|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| HijackThis Log Help Get Rid Of Malware With Help From Our Analysts. Follow the "First Steps" link at the top right of each page before posting for help. |
 |
|
|
Thread Tools |
09-07-2007, 10:01 AM
|
#21 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
i had deleted the original copy of ComboFix and downloaded a new one yesterday. However, the CFSubmit file that you gave me was not compatible with deleting/accessing certain files last night. Perhaps I need new code for it?
|
|
     
|
|
09-09-2007, 04:22 PM
|
#23 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
I've run the ComboFix and checked the hidden files on my G: and oblipto.exe is gone from that as well. :)
Am I clear now??? -------------------------------------------------------------------- ComboFix 07-09-07.4 - "Melody Li" 2007-09-09 1:50:54.5 - FAT32x86 Microsoft Windows XP Professional 5.1.2600.2.950.886.1033.18.159 [GMT -4:00] * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . d:\oblipto.exe g:\autorun.inf G:\Autorun.inf g:\oblipto.exe ((((((((((((((((((((((((( Files Created from 2007-08-09 to 2007-09-09 ))))))))))))))))))))))))))))))) . 2007-08-28 02:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-27 12:03 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-08-27 12:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab 2007-08-27 11:53 <DIR> d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\MailFrontier 2007-08-27 04:12 512 --a------ C:\ScanSectorLog.dat 2007-08-27 03:58 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-08-27 03:58 75,248 --a------ C:\WINDOWS\zllsputility.exe 2007-08-27 03:58 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-08-27 03:58 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2007-08-27 03:58 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-27 03:58 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2007-08-27 03:58 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier 2007-08-27 03:27 <DIR> d--hs---- C:\FOUND.002 2007-08-27 03:24 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-17 07:52 <DIR> d-------- C:\Program Files\ParaUSB 2007-08-17 07:52 <DIR> d-------- C:\Program Files\MFLPRO 2007-08-13 18:07 <DIR> d--hs---- C:\FOUND.001 2007-08-13 13:56 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-08-13 13:56 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Picasa2 2007-08-13 13:53 <DIR> d-------- C:\Program Files\Google 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-08-12 07:38 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys 2007-08-10 14:20 <DIR> d-------- C:\WINDOWS\system32\LogFiles . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-07 09:14 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-08-08 23:14 --------- d-------- C:\Program Files\Help 2007-08-03 13:12 --------- d-------- C:\Program Files\Symantec AntiVirus 2007-08-03 11:22 --------- d-------- C:\Program Files\SymNetDrv 2007-08-01 14:56 --------- d-------- C:\Program Files\FirstClass 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll 2007-07-30 09:21 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Inspiration Software 2007-07-27 23:26 --------- d-------- C:\Program Files\Inspiration 8 IE 2007-07-24 14:36 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FirstClass 2007-07-17 14:38 --------- d-------- C:\Program Files\MSXML 4.0 2007-07-17 14:14 --------- d-------- C:\Program Files\Rainlendar2 2007-07-17 11:39 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\AdobeUM 2007-07-17 09:49 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Opera 2007-07-17 00:50 --------- d-------- C:\Program Files\MSN Messenger 2007-07-17 00:47 --------- d-------- C:\DOCUME~1\MELODY~1\APPLIC~1\Talkback 2007-07-16 21:07 --------- d-------- C:\Program Files\DivX 2007-07-16 21:07 --------- d-------- C:\Program Files\DefilerPak 2007-07-16 21:03 --------- d-------- C:\Program Files\Common Files\Ahead 2007-07-16 21:03 --------- d-------- C:\Program Files\Ahead 2007-07-16 20:55 --------- d-------- C:\Program Files\Common Files\Adobe Systems Shared 2007-07-16 20:55 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems 2007-07-12 22:15 --------- d-------- C:\Program Files\Microsoft Works 2007-07-12 22:09 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help 2007-06-26 11:13 851968 --a------ C:\WINDOWS\system32\dllcache\vgx.dll 2007-06-26 10:09 658944 --a------ C:\WINDOWS\system32\dllcache\wininet.dll 2007-06-26 02:08 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-26 02:08 1104896 --a------ C:\WINDOWS\system32\dllcache\msxml3.dll 