View Single Post
Old 06-18-2008, 06:09 AM   #7 (permalink)
TheBruce1
Moderator, Analyst, Security Team
 
TheBruce1's Avatar
 
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP


Re: Everything gone crazy ( Trojan.win32.mondera.gen )

Hi Randy

Quote:
Originally Posted by Webdrifter
I purchased Zone alarm and Spyware doctor off of their web sites and they are both legal. I just purchased spyware doctor about a week ago right after this problem started. I know you said delete one of my antivirus programs, but could I just disable spyware doctor, and run scans from time to time manually without it conflicting with Zone alarm?
Just wanted to be sure that those version were not crack version, the version number of Zonealarm was giving me a lot of crack/torrent hits.

As to you having two AV installed, i don`t know anyone in the security field that has two AV, personally i think its a waste of hard drive space and it does not offer greater protection as you have found out. PC Tools antivirus programme is not one of the best and if you want my recommendation, you could have installed Avira AntiVir Personal - FREE Antivirus and Comodo Firewall Pro(Free) , these two free programs would give you better protection that having two AV installed, if your looking for a second opinion, then run an online scan with a different vendor, in the end you will have to configure these application not to be running at the same time. You`ll also have to make sure they are not running together in the back ground.

=========

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
http://www.techsupportforum.com/security-center/hijackthis-log-help/258725-everything-gone-crazy-trojan-win32-mondera-gen.html

Collect::
C:\WINDOWS\system32\drivers\atinx2k.sys
C:\WINDOWS\system32\drivers\watvex.sys
C:\WINDOWS\system32\dsqcache.dll
C:\WINDOWS\system32\usr32.dll
C:\WINDOWS\system32\setsvr.exe
C:\WINDOWS\rundys32.exe
C:\WINDOWS\winfsysrn.dll
File::
C:\WINDOWS\BM7bf9ca38.xml
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfcAssT]
khfcAssT.dll
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

===========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.
  • Click Run at the Security prompt.
  • The program will then begin downloading and installing and will also update the database.
  • Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
  • Click the Save Report As... button.
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

Animated Tutorial Here


To optimize scanning time and produce a more sensible report for review:
  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

=========
Logs Required
C;\Combofix.txt
Kaspersky Scan Log
Hijackthis Log
__________________
Member of ASAP since 2007
Member of UNITE since 2008


**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI

If we have helped you in anyway, please consider Donating
TheBruce1 is offline