask you to respect their time and be patient as sometimes real life demands our time and replies to you can be delayed.
    • Private Message(PM) if and only if I have not responded to your thread within three days or your query is offtopic and personal. Do not PM me under any other circumstances. Your thread is the only medium of communication.
    • The fixes are for your system only. Please refrain from using these fixes on other system as it may do serious damage.

Please re-attach the Extras.txt. How many self-fix tools have you run?

  • Step #1 Fix with OTL

      [li]Re-run [b]OTL[/b] by right clicking and choosing [i]Run as administrator[/i];
      - Under the [i]Custom Scans/Fixes[/i] Box copy and paste the following contents inside the [i]code[/i] box.
    

    [/li]

:Commands
[createrestorepoint]

:OTL
FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
[2010/12/24 17:27:26 | 000,000,000 | ---D | M] (Oberon GamesBar) -- C:\Users\Gary\AppData\Roaming\Mozilla\Firefox\Profiles\ot4i06e5.default\extensions\gamesbar@oberon-media.com
O13 - gopher Prefix: missing
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
[1 C:\Users\Gary\AppData\Local\*.tmp files -> C:\Users\Gary\AppData\Local\*.tmp -> ]
[2014/06/17 11:58:28 | 000,015,984 | ---- | M] () -- C:\Users\Gary\AppData\Roaming\wklnhst.dat

:Commands
[emptytemp]

  •   [li]Click on [b]"Run Fix"[/b] and let the program run unhindered;
      - Your PC will reboot automatically and a log will be opened;
      - Please attach it in your next reply.
    
    [/li]

  • Step #2 Fix with AdwCleaner

      [li]Download [b]AdwCleaner[/b] by [i][b]Xplode[/b][/i] to your [i]Desktop[/i] from the following link.
    

[list]
[li]Download Link #1
- Download Link #2
[/li]
- Right-click on AdwCleaner.exe and choose Run as administrator;
- Click on Scan and let the program run unhindered;
- When done, click on Clean and allow the system to reboot after it is done;
- A log will be opened automatically after the restart;
- Attach the log in your reply.
[/list][/li]


  • Step #3 Fix with Junkware Removal Tool
    Download Junkware Removal Tool by thisisu to your Desktop from the link below.
    Download Link 1
    Download Link 2

      [li]Disable your anti-virus to avoid potential conflicts. For more information please acknowledge yourself [url=http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]this[/url] article;
      - Run the program either by double-clicking(Windows XP) or Right-clicking and choosing [i]Run as administrator[/i](Windows Vista and above);
      - Please be patient as the tool cleans your system;
      - After completion of the process a log named [b]JRT.txt[/b] will automatically open and is save to your Desktop;
      - Attach the log in your next reply.
    

    [/li]


  • Required Log(s):

      [li]OTL Fix Log
      - AdwCleaner Log
      - Junkware Removal Tool Log
    

    [/li]
    Regards,
    Valinorum

hi here the three logs yo asked for below;
otl fix log, adwcleaner log
JRT.txt

have good day

Diddy, I don’t know how many times we are going to say this too you. Stop using Zoek, adwcleaner, and other highly advanced programs. They are used for professionals trained by the program UNITE. They are not meant for untrained people. I don’t even use them, and I am in training.

Stick to Malwarebytes, Avast! (Or another AV) and a firewall of some sort. Don’t run suspicious programs, don’t go on suspicious sites, and you will be fine. (Same goes for emails, don’t go sifting through your spam box opening everything with an attachment)

Only use the programs like zoek, when/if a remover says you can, and under his/her supervision!

I asked you a question and expected an answer.

HI Valinorum I did not install and use Zoek and these other tools that you may have found on this computer with out a malware experts help in the first place I thought I had deleted some of these tools off the computer but I guess not. can we now contimue on with looking into this computer please to make sure it has no other viruses or trojans on it please thanks.

