|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-04-2008, 09:15 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: India
Posts: 17
OS: windows xp sp2
|
spy.ardamax.j
Hello. Have a trojan on my system and cannot find any information on it on existing forums. Would appreciate any help anyone can offer!
System details: Windows XP, Service pack 2 Antivirus: Avira AntiVir Personal (I have spyware doctor installed but usually disable it when I'm working offline because of how slow the system gets.) My dad's thumb drive got infected by this trojan when he'd taken it for a presentation at another company. (Incidentally, the company he visited is part of the government's aerospace division. Whee!) When he brought it home, the system refused to open the drive; accompanied by an Avira message on the screen saying: "C:\WINDOWS\system32\28463\svchost.exe is the Trojan horse TR/Spy.Ardamax.J" However, after selecting "delete", I was able to open the drive. I noticed the following: 1. "New Folder" executable file in the main drive contents 2. .exe file with the same name as parent folder in all other folders Since I'd seen similar viruses before, I immediately ejected the drive, but not before all other removable drives connected to the system exhibited the same symptoms. :( [I have not tried deleting the system32\28463 folder because I wasn't sure what chain of events that might set up. Also uncertain about how deleting that will help me clean the removable drives.] None of the applications on my system seem affected at this point apart from my registry editor (which is disabled.). I have not run any other system applications, though, so I'm not sure if this is accurate. I ran the Deckard's System Scanner and here are the results: -------------- Deckard's System Scanner v20071014.68 Run by Home on 2008-06-04 18:59:30 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 35: 2008-06-04 13:29:37 UTC - RP208 - Deckard's System Scanner Restore Point 34: 2008-06-03 04:33:04 UTC - RP207 - Installed OpenOffice.org 2.3 33: 2008-06-03 04:29:22 UTC - RP206 - Installed Java(TM) 6 Update 3 32: 2008-06-02 12:29:12 UTC - RP205 - System Checkpoint 31: 2008-06-01 06:22:15 UTC - RP204 - System Checkpoint -- First Restore Point -- 1: 2008-05-03 18:58:36 UTC - RP174 - Software Distribution Service 3.0 Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Home.exe) ------------------------------------------------ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:09:11, on 04/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\WINDOWS\system32\28463\svchost.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\ups.exe H:\My Downloads\My Downloads\dss.exe C:\WINDOWS\system32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\PROGRA~1\TRENDM~1\HIJACK~1\Home.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [svchost Agent] C:\WINDOWS\system32\28463\svchost.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Msn Messsenger] C:\WINDOWS\system32\regsvr.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/shpo/default/shapo.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 6779 bytes -- File Associations ----------------------------------------------------------- .scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\system32\NOTEPAD.EXE" "%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- S3 catchme - c:\docume~1\home\locals~1\temp\catchme.sys (file missing) S3 ydsxg - c:\windows\system32\drivers\ydsxg.sys <Not Verified; YAMAHA Corporation; YAMAHA DS-XG> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - "c:\program files\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: Video Controller (VGA Compatible) Device ID: PCI\VEN_1002&DEV_5A61&SUBSYS_D6008086&REV_00\4&1C9EB71F&0&2808 Manufacturer: Name: Video Controller (VGA Compatible) PNP Device ID: PCI\VEN_1002&DEV_5A61&SUBSYS_D6008086&REV_00\4&1C9EB71F&0&2808 Service: Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318} Description: SM Bus Controller Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0 