A trojan that exists but does not? (gert0.dll)

Yeah, nothing that sticks out. But Hijack this is basically a useless program, as far as I'm concerned, besides giving you a quick glance at browser helper objects and some other auto run entries. Process Explorer and Autoruns from sys internals offers a welath of insight. But here are some tools that might be good at determing if you are still infected, too.

(Disclaimer: If you have not burned an Anti Virus Live Boot CD and scanned your system with it yet, what might you be waiting on?) Have you installed Avast and then let it do a pre-boot scan? ) I suspect you have a more academic interest in this virus, so you might enjoy these tools. And these great tools, too.

From Root Kit Analytics:

SpyDLLRemover v3: SpyDLLRemover is the standalone tool to effectively detect and delete spywares from the system. It comes with advanced spyware scanner which quickly discovers hidden Rootkit processes as well suspcious/injected DLLs within all running processes. It not only performs sophisticated auto analysis on process DLLs but also displays them with various threatlevels, which greatly helps in quick identification of malicious DLLs. The DLL search feature helps in finding DLL within all running processes using just partial or full name. Then user can choose to remove the dll from single process or from all loaded processes with just one click.

One of the unique feature of SpyDLLRemover is its capability to free the DLL from remote process using advanced DLL injection method which can defeat any existing Rootkit tricks. It also uses sophisticated low level anti-rootkit techniques to uncover hidden userland Rootkit processes as well as to terminate them.

Stream Armor: StreamArmor is the sophisticated tool for discovering hidden alternate data streams (ADS) as well as clean them completely from the system. It's advanced auto analysis coupled with online threat verification mechanism makes it the best tool available in the market for eradicating the evil streams. StreamArmor comes with fast multi threaded ADS scanner which can recursively scan over entire system and quickly uncover all hidden streams. All such discovered streams are represented using specific color patten based on threat level which makes it easy for human eye to distinguish between suspicious and normal streams. ( If you haven't heard of Alernate Data Streams in NTFS, read up about it. You'll love it. )

Actually, you should check out all the tools from: Spyware Analytics Forums - The Front Page . These guys are amazing at what they do, and they make modern tools that are relevant to todays threats.

My mistake, I did miss that part.

"Which Anti virus Live Boot CD would you say is the best one to use (most of them are Linux only on there, anyway)? [*edit* as long as it's free, that is */edit]

And speaking of which, do you need a blank CD to be able to use this? I've ran out of them at the moment."

My recommendation would be G-Data, Kapersky, and Avast. Yes, you have to burn the iso image to a cd in order to use it.

ps. I have MSE, so would that affect Avast if I had both on together?

Well, I'm not an MSE user, so I can't answer that with authority. However, its generally not a good idea to install two AV programs at the same time. If you're happy with the one you have, kick the tires on it for a while. It's free, so you can always uninstall and reinstall as much as you like.

Your HJT log doesn't show the infection... as suspected .. it's hidden.

Download DDS from one of these links:
Mirror 1 Mirror 2 Mirror 3

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--will be mininmised in the task bar
• Save both reports to your desktop.

Include the contents of both logs in your new topic.

I'll take a look at both... and either help you here, or advise you to 'certified' anti-malware forum to get the help you need. :)

I'll take a look at both... and either help you here, or advise you to 'certified' anti-malware forum to get the help you need.

hmm...

dranfu said:

I'll take a look at both... and either help you here, or advise you to 'certified' anti-malware forum to get the help you need.

hmm...

More of a comment, please dranfu

Oh, nothin, I just don't have a lot of faith in "malware forums". I think he can get all the help he needs here. I mean, he has IT professionals, a Microsoft MVP in security, and an assembly programmer in this thread alone. Why send people to these Hijack This experts. Most of them have no clue what they are talking about.

I mean, yes, he may find people there who want to spend more time on his issue, but I think he would get a wealth of advice here that he wouldn't get at other forums. I mean, that is why I was drawn here :)

Update: This does not apply to every "malware help" forum user of course, just my general experience with the Hijack This lunatics, who never seem to find the problem, which could have been found with a Debugger and Sys Internals tools in 10 minutes.

Download Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
New HJT log taken after the above scan has run
***A guide and tutorial on "How to use Combofix" can be found here:
A guide and tutorial on using ComboFix