and welcome to BleepingComputer.
This infection allows hackers to remotely control your computer, steal critical system information and download and execute files
. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?When Should I Format, How Should I Reinstall?
The choice is entirely up to you ...
If you decide you would like to try to remove this infection from your computer, please follow the steps outlined below.
Firstly, we need to try to get your internet access back. The trojan is known to modify the registry so that you cannot accesss the internet, so we will try to re-enable it for you. Before we do this, we need to make a backup incase anything goes wrong.
Navigate to Start | Run
and paste the following:regedit /e c:\registrybackup.reg
Now click OK
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.
and copy and paste the following quotebox into a new text document. (Don't forget to copy and paste REGEDIT4!)
"Start" = "2"
Save this as fix.reg
Choose to save as *all files
and place it on your Desktop.
It should look like this:
Double-click on it and when it asks you if you want to merge the contents to the registry, click Yes/OK
After this, please follow our Preparation Guide For Use Before Posting a HijackThis Log
; running all of the scans before posting your HijackThis log. Do not post your log here, but instead use our HijackThis Log and Analysis Forum
After posting a log you should NOT
make further changes to your computer except those that are advised by a member of the HijackThis Team; doing so can cause system changes that may not be visible in your log. Please be patient whilst waiting for a response, our HJT Team is currently very busy, and as we try to deal with logs on a "first come first served" basis, you may have to wait a short while.
Edited by rookie147, 06 September 2007 - 06:32 AM.