Manufacturer: Name: SM Bus Controller PNP Device ID: PCI\VEN_1002&DEV_4372&SUBSYS_D6008086&REV_82\3&61AAA01&0&A0 Service: -- Scheduled Tasks ------------------------------------------------------------- 2008-06-04 19:03:48 420 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{FC87BDCE-17AE-4479-A7D3-B71BE90EBB5C}.job 2008-06-02 20:36:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2008-05-29 18:39:00 268 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job 2008-05-16 20:45:43 406 --a------ C:\WINDOWS\Tasks\Norton Security Scan.job 2007-12-31 18:39:32 390 --a------ C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job -- Files created between 2008-05-04 and 2008-06-04 ----------------------------- 2008-06-04 19:08:59 0 d-------- C:\Program Files\Trend Micro 2008-06-04 08:55:00 0 d-------- C:\Program Files\Panda Security 2008-06-04 08:13:30 0 d-------- C:\WINDOWS\ERUNT 2008-06-04 07:58:09 682496 -rahs---- C:\WINDOWS\system32\svchost _exe.vir 2008-06-04 07:58:09 682496 -rahs---- C:\WINDOWS\system32\REGSVR_EXE.vir 2008-06-04 07:58:09 682496 --a------ C:\WINDOWS\regsvr_exe.vir 2008-06-04 07:56:33 0 d--hs---- C:\WINDOWS\system32\28463 2008-05-28 03:41:47 453632 --a------ C:\WINDOWS\system32\stdvcl40.dll <Not Verified; Borland International; Standard VCL ActiveX Library> 2008-05-28 03:41:46 0 d-------- C:\Program Files\Web CEO 2008-05-20 13:19:39 3532 --a------ C:\drmHeader.bin 2008-05-20 04:54:47 0 d-------- C:\Program Files\PQDVD 2008-05-19 18:24:47 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-18 19:49:50 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2008-05-13 20:43:01 0 d-------- C:\Documents and Settings\Home\Application Data\Flickr 2008-05-13 20:42:25 0 d-------- C:\Program Files\Flickr Uploadr 2008-05-13 12:17:04 0 d-------- C:\Documents and Settings\Home\Application Data\Apple Computer 2008-05-12 22:54:56 0 d-------- C:\Program Files\QuickTime 2008-05-12 22:54:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-12 22:54:29 0 d-------- C:\Program Files\Apple Software Update 2008-05-12 22:54:29 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-10 22:37:47 0 d-------- C:\Documents and Settings\Home\Application Data\skypePM 2008-05-10 22:37:47 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-05-10 22:36:45 0 d-------- C:\Documents and Settings\Home\Application Data\Skype 2008-05-10 22:34:07 0 d-------- C:\Program Files\Skype 2008-05-10 22:34:07 0 d-------- C:\Program Files\Common Files\Skype 2008-05-10 22:33:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Skype 2008-05-08 04:49:07 0 d-------- C:\!!media -- Find3M Report --------------------------------------------------------------- 2008-06-04 08:08:17 0 d-------- C:\Documents and Settings\Home\Application Data\uTorrent 2008-06-03 10:00:15 0 d-------- C:\Program Files\Java 2008-06-02 20:37:26 664 --a------ C:\WINDOWS\system32\d3d9caps.dat 2008-05-30 16:38:45 0 d-------- C:\Program Files\Last.fm 2008-05-17 23:07:03 0 d-------- C:\Program Files\Common Files\Symantec Shared 2008-05-16 15:00:04 0 d-------- C:\Program Files\Norton Security Scan 2008-05-10 22:34:07 0 d-------- C:\Program Files\Common Files 2008-05-03 14:17:40 0 d-------- C:\Program Files\Windows Media Connect 2 2008-04-27 22:03:49 0 d-------- C:\Program Files\Winamp 2008-04-23 06:13:09 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-23 06:12:57 0 d-------- C:\Program Files\Common Files\Real 2008-04-20 11:05:18 0 d-------- C:\Documents and Settings\Home\Application Data\Real 2008-04-14 06:48:26 0 d-------- C:\Program Files\Windows Live 2008-04-14 06:47:15 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-07 20:06:16 0 d-------- C:\Program Files\Common Files\Adobe 2008-04-06 05:53:23 552 --a------ C:\WINDOWS\system32\d3d8caps.dat 2008-04-05 20:38:25 0 d-------- C:\Documents and Settings\Home\Application Data\Google 2008-04-05 20:36:52 0 d-------- C:\Program Files\Google -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [04/08/2004 17:30] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 