Please remove BitTorrent DNA using the instructions below. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Please refer to this topic:
/t204179-P2P_programs_we_ask_that_you_remove_first.html
(Don't put it back until after your cleaning is completed.)


P2P apps must be completely removed before we will help you.


Some P2P applications are as bad as trojans when it comes to removal. Here's what you do:

Check Add/Remove Programs again via Control Panel. If any BitTorrent DNA entry is still there, remove it.


Next...
Windows XP: If it's not in Add/Remove Programs, open Task Manager by right-clicking your desktop taskbar and selecting it. Choose the Processes tab. Look for the btdna.exe executable file. Highlight it by clicking on it once, then click the End Process button on the bottom right. You'll get a warning box but just turn it off anyway. Close Task Manager.


Run HijackThis. Do a System Scan Only. Put a checkmark beside this entry only, be sure all other windows are closed, then click the Fix Checked button.

O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

Reboot your computer.

Next, do a system scan and save a logfile with HijackThis. Post the new log here.

You're Ready for cleaning.

At CastleCops we screen all HijackThis logs for errors, out-of-date versions, unupdated operating systems, omissions and P2P applications; getting you [READY] for cleaning by our 1st Responders and Security Experts. Now you wait for one of them to come help you.

Hello lisah420,

Welcome to the CC forums.

===Very Important===The instructions in this thread have been specifically designed for THIS USER'S MACHINE ONLY . You should not use these instructions to clean your machine. Doing so could cause irreparable damage to your machine. If you need assistance, please start your own thread.=================A couple of important things to keep in mind during our fix.

• Please >> DO NOT<< run any scans/tools or other fixes unless I ask you to.
• If you are running P2P filesharing program(s). Uninstall it/them.
• If you are running any cracked/pirated software, REMOVE it before proceeding. Many helpers -- myself included -- will not assist you if you are using such software.

Remember, we are in this process together. We must cooperate with each other or the fix will surely fail. If there is something you don't understand or or are unsure of -- Please Do not skip it. Instead, take a moment to ask. With some infections skipping a step can be disastrous.That being said, let's get started.

Your computer has been infected by some very dangerous software. It opens a backdoor to your machine which allows complete access to it from a remote location. The really bad news is that if you are connected to an interoffice network it's very likely those computers are infected as well. It would be a good idea to alert your IT department to that possibility. You also need to disconnect from the interoffice network immediately.

If this machine has been used for any financial transactions you need to call them an alert them to the possibility of illegal activity. From a known clean machine you need to change all of your passwords -- for everything.

The infection has been identified and most likely can be cleaned but there is no way of knowing how deeply the computer has been compromised. You should probably confer with your IT department as to whether they want to attempt cleaning or do a complete reformat/reinstall. There is some very good information in these three articles:
Danger: Remote Access Trojans.
When should I re-format? How should I reinstall?
How Do I Handle Possible Identify Theft, Internet Fraud and Credit Card Fraud?

If you decide you wish to go ahead and attempt cleaning, I will be happy to help you do so. Keep me posted. SCB

Hi lisah420,

OK, let's get started then. Incidentally, I should point out before we begin that these fixes don't always go in one step. We may get lucky and it will go easily but as a general rule it takes several go rounds to completely disinfect. Here's the first step:

Please print out these instructions since we will be working in "Safe Mode" and Internet connection will not be available.

Download SDFix and save it to your Desktop.

SDFix is updated regularly. If you have previously downloaded SDFix, please delete that copy.

Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix)

Reboot your computer into Safe Mode by doing the following :

• Restart your computer.
  
• Contiunally tap F8 until a menu appears.
  
• Use your up/down arrow key to highlight Safe Mode.
• Hit enter.
  
• Choose your usual account.
  
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• SDFix will complete its task then prompt you to hit any key to Reboot.
  
• Hit any Key
• Your computer will reboot.
  
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished.
  
• Hit any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).

in your reply, please include

• Report.txt.
• A fresh HijackThis log.

That should give us a pretty good indication of where we need to go from there. SCB

All times are GMT