troan horse PSW.Banker5.OGA

[wooosh]

hi,
i'm having a serious problem with this little sod!
its altered my xp desktop which i have only just installed. it started with the logon. after trying to logon there was no explorer display. starting task manager quickly, i can get around this by running it through task manager,new task,but, i have to do this every time i boot up. i have ran safe mode on admin account and ran avg free twice. once with restore on then with it off. i have created a new logon to see if that changed it but same on that too. if i dont get to start task manager quick enuf, i get a prob with userinit, then other dll issues. DEP is shutting these down.
i presume my user profile is corrupt but also think it may have affected the boot process as it keeps returning. it is preventing me from getting onto emsi site too(altho i dont know if that has anything to do with anything), so that i cant update a2 free trojan removal tool which i downloaded.
not sure what to try next as i have researched a bit and can only see editing the registry as being an answer. i'm unsure how to do this exactly as most answers i have had are vague and not simple (like me).
also, sys restore was wiped so cannot do that. xp disk i have is not genuine so i dont know if anyone is willing to help but would appreciate some advice.
i have hijack this log if it would help answer any questions that i havent covered
also have everest ultimate edition which has loads of info that i dont understand

system
xp pro sp3
pentium 4 550J, 3400 MHz (17 x 200)
medion MSI MS-7091

can anyone help me so that i dont have to reformat and re-install etc

Jay

[rjfvillarosa]

Originally Posted by wooosh xp disk i have is not genuine so i dont know if anyone is willing to help but would appreciate some advice.

As long as you are using a unique installation key we don't need to know that.
Go down to your local Maplins and get a USB adapter, they are about twenty five quid. Hot plug your harddrive to a machine with a very up-to-date antivirus installation, malwarebytes install and superantispyware install, then run scans on your harddrive. You could also try running the Sophos antirootkit scanner on it.

See this thread for information on using a USB adapter:
http://forum.pcmech.com/showthread.php?t=204049

[Khalil]

I used to date a girl from Tyne and Wear 30 years ago. Nice country side there, what are you doing getting a Trojan Horse on your computer?

If you can surf the net, download this http://www.malwarebytes.org/mbam.php and run it in safe mode.

[mjkovis]

Originally Posted by Khalil If you can surf the net, download this http://www.malwarebytes.org/mbam.php and run it in safe mode.

Agreed, but when booting into Safe Mode make sure to boot into Safe Mode with Networking so that Malware Bytes may update its definitions.

[wooosh]

How do you boot into safe mode with networking? Dunno how to do that.
Think I may have downloaded it in a program. Seems quite new too. Deeply embedded coz keeps appearing in system32 folder. Dunno where its starting tho. Is there no way I can just replace the boot files so that it doesn't get the go ahead to start?

[glc]

Start pressing F8, you have to catch it between the POST screen and the XP splash screen to get the boot menu.

[wooosh]

right, downloaded malwarebytes and ran it. got rid of 61 problems. also ran sofo antirootkit which caught a few others too, but I now have some issues which i need sorting.
no taskbar or icons and explorer only brings up windows etc. i could do with having this back so that i dont have to manually start everything.
also, having little problem with userinit not being able to start still.
help..... please...
Jay

[glc]

If you had a rootkit, pull the drive and use a USB adapter to recover your data files onto another computer, then zero fill the hard drive and start from scratch.

[wooosh]

Is there no way to replace the wiped system files?
I.e. explorer, etc
I can still work with it through task manager but only in safe mode. Task manager is locked out thro logins.
Would obv need to know which files to replace but dunno how to find out.
Is re-install only way round?

[rjfvillarosa]

You can do a repair-install to replace your damaged system files, but if you cannot be 110% certain that the nasties are gone you are wasting your time.
If you have any kind of suspision that you did indeed have a root-kit then the only way to go is save your personal files and zero fill the harddrive, this is the only way of being sure the root-kit is gone.