17:30] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [04/08/2004 17:30] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [18/04/2008 16:58] "RTHDCPL"="RTHDCPL.EXE" [30/11/2007 18:42 C:\WINDOWS\RTHDCPL.exe] "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [02/01/2007 02:52] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [23/04/2008 06:12] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 23:37] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "svchost Agent"="C:\WINDOWS\system32\28463\svchost.exe" [25/01/2008 01:24] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 17:30] "Msn Messsenger"="C:\WINDOWS\system32\regsvr.exe" [] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] ALCMTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3937c11-b843-11dc-af84-001676531ecf}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe Open\command- J:\regsvr.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3937c1c-b843-11dc-af84-001676531ecf}] AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe Open\command- J:\regsvr.exe -- End of Deckard's System Scanner: finished at 2008-06-04 19:09:50 ------------ I'm really hoping this is only a minor trojan that can be gotten rid of easily. I work from home a lot and infecting the office systems would not be a good way to endear myself to the bosses! Thanks in advance to anyone who can help me. - T |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-06-2008, 08:33 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,269
OS: XP SP3
|
Re: spy.ardamax.j
Hello and welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ We do not recommend the use of registry cleaners. Our colleague miekiemoes has an excellent writeup here ------------------------------------------------------ I see you have P2P software ( uTorrent and Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. If you decide to uninstall uTorrent and Limewire, also delete these Folders if they still exist: C:\Documents and Settings\Home\Application Data\uTorrent C:\Documents and Settings\Home\Application Data\LimeWire C:\Program Files\uTorrent C:\Program Files\LimeWire ------------------------------------------------------ Download Flash_Disinfector.exe and Save it to your Desktop.
Please visit this webpage for instructions on downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. As part of installing the Recovery Console, ComboFix will begin to run. Follow the prompts to install the Recovery Console. Your desktop may disappear. This is normal. It will return. Once the Recovery Console is installed, this blue window will appear:  Please continue as follows:
Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system. ------------------------------------------------------ Please download HijackThis and Save it to your Desktop. Alternate link This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double-click on HijackThis.exe 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Please post the HijackThis log in your next reply. Do not fix anything in HijackThis since they may be harmless. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt new HijackThis log If you have any questions along the way...STOP and ask them before proceeding. |
|
|
|
|
06-07-2008, 09:37 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: India
Posts: 17
OS: windows xp sp2
|
Re: spy.ardamax.j
Thank you very much!
I have followed all the steps mentioned. Attached is the Combofix file and the new HijackThis log (I had to rename it to a .txt because I was told .log was not a valid format. Is that right? I created a copy and renamed only that in case there is another way to attach it.) I ran the same steps on my father's laptop as well. Can I attach those logs to this same thread? Thanks... |
|
|
|
|
06-07-2008, 09:43 PM
|
#4 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: India
Posts: 17
OS: windows xp sp2
|
Re: spy.ardamax.j
Oops - just realized that I was asked to post and not attach files. Sorry.
