Trojan Virus Please help ESSEXBOY !! D:

[system]

Hello, Like many others i am receiving the nonstop Trojan Horse blocked alert, Win32:atrap-PF along with the malware win32 gin message i have the logs from the malware bytes results i have seen essexboy help many others with this so i would be very grateful if i could get help
Thank You

Here are the logs

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.07.08.05

Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
IAN FTW :: IANFTW [administrator]

Protection: Disabled

7/8/2012 11:50:05 AM
mbam-log-2012-07-08 (11-50-05).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 384509
Time elapsed: 41 minute(s), 6 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 35
HKCR\CLSID{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCR\TypeLib{44444444-4444-4444-4444-440044224458} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCR\Interface{55555555-5555-5555-5555-550055225558} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.BHO.1 (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCR\CLSID{22222222-2222-2222-2222-220022222258} (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.Sandbox.1 (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.Sandbox (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CLSID{33333333-3333-3333-3333-330033223358} (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.FBApi.1 (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.FBApi (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.BHO (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I Want This (Adware.GamePlayLabs) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.BHO (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.BHO.1 (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.FBApi (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.FBApi.1 (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.Sandbox (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCR\CrossriderApp0002258.Sandbox.1 (PUP.CrossFire.Gen) → Quarantined and deleted successfully.
HKCU\Software\Cr_Installer\2258 (Adware.GamePlayLab) → Quarantined and deleted successfully.
HKCU\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\215 APPS (PUP.CrossFire.SA) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKCR\CLSID{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKCR\TypeLib{44444444-4444-4444-4444-440044224458} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKCR\Interface{55555555-5555-5555-5555-550055225558} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) → Quarantined and deleted successfully.

Registry Values Detected: 2
HKCU\Software\InstalledBrowserExtensions\215 Apps|2258 (PUP.CrossFire.SA) → Data: I Want This → Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I Want This|Publisher (Adware.GamePlayLab) → Data: 215 Apps → Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:\Program Files (x86)\I Want This (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\Local Settings\Application Data\I Want This (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\Local Settings\Application Data\I Want This\Chrome (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\AppData\Local\I Want This (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\AppData\Local\I Want This\Chrome (Adware.GamePlayLab) → Quarantined and deleted successfully.

Files Detected: 15
C:\Program Files (x86)\I Want This\I Want This.dll (Adware.GamePlayLabs) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want This.exe (Adware.GamePlayLabs) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want ThisGui.exe (Adware.GamePlayLabs) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\Uninstall.exe (Adware.GamePlayLabs) → Quarantined and deleted successfully.
C:\Users\IAN FTW\AppData\Local\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) → Quarantined and deleted successfully.
C:\Users\IAN FTW\Downloads\FreeYouTubeDownloaderInstaller.exe (PUP.BundleInstaller.Somoto) → Quarantined and deleted successfully.
C:\Windows\Installer{69f6b531-2da1-806f-0770-c3132b06b9b7}\U\00000008.@ (Trojan.Dropper.BCMiner) → Quarantined and deleted successfully.
C:\Users\IAN FTW\AppData\Local\Temp.exe (Trojan.Agent) → Quarantined and deleted successfully.
C:\Users\IAN FTW\Local Settings\TempDIR\BetterInstaller.exe (PUP.BundleInstaller.Somoto) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want This.ini (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want This.ico (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want ThisInstaller.log (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\Local Settings\Application Data\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Users\IAN FTW\AppData\Local\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) → Quarantined and deleted successfully.
C:\Program Files (x86)\I Want This\I Want This.dll (PUP.GamePlayLab) → Quarantined and deleted successfully.

(end)

[Pondus]

Here are the logs

you say logs......i only see one ?

[system]

well when i did the malwarebytes full scan i just pasted what was in the log that came up.

[Pondus]

OTL and aswMBR log also…attach…not copy and paste

http://forum.avast.com/index.php?topic=53253.0

[system]

i dont know what otl or the other thing is either

[DavidR]

You don’t have to, the instructions and links, etc. are in the link that Pondus gave in his post above yours.

