Win32/Genetik Trojan very aggresive behaviour

[exnergy]

Nod 32 has alerted me with its notification screens mainly when I use Firefox, when offline, nothnig shows up, also when I have installed fresh win xp, there was some old files in program files in another disk, and I installed the same programs to another location, and don;t know what else could be crucial here..

[exnergy]

Ok posted , uploaded, link is :

http://www.thespykiller.co.uk/forum/index.php?board=1.0


ooopps here;

http://www.thespykiller.co.uk/forum/...p?topic=3731.0

please check this, and lets go kill the f**ker - trojan

[exnergy]

in the mean time I have installed the newest comodo firewall (just for the record) as jetico 2 beta doesnt seem to be user friendly for me now, when I am quite tired of tons of notifications, and comodo leads the ranks

[Tammy]

Thank you, exnergy!

Ok, here we go:

Follow this link and do an onlinescan at
http://housecall.trendmicro.com/
and save the logfile.


Please download FixWareout from one of these sites:
subratam
bleepingcomputer

Save it to your desktop and run it. Click "Next", then "Install", make sure "Run fixit" is checked and click "Finish".
The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

Next after restart:
Run Hijackthis, click >scan< and put a checkmark next to each of these items.
Then click the >Fix Checked< -button:

O2 - BHO: (no name) - {81A35F39-4850-474E-92C9-B4CF283207E0} - c:\windows\system32\iegfilt.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{1D1250E3-C52C-4187-94C1-AA099602F62F}: NameServer = 195.116.xxxxxxx
O17 - HKLM\System\CS1\Services\Tcpip\..\{1D1250E3-C52C-4187-94C1-AA099602F62F}: NameServer = 195.116.1xxxxx
O17 - HKLM\System\CS2\Services\Tcpip\..\{1D1250E3-C52C-4187-94C1-AA099602F62F}: NameServer = 195.116.1xxxx


Next:
In the windows control panel:
If you are using Windows XP's Category View, select the Network and Internet Connections category otherwise double click on Network Connections.
Then right click on your default connection, usually local area connection for cable and dsl, and left click on properties. Click the Networking tab. Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically
Press OK twice to get out of the properties screen and reboot if it asks.
That option might not be avaiable on some systems
Next Go start run type cmd and hit OK
type
ipconfig /flushdns
then hit enter, type exit and hit enter
(notice that space between g and / )


Next:

• Download RegSrch.zip by Bobbi Flekman
  and safe it to your desktop.
  
• Unzip it to the new created folder:
  C:\Programs\RegSrch
  
• Start RegSearch and type in the first line:
  {81A35F39-4850-474E-92C9-B4CF283207E0}
  
• klick "OK"

Repeat this with each of the following lines:
{1D1250E3-C52C-4187-94C1-AA099602F62F}

If it finished reboot your PC and make me see the "EventLogs"
and a fresh HJT-logfile.

Notice:
Please poste all requested logfiles in "code-tags".
See here how to do this.

Regards,
Tammy

[exnergy]

BTW.You know what is interesting - now when jetico is out and comodo pro firewall is installed for the last few minutes no alerts from nod32 shown.

and the 195.116.xxxxxxx was my ISP DNS adresses which I made :xxxx" for security purposes

I dont know it obtaining DNS will work for my ISP as I always had to enter this values manually

OK I am going to follow your instructions now.

[exnergy]

edited - maybe important info belowe:

the 195.116.xxxxxxx was my ISP DNS adresses which I made :xxxx" for security purposes

I dont know if obtaining DNS will work for my ISP as I always had to enter this values manually

[exnergy]

OMG online trend micro scanner shows now 2h ufff, is this step extremely needed now? cant I jump into next one? Maybe it is only estimated time? geez

[mrrockford]

Let the scan run. You are in good hands.

[exnergy]

yeah I've noticed, scan is almost complete

one trojan and so many problems thx God Tammy was here

[exnergy]

well it wanted rescan, so i let it rescan, it is much quicker now