Here are the contents of Combo.txt: ComboFix 08-06-06.6 - Home 2008-06-07 22:49:48.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.561 [GMT 5.5:30] Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Home\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\regsvr.exe C:\WINDOWS\system32\28463 C:\WINDOWS\system32\28463\svchost.001 C:\WINDOWS\system32\28463\svchost.002 C:\WINDOWS\system32\28463\svchost.exe C:\WINDOWS\system32\regsvr.exe C:\WINDOWS\system32\setting.ini C:\WINDOWS\system32\setup.ini C:\WINDOWS\system32\svchost .exe . ((((((((((((((((((((((((( Files Created from 2008-05-07 to 2008-06-07 ))))))))))))))))))))))))))))))) . 2008-06-04 19:08 . 2008-06-04 19:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-04 18:53 . 2008-06-04 18:53 <DIR> d-------- C:\Deckard 2008-06-04 08:55 . 2008-06-04 08:58 <DIR> d-------- C:\Program Files\Panda Security 2008-06-04 08:13 . 2008-06-04 08:13 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-04 08:00 . 2008-06-05 17:56 <DIR> d-------- C:\SDFix 2008-05-28 03:41 . 2008-05-28 03:46 <DIR> d-------- C:\Program Files\Web CEO 2008-05-28 03:41 . 2000-01-24 06:01 453,632 --a------ C:\WINDOWS\system32\stdvcl40.dll 2008-05-21 19:15 . 2008-06-05 05:19 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-21 19:15 . 2008-05-21 19:15 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-20 13:19 . 2008-05-20 13:19 3,532 --a------ C:\drmHeader.bin 2008-05-20 04:54 . 2008-05-20 04:54 <DIR> d-------- C:\Program Files\PQDVD 2008-05-19 18:24 . 2008-05-19 18:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-13 20:43 . 2008-05-13 20:43 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Flickr 2008-05-13 20:42 . 2008-06-06 23:31 <DIR> d-------- C:\Program Files\Flickr Uploadr 2008-05-13 12:17 . 2008-05-13 12:17 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Apple Computer 2008-05-12 22:54 . 2008-05-12 22:55 <DIR> d-------- C:\Program Files\QuickTime 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Program Files\Apple Software Update 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-10 22:37 . 2008-05-28 11:09 <DIR> d-------- C:\Documents and Settings\Home\Application Data\skypePM 2008-05-10 22:37 . 2008-05-10 22:37 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-05-10 22:36 . 2008-05-28 12:12 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Skype 2008-05-10 22:34 . 2008-05-10 22:34 <DIR> d-------- C:\Program Files\Skype 2008-05-10 22:34 . 2008-05-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-05-10 22:33 . 2008-05-10 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype 2008-05-08 04:49 . 2008-05-20 05:42 <DIR> d-------- C:\!!media . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-07 15:49 --------- d-----w C:\Documents and Settings\Home\Application Data\uTorrent 2008-06-07 15:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-06-05 11:34 --------- d-----w C:\Program Files\Spyware Doctor 2008-06-03 04:30 --------- d-----w C:\Program Files\Java 2008-05-30 11:08 --------- d-----w C:\Program Files\Last.fm 2008-05-17 17:37 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-16 09:30 --------- d-----w C:\Program Files\Norton Security Scan 2008-05-03 08:47 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-27 16:33 --------- d-----w C:\Program Files\Winamp 2008-04-23 00:43 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-23 00:42 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-04-23 00:42 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-04-23 00:42 --------- d-----w C:\Program Files\Common Files\Real 2008-04-14 01:18 --------- d-----w C:\Program Files\Windows Live 2008-04-14 01:17 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-14 01:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-04-07 14:36 --------- d-----w C:\Program Files\Common Files\Adobe 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-21 02:40 155,995 ----a-w C:\WINDOWS\java\Packages\RFFV3B9J.ZIP 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 17:30 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 17:30 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 17:30 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 17:30 455168] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-18 16:58 262401] "RTHDCPL"="RTHDCPL.EXE" [2007-11-30 18:42 16858624 C:\WINDOWS\RTHDCPL.exe] "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 02:52 3739648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-23 06:12 185896] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-06-12 13:19 1053264] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 17:30 15360] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 02:48 443968] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 18:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-12 20:10 21898024 C:\Program Files\Skype\\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-04-23 06:12 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= S3 ydsxg;ydsxg;C:\WINDOWS\system32\drivers\ydsxg.SYS [1999-09-02 22:22] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3937c11-b843-11dc-af84-001676531ecf}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL regsvr.exe \Shell\Open\command - J:\regsvr.exe . Contents of the 'Scheduled Tasks' folder "2008-06-02 15:06:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-07 17:20:39 C:\WINDOWS\Tasks\At1.job" - C:\WINDOWS\system32\svchost "2008-05-16 15:15:43 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe "2008-05-29 13:09:00 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2007-12-31 13:09:32 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2008-06-07 16:59:39 C:\WINDOWS\Tasks\User_Feed_Synchronization-{FC87BDCE-17AE-4479-A7D3-B71BE90EBB5C}.job" - C:\WINDOWS\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-07 22:52:01 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-07 22:54:42 ComboFix-quarantined-files.txt 2008-06-07 17:23:46 Pre-Run: 26,858,676,224 bytes free Post-Run: 26,853,232,640 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 159 --- E O F --- 2008-05-28 01:26:17 Here are the results of the Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:58:51, on 08/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Google\Google Talk\googletalk.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} - http://zone.msn.com/bingame/shpo/default/shapo.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 6574 bytes -------- I'm also having a small problem with popups which I've never had before (Not since the last virus, at any rate!). Just thought I should mention that? Thank you! |
|
|
|
|
06-08-2008, 12:37 PM
|
#5 (permalink) | ||
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,269
OS: XP SP3
|
Re: spy.ardamax.j
Hello again, tangled_b. Please tell us how your system is behaving.
