Solved Cannot get rid of Trojan.Gadja.Injected.A

Run OTL

• Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
  
  
  Code:

  :Files
  c:\windows\system32\stu2.exe
  C:\Documents and Settings\Robert\Local Settings\Temp\in1.tmp
  
  :Commands
  [emptytemp]
  [resethosts]
  [Reboot]

• Then click the [color= "#FF0000"]Run Fix[/color] button at the top.
• Let the program run unhindered, reboot the PC when it is done.
• Post log from this run.
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

 

Ran the Run Fix command but lost my desktop on reboot. The "Loading personal settings" window appeared but then all I got was a blank screen - not icons - no taskbar.

No report generated - had to use system restore to get back to a state of usability.

I would run it again but will await your advice

 

Try going into that temp folder and deleting the file manually please. If you have difficulty in normal mode, give it a try in safe mode.

 

No go in either mode.

Tried moveonboot then ran a scan on restart - removal failed

C:\Documents and Settings\Robert\Local Settings\Temp\in1.tmp

Trojan.Gadja.Injected.A

Bitdefender move to quarantine failed

Off to bed - will look for you in the morning

Thanks for your persistence

 

• Download Avenger by Swandog and unzip it to your Desktop.
  
  Note: This program must be run from an account with Administrator privileges.
  
  
• Open the Avenger folder and double click Avenger.exe to launch the programme.
• Copy the text in the code box below and Paste it into the Input script here: box.

Code:

Files to delete:
c:\windows\system32\stu2.exe
C:\Documents and Settings\Robert\Local Settings\Temp\in1.tmp

• Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
  
  
• Ensure the following:
  • Scan for Rootkits is checked.
  • Automatically disable any rootkits found is Unchecked.
• Press the Execute key.
• Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
• Post the log back here please. (it can also be found at C:\avenger.txt)

 

Ran the program and lost the desktop again - system restore will not bring it back either. I've never seen anything like this

 

Do you have a second pc that you can use? I am thinking that you may be able to slave the infected hard drive to the second pc and remove the infection that way.
Do you have your XP CD?

 

Yes on both counts

Is the infection causing the loss of desktop?

 

Quite possibly this has woven it's way into the system.
Are you comfortable with hooking up the drive from the infected to the good pc? Are they IDE or Sata drives? If Sata, it is straight forward. If IDE, you will have to set the infected one as slave. Diagram should be on the hard drive.
Once done, run Bitdefender scan for the infected drive and see if it is able to remove it now.
Let me know how you get on.
If we have a successful removal, you may have to do a repair install.

 

I cannot say what happened but it is gone...

I had to restart the computer 4 times and each time I had to start run from task manager and explorer.exe from the run window. On the 5th restart the desktop came back and when I went looking for the file it was gone. Did a complete BD scan and there is no sign of it.

Any thoughts crunchie?

 

Computers are a wonderful thing . I have seen some strange things happen at times that I cannot explain. This is one of those times.
stu2.exe was obviously the key in the end though.
Can you try an on-line scan please to check for anything else..

Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with [color= "blue"]Kaspersky Online Scanner[/color]

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet [color= "#3333FF"]Explorer 7[/color] users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

• Once the files are downloaded click on Next
• Click on Scan Settings and configure as follows:
  • Scan using the following Anti-Virus database:
    • [color= "#6666CC"]Extended[/color]
  • Scan Options:
    • [color= "#6666CC"]Scan Archives[/color]
    • [color= "#6666CC"]Scan Mail Bases[/color]
• Click OK and, under select a target to scan, select My Computer

When the scan is done, in the [color= "Navy"]Scan is completed [/color]window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the [color= "Navy"]Save as [/color]prompt, [color= "navy"]Save in[/color] area, select: Desktop
In the [color= "navy"]File name[/color] area, use KScan, or something similar
In [color= "navy"]Save as type[/color], click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the [color= "Navy"]Kaspersky Online Scanner Report [/color]in your reply.

 

Good news, all clear - any last suggestions or words?

Tuesday, March 30, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, March 30, 2010 06:17:01
Records in database: 3898911


Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes

Scan area My Computer
C:\
D:\
E:\

Scan statistics
Objects scanned 99108
Threats found 0
Infected objects found 0
Suspicious objects found 0
Scan duration 01:48:50

No threats found. Scanned area is clean.
Selected area has been scanned.

 

Just one other thing and you should be sweet.

Launch OTL and click on the Cleanup button. Follow the prompts.

==

Check for any M$ security updates. Stay safe .

 

Thanks for your help

 

Glad we made it through .

 

Yes, before it killed us too

The matter is resolved - the computer is back with the client and working fine
Thanks

 

Excellent news . Glad to help.