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll 2007-06-19 09:31 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-19 09:31 282112 --a------ C:\WINDOWS\system32\dllcache\gdi32.dll 2007-06-14 14:09 96256 --a------ C:\WINDOWS\system32\dllcache\inseng.dll 2007-06-14 14:09 615424 --a------ C:\WINDOWS\system32\dllcache\urlmon.dll 2007-06-14 14:09 55808 --a------ C:\WINDOWS\system32\dllcache\extmgr.dll 2007-06-14 14:09 532480 --a------ C:\WINDOWS\system32\dllcache\mstime.dll 2007-06-14 14:09 474112 --a------ C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-06-14 14:09 449024 --a------ C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-06-14 14:09 39424 --a------ C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-06-14 14:09 357888 --a------ C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-06-14 14:09 3058688 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll 2007-06-14 14:09 251392 --a------ C:\WINDOWS\system32\dllcache\iepeers.dll 2007-06-14 14:09 205312 --a------ C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-06-14 14:09 16384 --a------ C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-06-14 14:09 151040 --a------ C:\WINDOWS\system32\dllcache\cdfview.dll 2007-06-14 14:09 1494528 --a------ C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-06-14 14:09 146432 --a------ C:\WINDOWS\system32\dllcache\msrating.dll 2007-06-14 14:09 1054208 --a------ C:\WINDOWS\system32\dllcache\danim.dll 2007-06-14 14:09 1023488 --a------ C:\WINDOWS\system32\dllcache\browseui.dll 2007-06-14 10:07 18432 --a------ C:\WINDOWS\system32\dllcache\iedw.exe 2007-06-13 06:23 1033216 --a------ C:\WINDOWS\system32\dllcache\explorer.exe 2007-06-13 06:23 1033216 --a------ C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2005-05-12 00:15] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-07 20:02] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-07 19:59] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-07 20:03] "ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2003-09-19 12:54] "Wireless Console"="C:\Program Files\ASUS\Wireless Console\wcourier.exe" [2005-06-20 19:16] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 14:46 C:\WINDOWS\KHALMNPR.Exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-12-21 23:23] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-12-21 23:23] "SoundMan"="SOUNDMAN.EXE" [2005-01-05 00:40 C:\WINDOWS\SoundMan.exe] "AlcWzrd"="ALCWZRD.EXE" [2005-01-05 00:02 C:\WINDOWS\ALCWZRD.EXE] "Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2004-09-21 16:55] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 11:27] "EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 11:31] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 20:00] "IMEKRMIG6.1"="C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 20:00] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 20:00] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 20:00] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-08-03 13:14] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 19:26] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-06-15 19:15] "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 21:54] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "Rainlendar2"="C:\Program Files\Rainlendar2\Rainlendar2.exe" [2007-04-15 02:31] C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\ Logitech SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [1980-11-16 10:22:35] Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-22 13:42:22] Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 01:19:50] Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\DOCUME~1\MELODY~1\STARTM~1\PROGRAMS\STARTUP\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 11:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-09 01:53:04 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-09 1:54:16 C:\ComboFix-quarantined-files.txt ... 2007-09-09 01:54 C:\ComboFix2.txt ... 2007-09-07 00:58 C:\ComboFix3.txt ... 2007-09-07 00:44 . --- E O F --- |
|
|
|
|
09-09-2007, 04:46 PM
|
#24 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved. 下次要小心一点 |
|
|
|
|
09-09-2007, 05:42 PM
|
#25 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
THANKS SO MUCH!
now, for my friends who have also been infected with the same virus, should i get them to follow each process (b/c i'm pretty sure we have the same virus) OR should i get them to start their own thread with you guys? |
|
|
|
|
09-09-2007, 05:59 PM
|
#26 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Best that each start their own thread. If they have oblipto.exe, get them to post ComboFix logs.