Please save this page to Notepad in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Quote:
Do not apply this fix to any other computer. ------------------------------------------------------ Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they still exist: (Make sure you do not miss any) R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) Please remember to close all other windows, including browsers then click Fix checked. Please close HijackThis now. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript into ComboFix.exe Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Click Accept, when prompted to install an ActiveX component.
To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here. ------------------------------------------------------ Please post the following in your next reply: C:\ComboFix.txt Kaspersky report new HijackThis log report on system behavior |
||
|
|
|
|
06-09-2008, 11:09 AM
|
#6 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: India
Posts: 17
OS: windows xp sp2
|
Re: spy.ardamax.j
ComboFix.txt
ComboFix 08-06-06.6 - Home 2008-06-09 8:25:04.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.613 [GMT 5.5:30] Running from: C:\Documents and Settings\Home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Home\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\Tasks\At1.job C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job . ((((((((((((((((((((((((( Files Created from 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))) . 2008-06-04 19:08 . 2008-06-04 19:08 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-04 18:53 . 2008-06-04 18:53 <DIR> d-------- C:\Deckard 2008-06-04 08:55 . 2008-06-08 07:53 <DIR> d-------- C:\Program Files\Panda Security 2008-06-04 08:13 . 2008-06-04 08:13 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-28 03:41 . 2008-05-28 03:46 <DIR> d-------- C:\Program Files\Web CEO 2008-05-28 03:41 . 2000-01-24 06:01 453,632 --a------ C:\WINDOWS\system32\stdvcl40.dll 2008-05-21 19:15 . 2008-06-08 17:16 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-21 19:15 . 2008-05-21 19:15 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-20 13:19 . 2008-05-20 13:19 3,532 --a------ C:\drmHeader.bin 2008-05-20 04:54 . 2008-05-20 04:54 <DIR> d-------- C:\Program Files\PQDVD 2008-05-19 18:24 . 2008-05-19 18:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-13 20:43 . 2008-05-13 20:43 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Flickr 2008-05-13 20:42 . 2008-06-06 23:31 <DIR> d-------- C:\Program Files\Flickr Uploadr 2008-05-13 12:17 . 2008-05-13 12:17 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Apple Computer 2008-05-12 22:54 . 2008-05-12 22:55 <DIR> d-------- C:\Program Files\QuickTime 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Program Files\Apple Software Update 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-12 22:54 . 2008-05-12 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-05-10 22:37 . 2008-05-28 11:09 <DIR> d-------- C:\Documents and Settings\Home\Application Data\skypePM 2008-05-10 22:37 . 2008-05-10 22:37 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-05-10 22:36 . 2008-05-28 12:12 <DIR> d-------- C:\Documents and Settings\Home\Application Data\Skype 2008-05-10 22:34 . 2008-05-10 22:34 <DIR> d-------- C:\Program Files\Skype 2008-05-10 22:34 . 2008-05-10 22:34 <DIR> d-------- C:\Program Files\Common Files\Skype 2008-05-10 22:33 . 2008-05-10 22:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-08 19:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-06-08 02:40 --------- d-----w C:\Program Files\TweakNow RegCleaner Std 2008-06-08 02:15 --------- d-----w C:\Documents and Settings\Home\Application Data\uTorrent 2008-06-05 11:34 --------- d-----w C:\Program Files\Spyware Doctor 2008-06-03 04:30 --------- d-----w C:\Program Files\Java 2008-05-30 11:08 --------- d-----w C:\Program Files\Last.fm 2008-05-17 17:37 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-05-16 09:30 --------- d-----w C:\Program Files\Norton Security Scan 2008-05-03 08:47 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-27 16:33 --------- d-----w C:\Program Files\Winamp 2008-04-23 00:43 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-23 00:42 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-04-23 00:42 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-04-23 00:42 --------- d-----w C:\Program Files\Common Files\Real 2008-04-14 01:18 --------- d-----w C:\Program Files\Windows Live 2008-04-14 01:17 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-14 01:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-21 02:40 155,995 ----a-w C:\WINDOWS\java\Packages\RFFV3B9J.ZIP 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of C:\!!media ---- C:\!!media\ ((((((((((((((((((((((((((((( snapshot@2008-06-07_22.53.28.09 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-07 17:15:17 