Computer help forum: Trojan-BNK.Win32.Keylogger.gen

Download ALL of the tools below on a friend or family member's, CLEAN computer and copy them to a CD or flash drive, then transfer them to the problem machine.

First, please download and run the following tool to help allow the removal programs below to run. (courtesy of Grinler at BleepingComputer.com)
There are 4 different versions. If one of them won't run then try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.

Rkill.exe http://download.bleepingcomputer.com/grinler/rkill.exe
Rkill.com http://download.bleepingcomputer.com/grinler/rkill.com
Rkill.scr http://download.bleepingcomputer.com/grinler/rkill.scr
Rkill.pif http://download.bleepingcomputer.com/grinler/rkill.pif
_____________________

IMMEDIATELY after running the "Rkill" tool above, run/install the Malwarebytes and SuperAntispyware installer and update files from the links below which you've also copied to a CD or flash drive, and transfered to the problem machine. Do NOT restart the computer after running Rkill.

Once downloaded and before transferring Malwarebytes and SuperAntispyware to the problem machine, rename the program installer "mbam-setup.exe" file to something else like "Gogetum.exe", then copy the installer file and the update file to a CD or flash drive.. Transfer the file to the problem machine, then install the "Gogetum.exe" file, then run the update to get the program current.. After that, run a full system scan and delete anything it finds.

Malwarebytes Installer Download Link (Clicking on the links below will immediately start the download dialogue window.)
http://www.besttechie.net/tools/mbam-setup.exe

Malwarebytes Manual Updater link
http://www.malwarebytes.org/mbam/database/mbam-rules.exe

Next, install and run a full system scan with the SuperAntispyware program and the manual updater from the links below. As before, you may need to rename the installer file to get the program to install.:

SuperAntispyware
http://www.superantispyware.com/

SuperAntispyware Manual Updater
http://www.superantispyware.com/definitions.html
____________

In a few situations, in order for the program to run, it was also necessary to rename the main "mbam.exe" file also after installing it.. It resides in the C:\Programs Files\Malwarebytes Antimalware folder....
_____________________



Hope this helps.

Grif

thanks a whole bunch i was able to repair my pc in a couple of minutes because of you and it works perfectly now

Thanks for the help, your suggestions worked great and took care of most of the issues on my XP Pro SP3 box. My last issue is that the automatic updates service dissapeared completely, so the red shield appears in the task bar and updates cannot be turned on. I tried updating from the Microsoft update web site and I get error code 0x80070424. I followed Microsoft directions to reinstall in and it tells that it's already installed. BITS service is enabled and started so is workstation. Should I assume malware may still be lingering about? Should I considered system restore to a date before infection happened? I'd rather not have to re-install XP. Any and all suggestions are greatly appreciated.
Marlee

Thanks Grif, will give it a shot as suggested.

If you're referring to the "msconfig" startup tab, there are a number of reasons for blank entries.. For most, UNCHECK them and forget about them.. You might or might not be able to remove them safely, but UNCHECKing them will prevent them from running and you can move on.

As to the registry itself, the best recomendation is to leave well enough alone until you can know exactly what your changing.

Hope this helps.

Grif

I followed your directions for removing the virus by running Rkill once and Malwarebytes & SuperAntispyware several times until nothing was detected by both, but I am still having a problem with Automatic Updates being disabled.

I tried your suggestion above, but every time I enter the commands I receive a message that says the command "is not recognized as an internal or external command, operable program or batch file". When I attempt to run Windows Update, I receive the error 0x80070424.

My operating system is WinXP. When I type in the commands, I am not connected to the internet. I was only connecting to the internet to try to run the Windows Update. Do I need to be connected when I am typing in the commands or is there any other help you could supply?

The security center says that automatic updates is disabled, but if I go to automatic updates in the control panel, it is showing that the "notify me but don't automatically download or install them" is still checked.
dcritch

Thank you for the help. That was exactly what I was doing wrong. My computer is now fixed.

Thanks much,
dcritch

Thank you so much for your easy to follow instructions, fixed my son's and daughter-in-laws computer no problem. Really appreciate it.
B

Hi Grif,

thanks for the instructions, I went through all of the steps and it seemed like it removed everything. After the SuperAntiSpyware ran, it asked to reboot the computer to make sure everything was removed. I did that and when it restarted, the internet does not work (same issue that happened after getting the Trojan-BNK.Win32.Keylogger.genmessage). Went through the steps again, rebooted again and still internet not working.

Are there any additional steps I need to do or anything else that I am missing?

Thanks.

Dude you are the best!!! I appreciated it!!!!!

Hi Grif, thanks for the instructions. I have XP on my infected PC I'm not particularly computer literate. Feeling a bit desperate.
I cannot get the Grinler tool to install. l was able to copy and save it to my flashdrive but it won't install on the infected PC. I have also typed the address directly into my browser window but the virus blocks it from installing that way as well.
As an alternative I tried skipping the Grinler tool, went direct to the website and tried to run malwarebytes from there, but the virus prevents it from running.
Last, can you please give me some instructions on copying and renaming the Malwarebytes Installer Download Link, and then saving it to my flashdrive. I just keep clicking on it and getting sent to the website; i don't understand how to copy it to my flash drive.
Any advice you have would be much appreciated. I am assuming my problem is operator error since so many people have been able to follow your directions and fix their computers!

Hi Grif,

Firstly I want to thank you for the instructions! I stopped receiving those messages. However, I soon experienced error in installing norton antivirus 2012. Each time I installed, the error message of 8506 422 appeared. So I uninstalled it and tried other free trials of antivirus softwares. Each time, they cannot be installed and seemed to hint that the problem lied with my pc. Do you have a solution to it? Thanks.

Hi Grif,
Thank you for taking the time to answer my question. First, I followed your instructions but the same error message appeared. Then I tried shamrock's and same thing happened too. So I gave up and tried Avast which was successfully installed. Checked with a couple of ppl and they also agreed with me that norton is problematic. Guess I wasted my money.

This is the first time I faced such issues with my pc and being a technology idiot (I did not install antivirus for my pc!), I want to thank you once again for helping me solve these issues!

Just want to express my big gratitude to your advice. I was very frustrated with the issue and seemed helpless until I followed your instruction. The issue is now gone and I couldn't be happier. Thank you!