Whatever you do, don't allow them to stick their pendrives into your machine. |
|
|
|
|
09-13-2007, 01:15 PM
|
#27 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
I just did one final Kaspersky scan on my computer and it shows that I still have 2 viruses and 10 infected files. Most of them are contained within those Submit files that are on my desktop and C:/goobox/Quarantine due to the scans. How should I properly dispose of these files?
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, September 13, 2007 3:12:29 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 13/09/2007 Kaspersky Anti-Virus database records: 418088 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 43159 Number of viruses found: 2 Number of infected objects: 10 Number of suspicious objects: 0 Duration of the scan process: 00:58:03 Infected Object Name / Virus Name / Last Action C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\temp\ZLT00e59.TMP Object is locked skipped C:\WINDOWS\temp\ZLT01cf3.TMP Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\MELODY.ldb Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{DBC51CB5-8D86-48A7-AE58-7C1E663BA061}.bin Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-09-13_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Melody Li\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\History\History.IE5\MSHist012007091320070914\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Melody Li\Local Settings\Temp\~DF9882.tmp Object is locked skipped C:\Documents and Settings\Melody Li\Desktop\Submit.zip Infected: Trojan-PSW.Win32.OnLineGames.aim skipped C:\Documents and Settings\Melody Li\Desktop\[4]-Submit_2007-09-07_ 05240.54.zip/WINDOWS/system32/tdvwate.exe Infected: Virus.Win32.AutoRun.f skipped C:\Documents and Settings\Melody Li\Desktop\[4]-Submit_2007-09-07_ 05240.54.zip/WINDOWS/system32/aishiph.exe Infected: Virus.Win32.AutoRun.f skipped C:\Documents and Settings\Melody Li\Desktop\[4]-Submit_2007-09-07_ 05240.54.zip/WINDOWS/system32/meex.com Infected: Virus.Win32.AutoRun.f skipped C:\Documents and Settings\Melody Li\Desktop\[4]-Submit_2007-09-07_ 05240.54.zip ZIP: infected - 3 skipped C:\Documents and Settings\Melody Li\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\history.dat Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\cert8.db Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\key3.db Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\parent.lock Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\search.sqlite Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Melody Li\Application Data\Mozilla\Firefox\Profiles\reps95sd.default\formhistory.dat Object is locked skipped C:\Documents and Settings\Melody Li\.rainlendar2\rainlendar2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0733NAV~.TMP Object is locked skipped C:\Program Files\Symantec AntiVirus\SAVRT\0735NAV~.TMP Object is locked skipped C:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP9\change.log Object is locked skipped C:\qoobox\Quarantine\C\WINDOWS\system32\tdvwate.exe.vir Infected: Virus.Win32.AutoRun.f skipped C:\qoobox\Quarantine\C\WINDOWS\system32\aishiph.exe.vir Infected: Virus.Win32.AutoRun.f skipped C:\qoobox\Quarantine\C\WINDOWS\system32\meex.com.vir Infected: Virus.Win32.AutoRun.f skipped C:\qoobox\Quarantine\D\oblipto.exe.vir Infected: Virus.Win32.AutoRun.f skipped C:\qoobox\Quarantine\g\oblipto.exe.vir Infected: Virus.Win32.AutoRun.f skipped D:\System Volume Information\_restore{5EA4FB9B-208A-40FD-9107-1DAA34B9034E}\RP9\change.log Object is locked skipped Scan process completed. |
|
|
|
|
09-13-2007, 01:26 PM
|
#28 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 20,794
OS: XP
|
Re: Trojan.PSW.QQPass.b
Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\Melody Li\Desktop\Submit.zip"
"C:\Documents and Settings\Melody Li\Desktop\[4]-Submit_2007-09-07_ 05240.54.zip"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"%systemdrive%\VundoFix Backups"
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says |
|
|
|
|
09-13-2007, 02:02 PM
|
#31 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 22
OS: WIN XP
|
Re: Trojan.PSW.QQPass.b
Actually, they were removed. I'm currently working with my friend right now to work on his computer (since he's infected also). I will be posting his Kaspersky log onto another thread.
Thanks so much for everything. I really hope I'm virus-free at this point. |
|
|
|
|
| Thread Tools | |
|
|
