Trojan reappears instantly

[vj]

Hi all,

I have QuickHeal Total Security antivirus installed, which has
detected "TrojanPSW.Kates.ae" in C:\Documents and settings\.\..\..\..
\vorcmel.tmp
The quickheal detects and repairs the file, but  it reappears instantly.

Need urgent help.

I posted this problem in alt.comp.virus. I was advised to Download, install, update and scan using Malwarebytes' Anti-Malware {http://www.malwarebytes.org/mbam/program/mbam-setup.exe}
which I did, it removed two trojans but my problem persists. I was then advised to post in this newsgroup with HijackThis log.

The log file is attached. Also attached is a doc file "MessageWindow.doc" with a snapshot of the Total Security message that I get repeatedly.
Thanks in advance.

Vj

[Derek]

please post the malwarebytes log

then

Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note:  It is important that it is saved directly to your desktop  and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and  anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  
• Remember to re enable the protection again after combofix has finished
  

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you. 
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.

Warning:
qy-uick heal detects soemparts of combofix wrongly as malware. Do not let it delete anything while combofix is running

it should be disabled to prevent it doing this and interfering with combofix running

[vj]

Dear Derek,
Thankyou for your reply, and my apologies for the delay in my response.

The log of malwarebytes is attached as desired.

I downloaded and saved Combofix as per your guidelines, and have following difficulties/observations for your kind perusal:
(1) I disabled Quickheal antivirus first of all. However, I could not disable Quickheal firewall, as I could not find an option to disable the firewall. Please advise if you have an idea.
(2) Neverthless, I still attempted to run Combofix (after disabling Quickheal Antivirus, but leaving firewall on).
(3) The combofix ran successfully, except that in the end I got a window saying (to the best of my memory) that it can't write log file as some file hidec.exe (?) could not be found. I can't recall exactly what was the message, since I decided to close this window and retry by re-running combofix.
(4) To my pleasant surprise, after running the combofix for the first time, my original problem of trojan (Quickheal window popping again and again repeatdly) was gone now.

So, my original problem doesn't exist any more. But I am not sure there may be some hidden trojan or problem residing, since I could not perform the steps mentioned above flawlessly.
Therefore, I would be thankful if you can advise me what and how to do now,  so that I can be sure. Also, please let me know how to locate the log file of combofix (if needed).

Thankyou
Vj

[Derek]

see if there is a log at
c:qoobox
or C:\qoobox\quarantine

[vj]

I found a log at C:\qoobox\quarantine, but the file seems to be empty (attached).

[vj]

Another problem which is occuring (and as far as I remember, has the origin almost at the same time when this trojan problem occured) is that everytime I reboot, a "Windows Installer: Preparing to install" window appears, and configures my Adobe Acrobat 7.0. I am not sure if this is connected in any way to my original trojan problem, but thought worth mentioning it. Please also suggest somethiong about it if you can.

Thanks

[Derek]

it looks like combofix was prevented making a log because the forewall etc interfered & blocked it
* Run Kaspersky online virus scan  Kaspersky Online Scanner.

After the updates have downloaded, click on the "Scan Settings" button.
select the (b)"Spyware, Adware, Dialers and other potentially dangerous programs" for the scan.
Under "Please select a target to scan", click "My Computer".
When the scan is finished, Save the results from the scan!

Note: Kavscan is a scanner only & won't fix anything but will normally find the most infected files so it's report gives us a good place to work from

If that won't run then
Run an online antivirus check from one of the following sites
http://security.symantec.com/default.asp?
http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/
http://www.bitdefender.com/scan8/ie.html

[vj]

I have run the Kaspersky online scanner as suggested.
The log containing information of infections is attached.

Please suggest what has to be done now. Also, the "Windows Installer" problem (Adobe 7.0) mentioned in  my previous post: does it seem to be related or a separate issue?
Thanks for your help.
Vj

[vj]

I would be thankful if I get a reply, since I also use net banking and and that's why a bit worried.
Thanks for your help till now.
Vj

[Derek]

I can't see any problems now & teh only thing kaspersky found what was what had already delat with & is in combofix quarantine

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
*  Click START then RUN
*  Now type Combofix /Uninstall in the runbox  and click OK.  Note the space between the X and the /U, it needs to be there.


This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated,  that will help to plug the security holes that let these pests on in the first place

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser