problem with trojan

[abel]

Hey

yesterday my computer got infected by a trojan that i cant seem to get rid of.

My f-secure says ive got a trojan downloader in a file called winctrl32.dll, the trojan(s?) keep coming back after cleaning.

any help is appreciated

Malwarebytes' Anti-Malware 1.31

Database version: 1460

Windows 5.1.2600 Service Pack 3

2008-12-05 17:03:29

mbam-log-2008-12-05 (17-03-29).txt

Scan type: Quick Scan

Objects scanned: 53188

Time elapsed: 1 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 4

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wineh22 (Rootkit.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\wineh22 (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wineh22 (Rootkit.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\Wineh22.sys (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\WinCtrl32.dl_ (Trojan.Agent) -> Quarantined and deleted successfully.

and here is the hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:05:15, on 2008-12-05

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\F-Secure\Common\FSM32.EXE

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe

C:\progra~1\valve\steam\steam.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe

C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE

C:\Program Files\F-Secure\Common\FSMA32.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\F-Secure\Common\FSMB32.EXE

C:\Program Files\F-Secure\Common\FCH32.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\F-Secure\Anti-Virus\fssm32.exe

C:\Program Files\F-Secure\Common\FAMEH32.EXE

C:\Program Files\F-Secure\Anti-Virus\fsqh.exe

C:\Program Files\F-Secure\Common\FNRB32.EXE

C:\Program Files\F-Secure\FSAUA\program\fsaua.exe

C:\Program Files\F-Secure\Common\FIH32.EXE

C:\Program Files\F-Secure\FSGUI\fsguidll.exe

C:\Program Files\F-Secure\Anti-Virus\fsav32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Messenger\usnsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://se.msn.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: L

[abel]

a side note

im not noticing any symptoms from the virus. when i first got it my pointer was a bit weird but that got removed when i first tried using mbam. but my f-secure sometimes give me a warning that im infected and when im using mbamb i get some infected files as you could see in my first post

[abel]

am I some sort of a lost cause? just need some confirmation if i need to reformat my computer or if there is some easier solution to my problem.

thx in advance

[Raid]

am I some sort of a lost cause? just need some confirmation if i need to reformat my computer or if there is some easier solution to my problem.

thx in advance

Please disable f-prot, run mbam, update it, scan with it, select everything it finds for removal, have it removed everything found. then follow these instructions:

Please download and run the Trend Micro Sysclean Package on your computer.

NOTE! This scan will probably take a long time to run on your computer so be patient and don't use it while it's scanning.

• Trend Micro Damage Cleanup Engine

Make sure you read this document to understand how to use the program.

Trend Micro Sysclean Package

README 1st

Basically there are 3 parts that need to be downloaded from these links:

1. Sysclean Package

2. Virus Pattern Files

3. Spyware Pattern Files

• As an example on 2008-10-17 the files to download are:
  sysclean.com
  |
  lpt605.zip
  |
  ssapiptn697.zip

• NOTE!
  These file names are examples and you must visit Trend Micro for the very latest files which may have different names.

• Create a brand new folder to copy these files to.

• As an example:
  C:\DCE

• Then open each of the zipped archive files and copy their contents to
  C:\DCE

• Copy the file
  sysclean.com
  to the new folder
  C:\DCE
  as well.

• Double-click on the file
  sysclean.com
  that is in the
  C:\DCE
  folder and follow the on-screen instructions.
  After doing all of this, please post back your results, including the log file
  sysclean.log
  that will be left behind by sysclean.

• This self-extracting archive is a stand-alone fix package that incorporates the Trend Micro VSAPI Malware and Spyware scanning engines as well as the Trend Micro Damage Cleanup Engine and Template.
  This tool supports the following features:
  o Terminate all detected malware/spyware instances in memory
  o Remove malware/spyware registry entries
  o Remove malware/spyware entries from system files
  o Scan for and delete all detected malware/spyware copies in all local drives

How To Use Compressed (Zipped) Folders in Windows XP

Compress and uncompress files (zip files) in Vista

http://windowshelp.microsoft.com/windows/en-us/help/7050d809-c761-43d4-aae7-587550cd341a1033.mspx' rel="external nofollow">

[abel]

HI raid

it seems as if i got rid of the virus, none of my protections i reporting about it anymore and mbam didnt find anything either. would you still recommend me to follow your instructions posted?

[Raid]

HI raid

it seems as if i got rid of the virus, none of my protections i reporting about it anymore and mbam didnt find anything either. would you still recommend me to follow your instructions posted?

I would recommend we continue, however, it's your computer in the end, and if you feel your alright and don't wish to continue, please let me know and I'll go ahead and closeout this thread.