Klone.t And Basefdrn32.dll

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > HijackThis Logs and Malware Removal

Forum Guidelines

Read this topic before posting a log.

DO NOT post a ComboFix log unless requested to.

Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

3 Pages

1 2 3 >

Klone.t And Basefdrn32.dll, Need help removing this infection, please

Options

Billy O'Neal View Member Profile	Jul 21 2008, 10:10 AM Post #2
Multi Megaton Malware Munition Group: HJT Team Posts: 3,967 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, capt.frito. Under NO CIRCUMSTANCES should ComboFix be run unsupervised. CF can cause severe damage to systems when used improperty and in some instances can prevent machines from ever starting again!! Please don't use this tool unless under the guidance of a trained helper. to BleepingComputer.com My name is Billy O'Neal and I will be helping you. (Billy or Bill is fine, if you like.) Please give me some time to look over your computer's log(s). Please take note of the following: In the meantime, please refrain from making any changes to your computer. Also, even if things appear to be running better, there is no guarantee that everything is finished. Please continue to check this forum post in order to ensure we get your system completely clean. We do not want to clean you part-way up, only to have the system re-infect itself. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. Finally, please reply using the button in the lower left hand corner of your screen. We need to create a Deckard's System Scanner (DSS) Log Please download Deckard's System Scanner (DSS) from one of the links below and save to your Desktop. Primary Mirror Secondary Mirror DSS will do the following: Create a new System Restore point in Windows XP and Vista. Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives. Check some important areas of your system and produce a report for an analyst to review. Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes. Note: You must be logged onto an account with administrator privileges when using Deckard's System Scanner. Close all applications and windows. Double-click on dss.exe to run it and follow the prompts. If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When the scan is complete, two text files will open in Notepad: main.txt <-- Will be maximized extra.txt <-- Will be minimized If not, they both can be found in the C:\Deckard\System Scanner folder. Please copy (<Control>+C) and paste (<Control>+V) the contents of main.txt and extra.txt in your next reply. Note: When running DSS, some firewalls may warn that DSS is trying to access the Internet; especially if you are asked to download the most current version of HijackThis. Please ensure that DSS is given permission to access the internet. Note: If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful. In your next reply, please include the following: DSS's Main.txt DSS's Extra.txt Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please say so in My Guestbook.

capt.frito View Member Profile	Jul 21 2008, 03:22 PM Post #3
Member Group: Members Posts: 24 Joined: 28-June 08 Member No.: 219,148	Hi Billy, Thanks for helping me with this. It's not my computer either, it belongs to a buddy who only knows how to click everything that says "click me" ;-) A few things: I'm a Linux guy so I dd'd the entire drive before I did anything, so I wasn't too worried about breaking things (I have a dd'd copy as of the posting I made). Anyway, clearly you guys are very busy and I figured that if I could get some things out of the way, the better for everyone. But you run the show from here on out. I did run Deckert's and I have all the files. I'll post them shortly, I don't have access to them atm :-\| I do remember that it didn't like the version of HJT I had (it was too new apparently) and so it used it's own "internal" version, whatever that means. But we can give it another try if you like. Have you heard of this particular problem before, this basefdrn32.dll thing? Ppl call me "Frito" best, Capt. Frito

Billy O'Neal View Member Profile	Jul 21 2008, 03:27 PM Post #4
Multi Megaton Malware Munition Group: HJT Team Posts: 3,967 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	I have not heard of any specific DLL by that name. Make sure DSS is run again; several parts of it's log are time sensitive Have a nice day, Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please say so in My Guestbook.

Billy O'Neal View Member Profile	Jul 28 2008, 08:29 AM Post #5
Multi Megaton Malware Munition Group: HJT Team Posts: 3,967 Joined: 17-January 08 From: Northfield, Ohio Member No.: 184,215	Hello, capt.frito. Due to lack of feedback, this topic has been closed. If you need this topic reopened, please send me or another moderator a PM. Everyone else please begin a new topic. Billy3 -------------------- The forum is always a busy place. In the event I fail to reply within twenty-four hours, feel free to send me a PM. Have I helped you? If so, please say so in My Guestbook.

Billy O'Neal View Member Profile	Jul 28 2008, 10:04 AM Post #6
Multi Megaton Malware Munition Group: