Win32/Rustock.gen!C

[missy_ellie]

yes after the second page i get the Install Active X Control thing pop up at the top of the screen and when i "install" it.. it then goes to the first thumbnail page that you put up but with out any accept button.

[tetonbob]

Try the direct link I posted.

[missy_ellie]

ok so this time it worked ..

[tetonbob]

Cool...so you're getting my second image now, and will be able to run the scan?

[missy_ellie]

"Failed to load Kaspersky Online Scanner ActiveX control!

You must have administrative rights on this computer;
you also must have the IE security settings to the Medium level."

how do i change the IE settings?
im assuming that i already have administrative rights

[tetonbob]

Hmmm, we'll try one more thing, and then move on....sometimes some scanners just are unhappy with some systems. Panda ran just fine, so if you're still in the same account, yes, you should have admin rights.

Please check your ActiveX security settings (Start -> (Settings) -> Control Panel -> Internet Options, Security Tab -> Internet -> Custom Level).

Make sure the following are checked:

ActiveX controls and plug-ins
* Download signed ActiveX controls (Prompt)
* Download unsigned ActiveX controls (Disable)
* Initialize and script ActiveX controls not marked as safe (Disable)
* Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
* Script ActiveX controls marked safe for scripting (Prompt)


Let me know.

[missy_ellie]

Monday, February 26, 2007 5:57:32 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 26/02/2007
Kaspersky Anti-Virus database records: 273380


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 75427
Number of viruses found 5
Number of infected objects 12 / 0
Number of suspicious objects 0
Duration of the scan process 0101

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\McAfee\MNA\NAData Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\Elise\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\ApplicationHistory\hpqgalry.exe.cf8dd223.ini.inuse Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\administrativeInfo.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\albumImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\albumTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\CB_Server_Errors.txt Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\EXIFTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\imageTable.fpt Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\keywordImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\keywordTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\managedFolderTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\pathnameTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\ROFImagesTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.cdx Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\HP\Digital Imaging\db\ROFTable.dbf Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\pending.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\Working\database_7658_69B8_5869_77AF\dfsr.db Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\Working\database_7658_69B8_5869_77AF\fsr.log Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\Working\database_7658_69B8_5869_77AF\fsrtmp.log Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Messenger\funkybaby333@hotmail.com\SharingMetadata\Working\database_7658_69B8_5869_77AF\tmp.edb Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Windows Live Contacts\funkybaby333@hotmail.com\real\members.stg Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Application Data\Microsoft\Windows Live Contacts\funkybaby333@hotmail.com\shadow\members.stg Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\History\History.IE5\MSHist012007022620070227\index.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\hpodvd09.log Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\JET27A3.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\JETD745.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\PICLog.log Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF2D6E.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF2D7C.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF2F24.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF3731.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF64F6.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF659B.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temp\~DF86E7.tmp Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temporary Internet Files\Content.IE5\ASK7WW7N\std_7715f16b568b433ec958d0f6fd554fd2[1].mp3 Object is locked skipped

C:\Documents and Settings\Elise\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Elise\ntuser.dat Object is locked skipped

C:\Documents and Settings\Elise\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Samsung\AVStation premium\Bin\MediaDB.ldb Object is locked skipped

C:\Program Files\Samsung\AVStation premium\Bin\MediaDB.mdb Object is locked skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar/whAgent.exe Infected: not-a-virus:AdWare.Win32.WebHancer.351 skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar/whInstaller.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar/whSurvey.exe Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar/webhdll.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar/whiehlpr.dll Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002/data.rar Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.WebHancer skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream/data0003 Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe/stream Infected: not-a-virus:AdTool.Win32.WinAD.bv skipped

C:\RECYCLER\S-1-5-21-3031989716-3685002225-2810315059-1005\Dc6.exe NSIS: infected - 10 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{FC190EAD-247A-44D3-90E8-D6004862F739}\RP224\A0145045.exe Infected: Trojan-Downloader.Win32.Adload.hd skipped

C:\System Volume Information\_restore{FC190EAD-247A-44D3-90E8-D6004862F739}\RP235\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{B83D999D-2407-4C4E-AC14-89889288B127}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[tetonbob]

Excellent!

All Kaspersky found was items in Recycle Bin, and System Restore. We'll take care of that shortly.

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Well done. Your logs are clean. Any more issues? If not you should be good to go. We still have a few items to address.


Reset hidden/system files and folders

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View tab.
• Deselect the Show hidden files and folders option.
• Select the Hide file extensions for known types option.
• Select the Hide protected operating system files option.
• Click Yes to confirm.
• Click OK.

Create a new System Restore point

• click Start >> Run - type SYSDM.CPL & press Enter
• select the System Restore Tab
• tick on the checkbox - "Turn off System Restore on all drives"
• click Apply
• then untick the same checkbox & click OK

Enable Windows Auto Update

• Go to Start>Run - type wuaucpl.cpl
• tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify".
• Click on "OK".

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• SpywareGuard to catch and block spyware before it can execute.
  
• SPYBOT - SEARCH & DESTROY
  Download and install Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here
  
• AD-AWARE
  Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here
  
  
• IE-SPYAD - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Download IE-SpyAD - Extract the contents to a new folder
    From within the folder, double-click install.bat
    Select Option #2 - Install the new IE-SPYAD list.
    Then return to the main menu.
    Select option #4 - Add the old porn sites domain
  
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  • Download Host.zip to your desktop.
  • From your Desktop right-click (hosts.zip) and select:
    Extract All from the menu.
    
  • Click Next, click Next, select the option:
    "Show Extracted files", click Finish
    
  • This will open the newly created hosts folder on your Desktop.
    
  • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
  
  
  
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  Here are a few very good free Antivirus products which are available:
  • AOL Active Virus Shield (powered by Kaspersky Antivirus)
  • Avast!
  • AVG
  • Avira PersonalEdition Classic
  Select one of these, or another of your choice. Do not install more than one antivirus program because they will conflict with each other. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  

  See this link for a listing of some online antivirus scanners:
  
  Anti-Spyware Tutorial

• FIREWALL
  If you do not have a firewall, here are a couple of great free ones available for personal use. Using a third-party firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:
  
  Do not install more than one firewall program because they will conflict with each other.

• Comodo Personal Firewall
• ZoneAlarm

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• HOW DID I GET INFECTED IN THE FIRST PLACE?
• THE ANTI-SPYWARE TUTORIAL
• MAKING INTERNET EXPLORER SAFER

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[missy_ellie]

Thank You Very Much,
so am i totally virus free now?

[tetonbob]

To the best of my knowledge from here, yes.

Keep your AV and Anti-Spyware programs up to date. Scan regularly. Prevention begins at the keyboard, so use common sense when surfing and downloading files.