Serious help needed...Please be the forum to help me!!!

Viruses and worms
1

I have 6 TrojanDNSChangers.
I have run Avast! but it doesn’t pick them up.
I have run Malwarebytes anti malwareware many times over, it finds them and deletes them. I then reboot my computer and cant log into a browser; so i reboot my router and then have internet back. I then run Malwarebytes again, and lo the 6 trojans are back again, its like a never ending loop.
I have constant popups, am being redirected to the weirdest sites, none of my antivirus will update and windows update always redirects to msn.com.

PLEASE tell me what to do to get rid of this.

Many thanks in advance.

Augera. ???

2

I suggest:

SuperAntiSpyware Free or MalwareByte’s AntiMalware.

3

How many antiviruses do you have?

4

I have run ‘Trojan remover’, ‘Avast Antivirus’, Malwarebytes’, ‘Superantispyware’; and many more, some find them and some don’t, but no matter how many times i remove them, they reappear after the computer has been rebooted.

5

augera,

You shouldn’t have more than one anti-virus on you computer. If you more than one, that may be the reason avast! wont update! Two or more anti-viruses will conflict resulting in less protection.

Trojan remover, Malwarebytes Antimalware & Superantispyware aren’t anti-viruses.

6

Try ESET’s Online scanner.
http://www.eset.com/onlinescan/
Requires Internet Explorer.

Don’t allow it to remove infections now.

7

if i don’t allow it to remove infections, what should i let it do?

8

that web site won’t load anyway >:(
i have only one antivirus now and thats avast.

9

Post Malwarebytes Antimalware & Superantispyware scan results here.

10

I forgot to tell you to scan with Malwarebytes Antimalware & Superantispyware in safe mode.

11

ah…ok, will start again lol

12

The reason for running Malwarebytes Antimalware & Superantispyware in safe mode is it’s easier for them to remove infections in safe mode.

I suggested not allowing ESET’s Online scanner to remove infections on first scan till we know what it finds. We don’t want to remove any false positives. Fp’s can be checked with http://www.virustotal.com/

I wanted you to post results of all scans so others in this forum that are more knowledgeable can give you better help than I can. They need to know what they’re dealing with.

13

Well here are the results:

Malwarebytes’ Anti-Malware 1.32
Database version: 1621
Windows 5.1.2600 Service Pack 2

06/01/2009 3:46:22 AM
mbam-log-2009-01-06 (03-46-18).txt

Scan type: Quick Scan
Objects scanned: 48492
Time elapsed: 1 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) → Data: 85.255.112.165 85.255.112.23 → No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces{a0473400-6470-4c41-8d6d-44fb658e2606}\DhcpNameServer (Trojan.DNSChanger) → Data: 85.255.112.165 85.255.112.23 → No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DhcpNameServer (Trojan.DNSChanger) → Data: 85.255.112.165 85.255.112.23 → No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces{a0473400-6470-4c41-8d6d-44fb658e2606}\DhcpNameServer (Trojan.DNSChanger) → Data: 85.255.112.165 85.255.112.23 → No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/06/2009 at 03:50 AM

Application Version : 4.24.1004

Core Rules Database Version : 3688
Trace Rules Database Version: 1664

Scan type : Quick Scan
Total Scan Time : 00:03:15

Memory items scanned : 153
Memory threats detected : 0
Registry items scanned : 344
Registry threats detected : 3
File items scanned : 5072
File threats detected : 8

Adware.Tracking Cookie
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@msnportal.112.2o7[1].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@mediaplex[1].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@apmebf[1].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@adbrite[2].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@partygaming.122.2o7[1].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@ad.yieldmanager[2].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@partypoker[2].txt
F:\Documents and Settings\Xp Pro\Cookies\xp_pro@atdmt[2].txt

Rogue.Component/Trace
HKLM\Software\Microsoft\0000FDEC
HKLM\Software\Microsoft\0000FDEC#0000fdec
HKLM\Software\Microsoft\0000FDEC#Version

14

Did Malwarebytes Antimalware & Superantispyware fail to remove infections in safe mode? I see no “action taken” in the logs.

15

i took no action when i was doing it, it makes no difference though, everytime i have done this before they simply reappear after a reboot.

16

You might want to try an anti-rootkit product like http://www.pandasecurity.com/homeusers/downloads/docs/product/help/rkc/en/rkc_en.htm