Trojan-PWS.Papras drop a rookit file and has keylogger characteristic in order to perform malicious action without user's knowledge.We will first clean infection and after that look "closer" HJT log:
Now please follow next steps:1. Turn of System Restore
Steps to turn off System Restore
1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to select the Turn off System Restore check box. Or, click to select the Turn off System Restore on all drives check box.
4. Click OK.
5. When you receive the following message, click Yes to confirm that you want to turn off System Restore:
You have chosen to turn off System Restore. If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer.
Do you want to turn off System Restore?
After a few moments, the System Properties dialog box closes.
2. Update your McAfee AV
3. Download, Install and Update SUPERAntiSpyware:
http://scforum.info/index.php/topic,116.0.html and Malwarebyte's:
http://scforum.info/index.php/topic,2201.0.html4. Restart your PC and run in Safe Mode.
To start the computer in safe mode
1.
You should print these instructions before continuing. They will not be available after you shut your computer down in step 2.
2.
Click Start and then click Shut Down.
3.
In the drop-down list of the Shut Down Windows dialog box, click Restart, and then click OK.
4.
As your computer restarts but before Windows launches, press F8.
On a computer that is configured for booting to multiple operating systems, you can press F8 when the boot menu appears.
5.
Use the arrow keys to highlight the appropriate safe mode option, and then press ENTER.
6.
If you have a dual-boot or multiple-boot system, choose the installation that you need to access using the arrow keys, and then press ENTER.
Note•
If Windows launches before you can choose a safe mode, restart your computer and try again.
•
In safe mode, you have access to only basic files and drivers (mouse, monitor, keyboard, mass storage, base video, default system services, and no network connections). You can choose the Safe Mode with Networking option, which loads all of the above files and drivers and the essential services and drivers to start networking, or you can choose the Safe Mode with Command Prompt option, which is exactly the same as safe mode except that a command prompt is started instead of the graphical user interface. You can also choose Last Known Good Configuration, which starts your computer using the registry information that was saved at the last shutdown.
•
Safe mode helps you diagnose problems. If a symptom does not reappear when you start in safe mode, you can eliminate the default settings and minimum device drivers as possible causes. If a newly added device or a changed driver is causing problems, you can use safe mode to remove the device or reverse the change.
•
There are circumstances where safe mode will not be able to help you, such as when Windows system files that are required to start the system are corrupted or damaged. In this case, the Recovery Console may help you.
•
NUM LOCK must be off before the arrow keys on the numeric keypad will function.
5. Run Full Scans and Delete all suspected files, first with SUPERAntiSpyware and then with Malwartebytes
5. Run Full Scan with your McAfee AntiVirus
6. After that BitDefender Online Scan:
http://scforum.info/index.php/topic,734.0.html7. After that HijackThis (it's important to before running HJT turn of all possible programs)
8. Finally provide us new logs from both (BitDefender and HJT)
I'll be waiting your next reply.
Regards,
S.
Total Members: 14198
Topic: help with trojan and searchclick (PWS.Papras.AC, remove, fix, clean, delete) (Read 10467 times)