I did not install and use Zoek and these other tools that you may have found on this computer with out a malware experts help in the first place I thought I had deleted some of these tools off the computer but I guess not.
Helpers usually remove their tools after providing assistance. [i]Some of these tools[/i] -- how many tools are we dealing here?

I am not sure how many tools we are dealing with excatly and no not all the helpers remove their tools after helping but most of the helpers to give me a hand with removing the tools Valinorum

Hi,

How is your system running?

  • Step #4 ESET Online Scanner
    Disable your security programs which includes but not limited to anti-virus, anti-malware, anti-spyware et cetera. Peruse this for additional information.

      [li]Download [b]esetsmartinstaller_enu.exe[/b] by clicking [url=http://download.eset.com/special/eos/esetsmartinstaller_enu.exe][b]here[/b][/url].
      - Right-click on the program and choose [i]Run as administrator[/i].
      - Accept their terms and condition and proceed.
      - Install [b]Add-On/Active X[/b] if prompted.
      - From the [b]Computer Scan Setting[/b] --
    

[list]
[li]Uncheck the box beside Remove Found Threats;
- Check the box beside Scan archives
[/li]
- Click on Advanced Setting and check the following boxes–

		[li][b]Scan for potentially unwanted applications[/b]
		- [b]Scan for potentially unsafe applications[/b]
		- [b]Enable Anti-Stealth Technology[/b]
	[/li]
	- Click on [b]Start[/b] and wait for the [b]virus signature database[/b] to update.
	- The online scan will begin [i]automatically[/i] and can take several hours.

		[li][b]Note:[/b] Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
	[/li]
	- After the Scan finishes --
	- 
		[li][b]If no threats were found:[/b]

[list]
[li]Put a checkmark in Uninstall application on close.
- Close the program and report that nothing was found
[/li]
- If threats were found:

			[li]Open the file located in [b]C:\Program Files\ESET\ESET Online Scanner\log.txt[/b] (32-bit) or [b]C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt[/b] (64-bit).
			- Attach the log file in your next reply.
		[/li]
	[/list][/li]
[/list][b]Note:[/b] Enable your security programs afterwards.[/li]

  • Required Log(s):

      [li]ESET Log
    

    [/li]
    Regards,
    Valinorum

zoek is there, or was. AdwCleaner, which granted, only targets adware. But still, do not use it.

Now, too give you an idea. sUBS has posted and warned many people against such actions and use of Combofix. (THis goes for ALL tools, used by Valinorum, or Martin etc.)

http://www.bleepingcomputer.com/forums/t/273628/combofix-usage-questions-help-look-here/
http://www.techsupportforum.com/forums/showpost.php?p=1829551

HI Valinorum what does Micheal mean when he says not to install any tools you recommend are you a malware expert now or are you still in training.

my computer Valimorum is fine and is doing well. the reason I need help with the other computer is because yesterday avast free found a trojan on the Home premium machine

  1. Michael is still in training, he started about 2 months ago if i am right.
  2. Martin ( Martin Newton) is essexboy, who is an expert and teacher on Geeks2Go

hI Steven can you tell me why Micheal would say this about Esseboy then. Why would Micheal also say this about Valinoroum

Thanks Steven

I did not say anything. I said, don’t be running those tools WITHOUT them. Or at least that’s what I meant. Valinorum & Essexboy are fully trustable. When they are done, Remove those tools. That is all.

Edit: Also, please learn to spell my name correctly. It is Michael, not Micheal. Thanks.

Thanks Micheal for explaining to me what you mean I would never use some of these tools without a malware expert to help Micheal.

Thanks Micheal

You can find the Malware Analyst list here. Awaiting your ESET Scan log. Inform me about your PC’s condition.

HI Valinorum do you mean to download and run the eset scanner on the Windows 7 home premium system.

Thanks.

Re-read my instruction. You are implored to download the installer which will start the scanning upon installation. :slight_smile:

hi Valimorum i did the Eset online scanner on this computer Eset online scanner did find any threats.

Thanks Valimorum

i did the Eset online scanner on Windows 7 home premium