[system]

Well i just contacted support and they said it was a rootkit virus, one of the nastiest virus’s out

[Pondus]

@Anarchyx13 post:7

Well i just contacted support and they said it was a rootkit virus, one of the nastiest virus’s out

yeeees…and if you want it removed, then attach the missing logs from the guide i gave you

[essexboy]

OK the logs I am after are as follows

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

https://dl.dropbox.com/u/73555776/OTL_Main_Tutorial.gif

[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
services.*
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_CURRENT_USER\Software\Microsoft\Windows Media\WMSDK\Local\AutoProxyCache /s
CREATERESTOREPOINT
[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

Download aswMBR.exe ( 4.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the “Scan” button to start scan

http://dl.dropbox.com/u/73555776/aswMBRscan.png

On completion of the scan click save log, save it to your desktop and post in your next reply

http://dl.dropbox.com/u/73555776/aswMBRlog.png

[system]

here you go the attachments

[Pondus]

then he just need aswMBR…and Essexboy can start working when he is back tomorrow

[system]

Tomorrow? :o
ok well here is the aswMBR

[Pondus]

@Anarchyx13 post:12

Tomorrow? :o
ok well here is the aswMBR

yes tomorrow…we are not in here 24hours…the man need sleep
and he is in UK…and you in US.

[essexboy]

OK lets kill it all

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

https://dl.dropbox.com/u/73555776/OTL_Fix.GIF

:OTL IE - HKU\S-1-5-21-2475542495-2524052195-120979788-1000\..\URLSearchHook: {6596e107-8944-4a8c-8045-62fda3697008} - C:\Program Files (x86)\mystartggtb\mystartggDx.dll () IE - HKU\S-1-5-21-2475542495-2524052195-120979788-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=111442&tt=100512_1_&babsrc=SP_ss&mntrId=1c90d4ea0000000000000019db4cf8e5 FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?affID=111442&tt=100512_1_&babsrc=HP_ss&mntrId=1c90d4ea0000000000000019db4cf8e5" FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=111442&tt=100512_1_&babsrc=KW_ss&mntrId=1c90d4ea0000000000000019db4cf8e5&q=" [2012/02/15 17:52:47 | 000,000,000 | ---D | M] (MyStart Toolbar) -- C:\Users\IAN FTW\AppData\Roaming\mozilla\Firefox\Profiles\m6le2jk4.default\extensions\{32b7e502-4f02-4d93-aa3d-fb377b29f91a} [2012/06/27 16:30:09 | 000,000,000 | ---D | M] ("I Want This") -- C:\Users\IAN FTW\AppData\Roaming\mozilla\Firefox\Profiles\m6le2jk4.default\extensions\crossriderapp2258@crossrider.com [2012/05/19 20:23:11 | 000,002,352 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2011/12/19 17:29:36 | 000,002,166 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\mystartggtb.xml O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (MyStart Toolbar) - {6596e107-8944-4a8c-8045-62fda3697008} - C:\Program Files (x86)\mystartggtb\mystartggDx.dll () O3 - HKLM\..\Toolbar: (MyStart Toolbar) - {6596e107-8944-4a8c-8045-62fda3697008} - C:\Program Files (x86)\mystartggtb\mystartggDx.dll () O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) [2012/05/19 20:22:55 | 000,000,000 | ---D | M] -- C:\Users\IAN FTW\AppData\Roaming\Babylon [2012/05/19 20:23:38 | 000,000,000 | ---D | M] -- C:\Users\IAN FTW\AppData\Roaming\BabylonToolbar

:Files
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\Installer{69f6b531-2da1-806f-0770-c3132b06b9b7}
C:\Users\IAN FTW\AppData\Local{69f6b531-2da1-806f-0770-c3132b06b9b7}
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Users\IAN FTW\AppData\Roaming\BabylonToolbar
C:\Program Files (x86)\BabylonToolbar
C:\Program Files (x86)\mystartggtb
C:\Users\IAN FTW\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
C:\Users\IAN FTW\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now