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-09 02:44:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 17:30 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 17:30 208952] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 17:30 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 17:30 455168] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-18 16:58 262401] "RTHDCPL"="RTHDCPL.EXE" [2007-11-30 18:42 16858624 C:\WINDOWS\RTHDCPL.exe] "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 02:52 3739648] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-23 06:12 185896] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-06-12 13:19 1053264] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 17:30 15360] "Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 02:48 443968] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr] --a------ 2005-05-03 18:43 69632 C:\WINDOWS\Alcmtr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-02-12 20:10 21898024 C:\Program Files\Skype\\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-04-23 06:12 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\WINDOWS\\system32\\dpvsetup.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"= S3 ydsxg;ydsxg;C:\WINDOWS\system32\drivers\ydsxg.SYS [1999-09-02 22:22] . Contents of the 'Scheduled Tasks' folder "2008-06-02 15:06:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-16 15:15:43 C:\WINDOWS\Tasks\Norton Security Scan.job" - C:\Program Files\Norton Security Scan\Nss.exe "2008-06-08 19:35:02 C:\WINDOWS\Tasks\User_Feed_Synchronization-{FC87BDCE-17AE-4479-A7D3-B71BE90EBB5C}.job" - C:\WINDOWS\system32\msfeedssync.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-09 08:26:33 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-09 8:28:57 ComboFix-quarantined-files.txt 2008-06-09 02:57:57 ComboFix2.txt 2008-06-08 02:53:55 ComboFix3.txt 2008-06-07 17:24:43 Pre-Run: 26,997,813,248 bytes free Post-Run: 26,988,433,408 bytes free 150 --- E O F --- 2008-05-28 01:26:17 Kaspersky report ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, June 09, 2008 10:19:15 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 9/06/2008 Kaspersky Anti-Virus database records: 841667 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ K:\ L:\ Scan Statistics: Total number of scanned objects: 126539 Number of viruses found: 4 Number of infected objects: 55 Number of suspicious objects: 0 Duration of the scan process: 03:50:15 Infected Object Name / Virus Name / Last Action C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped C:\Deckard\System Scanner\backup\DOCUME~1\Home\LOCALS~1\Temp\gwunstal.exe Infected: Trojan-Downloader.Win32.Banload.ohf skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Home\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Home\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\History\History.IE5\MSHist012008060920080610\index.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Home\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Home\ntuser.dat Object is locked skipped C:\Documents and Settings\Home\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\regsvr.exe.vir Infected: Trojan.Win32.Autoit.ci skipped C:\QooBox\Quarantine\C\WINDOWS\system32\regsvr.exe.vir Infected: Trojan.Win32.Autoit.ci skipped C:\QooBox\Quarantine\C\WINDOWS\system32\svchost .exe.vir Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP207\A0078149_exe.vir Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP207\A0079147_exe.vir Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP207\A0079152.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP207\A0079153.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP208\A0080211.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP208\A0080220.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP208\A0080230.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP208\A0080231.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP208\A0081243.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP215\A0086634.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP215\A0086696.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP216\A0086702.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP216\A0086705.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP216\A0086706.exe Infected: Trojan.Win32.Autoit.ci skipped C:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP221\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\(others)\!!(frm thumb)\(music)\(music) .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\(others)\(others) .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\01 Amritsar .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\comp entry_13.10.07\comp entry_13.10.07 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\dwgs & report\dwgs & report .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\Preliminary BOQ .