BSODs maybe caused by Trojans

[jaine]

Previous thread on BSODs: http://www.sevenforums.com/bsod-hel...0000c2-0x00000019-most-common-0x00000024.html

I removed F-secure and installed Security Essentials and MBAM. So far, Security Essentials scan finished and found two threats; TrojanDownloader:ASX/Wimad.AS and TrojanClicker:ASX/Wimad.CS.
MBAM found Trojan.MSIL.Injector, which was also removed.
Any suggestions, what should I do next or do I just wait if a BSOD appears again?

 

[VistaKing]

TDSSKILLER

download link :ar: TDSSKiller

Save to the Desktop

Right-click the program and select

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System

Click: OK


Press: Start Scan


If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)


When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\


Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt


Please post the TDSSKiller log in your reply.

 

[VistaKing]

Once you're done with that run this

<==== Download Link


<==== Download Link

:ar: Click on one of the links above that goes with your Windows 7 bit versions

:ar: Save to the Desktop.

:ar: Close all windows and browsers

:ar: Right click on

and choose

:ar: Press: SCAN

:ar: provide the RKreport.txt (Mode: Scan) in your reply.

 

[jaine]

When running TDSSKiller, I got a BSOD (see minidump attached & the TDSSKiller's log). Proceeded with a new scan, it went through without problems (the other log file).
Proceeding to RogueKillerX64 >

 

[Du Khang]

Previous thread on BSODs: http://www.sevenforums.com/bsod-hel...0000c2-0x00000019-most-common-0x00000024.html

I removed F-secure and installed Security Essentials and MBAM. So far, Security Essentials scan finished and found two threats; TrojanDownloader:ASX/Wimad.AS and TrojanClicker:ASX/Wimad.CS.
MBAM found Trojan.MSIL.Injector, which was also removed.
Any suggestions, what should I do next or do I just wait if a BSOD appears again?

That is why I still use Spybot S&D, though the teatimer function can slow down booting, it has a feature that you can use to 'immunize' and it works with the browser you use to protect from within to keep downloaders and clickers out of your system before they implant themselves. After d/l'ing the weekly definition files and running a scan [time consuming though] you can see in the bottom left had corner
what malware it is seeking out and it does seem to have kept the two above out or they would have showed up on the results pane. (on my system that is)

 

[VistaKing]

When running TDSSKiller, I got a BSOD (see minidump attached & the TDSSKiller's log). Proceeded with a new scan, it went through without problems (the other log file).
Proceeding to RogueKillerX64 >

Unzip the folder and upload just the tdsskiller log please .

 

[jaine]

But then I can't upload the minidump here...
Anyways, attached it and the RogueKiller logs too.

 

[VistaKing]

Doesn't look like TDSSKILLER completed . Rerun the scan again with tdsskiller

 

[jaine]

The second log file is the one that completed, the first one was the one with the crash interrupting it.

 

[VistaKing]

Download

HitManPro

64-Bit Version OS :ar: HitmanPro_x64

32-Bit Version OS :ar: HitmanPro

:ar: Save to the Desktop

:ar: Right click on HitmanPro.exe and choose

:ar: When HitmanPro opens up click on Settings uncheck Scan for tracking cookies . Click on OK . Then click on the Next button

:ar: Click on No, I only want to perform a one-time scan to check this computer on the Setup page . Click Next once done .

:ar: Let it scan the PC once its done Click Next

:ar: Click Activate free license to start the free 30 days trial and remove all the malicious files from your computer then click Next

Copy and Paste the contents of the log . Locate in C:\ProgramData\Hitman Pro\Logs

 

[jaine]

Here's the log for Hitman Pro.

 

[VistaKing]

Run Farbar Recovery Scan Tool

64-Bit Version OS Farbar Recovery Scan Tool x64 <===== Download Link

Drag the FRST64.exe from the Downloads folder to your Desktop

Right click on FRST64.exe and choose

When the tool opens click Yes on the disclaimer window .

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

   Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please upload both logs in your reply.(FRST.txt and Addition.txt)

:note: FRST.txt and Addition.txt will be on the Desktop :note:

Upload a File
Click on the Go Advanced button under the Message box . Scroll down to Additional Options then click on Manage Attachments in the Attach Files sections . Click the Browse button locate the file then click on the Open button . In the Upload File from your Computer section click on the Upload button . Wait until it finishes uploading then close the window . Then click Submit Reply .

 

[jaine]

Here are the Farbar logs.

 

[VistaKing]

On

Hold down Control and click on ESET Online Scanner to open ESET OnlineScan in a new window
Click the

button
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.


On

or

Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
Right click on

choose

on your desktop
Check YES, I accept the Terms of Use.
Click the Start button.
Accept any security warnings from your browser.
Under scan settings, check "Scan Archives" and "Remove found threats"
Click Advanced settings and select the following:
° Scan potentially unwanted applications
° Scan for potentially unsafe applications
° Enable Anti-Stealth technology
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click List Threats
Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Click the Back button.
Click the Finish button.

 

[jaine]

The log for ESET Smart Installer.

 

[VistaKing]

Run

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

Log looks like this : mbam-log-yyyy-mm-dd

Log located : C:\Users\{Your UserName}\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs or C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

 

[jaine]

Here it is.

 

[VistaKing]

Download CKScanner by askey127 below

• Download link :ar: CKScanner
  
• Save it to your Desktop
  
• Right-click CKScanner.exe select
  
  
  
• Click Search For Files
  
• When the cursor hourglass disappears, click Save List To File
  
• A message box will verify the file saved
  
• Upload CKFiles.txt in your next reply

 

[jaine]

CKFilest.txt attached.

 

[VistaKing]

Is there a reason why these didn't get checked and removed ?

C:\Program Files\Adobe\Adobe Bridge CS6 (64 Bit)\AMTLib.dll (PUP.RiskwareTool.CK) -> No action taken.
C:\Program Files\Adobe\Adobe Photoshop CS6 (64 Bit)\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.
C:\Program Files (x86)\Adobe\Adobe Bridge CS6\AMTLib.dll (PUP.RiskwareTool.CK) -> No action taken.
C:\Program Files (x86)\Adobe\Adobe Photoshop CS6\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.
F:\SOFTWARE\Adobe CS6 Master Collection\Crack\Cracked amtlib.dll\32-bit\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.
F:\SOFTWARE\Adobe CS6 Master Collection\Crack\Cracked amtlib.dll\64-bit\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.
F:\SOFTWARE\Adobe Photoshop CS6 Extended\DLL FILE\32bit\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.
F:\SOFTWARE\Adobe Photoshop CS6 Extended\DLL FILE\64bit\amtlib.dll (PUP.RiskwareTool.CK) -> No action taken.