Win 32 Tibs-Aee Trojan Win 32 Tibs-Aee Trojan
I have managed to get this trojan on both laptop and desktop. Hijack log attached.www.microsoft.com . Also error message 80072ee7 when trying to log into windows live messenger. Just for info - I have not yet solved either problem but Avast forum does have info on this Trojan. I have just found it. Lots more work to do but its a start. None of the spy removal programs, paid or otherwise, have so far been successful in removing this sweetheart.
Download Dr.Web CureIt to the desktop:ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Thanks for that. I'm away tomorrow for a week so will not have time to try until then. Will get back then. Really appreciate your help.
No problem it will be here, maybe on page 2.
I have run Dr Web which found no virus though when I run Avast it finds the original problems. I have done a new Hijack thishttp://www.everyclick.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.nec-online.co.uk/ http://update.microsoft.com/microsof...?1176317707093 http://www.superadblocker.com/activex/sabspx.cab https://mwpcuk.webex.com/client/v_my...ra/ieatgpc.cab http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ http://www.everyclick.com/uk/demelza...areforchildren http://home.bt.yahoo.com http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ http://uk.red.clientapps.yahoo.com/c...o/bt_side.html http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ http://home.bt.yahoo.com http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/ http://www.packardbell.co.uk/musicstation http://edits.mywebsearch.com/toolbar...tml?p=ZNfox000 http://favorites.live.com/quickadd.aspx www.motleyfool.co.uk http://www.shopandscan.com/TNSClicker.CAB http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://download.mcafee.com/molbin/sh...1/mcinsctl.cab http://download.mcafee.com/molbin/sh...20/mcgdmgr.cab https://mwpcuk.webex.com/client/v_my...ra/ieatgpc.cab https://secure.logmein.com/activex/ractrl.cab?lmi=100
Let's stick to one computer at a time, makes it to confuseing seeing two hijackthis logs at the same time. Let's start with the desktop since there are fixable things there.HIJACKTHIS To deactivate Spyware Doctor's OnGuard Tools From within Spyware Doctor, click the "OnGuard " button on the left side. Uncheck "Activate OnGuard ". AVG Anti-Spyware Install AVG Anti-Spyware by double clicking the installer. Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked. On the main screen under Your Computer's security . Click on Change state next to Resident shield . It should now change to inactive Click on Change state next to Automatic updates . It should now change to inactive Next to the words Last Update Update now . (You will need an active internet connection to perform this) Wait until you see the Update successful Click on Scanner on the toolbar at top of this screen. Click on the Settings tab. Under How to act? Click on Recommended Action and choose Quarantine Under How to scan? All checkboxes should be ticked. Under Possibly unwanted software: All checkboxes should be ticked. Under Reports: Select Automatically generate report after every scan and uncheck Only if threats were found . Under What to scan? Close AVG Anti-Spyware without running yet. Now disable (turn off AVG Anti-Spyware) Right-click the AVG Anti-Spyware Tray Icon (Bottom right corner of computer screen near clock) and uncheck Start with Windows . Right-click the AVG Anti-Spyware Tray Icon again and select Exit . Confirm by clicking Yes . AVG Anti-Spyware manual updates Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.Safe Mode .If you can't go to safe mode or run from safe mode, use NORMAL MODE. If the computer is running, shut down Windows, and then turn off the power. Wait 30 seconds, and then turn the computer on. Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again. Ensure that the Safe Mode option is selected. Press Enter . The computer then begins to start in Safe mode. Login on your usual account. ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.Note: If AVG Anti-Spyware screen does not fit your monitor screen Hold down the Alt button on keyboard then tap spacebar, menu should pop up then choose maximize. AVG Anti-Spyware screen should now fit to the screen a lot better. Click on the Scan tab. Click on Complete System Scan to start the scan process. Let the program scan the machine. When the scan has finished, follow the instructions below. IMPORTANT : Don't click on the "Save Scan Report" button before you hit the "Apply all Actions" button. Make sure that Set all elements to: shows Quarantine (1) Quarantine from the popup menu. (2) At the bottom of the window click on the Apply all Actions button.(3) When done, click the Save Scan Report button. (4) Click the Save Report as button. Save the report to your Desktop. I will need you to post this in your next reply. Right-click the AVG Anti-Spyware Tray Icon and select Exit . Confirm by clicking Yes . Reboot in Normal Mode.
Apologies to confuse - can I clarify
OK let's do laptop first. Are they connected? if so un-connect them for the time being.
Hihttp://www.everyclick.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.nec-online.co.uk/ http://www.shopandscan.com/TNSClicker.CAB http://update.microsoft.com/microsof...?1176317707093 http://www.superadblocker.com/activex/sabspx.cab https://mwpcuk.webex.com/client/v_my...ra/ieatgpc.cab
Junior Member