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\refernce drwngs for est\refernce drwngs for est .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\stc_AIT180108\stc_AIT180108 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\presentation_20.11.07\AmritsarIT\AmritsarIT .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\presentation_20.11.07\presentation_20.11.07 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Research- Sikhism\Research- Sikhism .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\WikiMapia India - Punjab - Amritsar, 3 km_files\WikiMapia India - Punjab - Amritsar, 3 km_files .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\Amritsar .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Amritsar\report\report .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\bB .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\01 Landscape Drawings\01 Landscape Drawings .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\02 Research .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\Landscape notes\Landscape notes .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\pics\pics .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\pics1412\pics1412 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\picture library\picture library .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\03 from architects\03 from architects .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\04 Presentations .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\pics1412\pics1412 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\picture library\picture library .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\Render plans\Render plans .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Deens Academy\Deens Academy .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\bB\Sitara - Devanahalli layout\Sitara - Devanahalli layout .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\SBI\SBI .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\Tharunya\16\16 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\Tharunya\64a\64a .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\Tharunya\Tharunya .exe Infected: Trojan.Win32.Autoit.ci skipped D:\(others)\!!(frm thumb)\visiting card-5\visiting card-5 .exe Infected: Trojan.Win32.Autoit.ci skipped D:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped D:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP194\A0063073.exe/unstall.exe Infected: Trojan-Downloader.Win32.Banload.ohf skipped D:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP194\A0063073.exe ZIP: infected - 1 skipped D:\System Volume Information\_restore{8B3ABFB6-A8E3-4114-BD30-DE7889282DF3}\RP194\A0063090.exe Infected: not-a-virus:AdTool.Win32.Zango.s skipped E:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped F:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped G:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped H:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped H:\My Downloads\Downloads\Mount Eerie - Black Wooden Ceiling.wma Infected: Trojan-Downloader.WMA.GetCodec.a skipped K:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped K:\RECYCLER\S-1-5-21-1708537768-1085031214-839522115-1003\Df1\VIDEO_TS.BUP Object is locked skipped K:\RECYCLER\S-1-5-21-1708537768-1085031214-839522115-1003\Df1\VIDEO_TS.IFO Object is locked skipped K:\RECYCLER\S-1-5-21-1708537768-1085031214-839522115-1003\Df1\VIDEO_TS.VOB Object is locked skipped K:\RECYCLER\S-1-5-21-1708537768-1085031214-839522115-1003\Df1\VTS_01_0.BUP Object is locked skipped K:\RECYCLER\S-1-5-21-1708537768-1085031214-839522115-1003\Df1\VTS_01_0.IFO Object is locked skipped L:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped L:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. new HijackThis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:25:54, on 09/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Spyware Doctor\SDTrayApp.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\LimeWire\LimeWire.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Last.fm Helper.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} - http://zone.msn.com/bingame/shpo/default/shapo.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{15E26308-B656-4F87-9967-416B5CB11D09}: NameServer = 192.168.1.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GO333C~1\GOEC62~1.DLL O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe -- End of file - 6813 bytes report on system behavior There haven't been any popups that I have noticed. The computer is running a little slower than it was about a week ago. No applications have stopped working. Is there anything else I should check? Thank you! |
|
|
|
|
06-09-2008, 11:31 AM
|
#7 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,269
OS: XP SP3
|
Re: spy.ardamax.j
Hello tangled_b.
Quote:
Please read the following article: http://www.techsupportforum.com/secu...ning-slow.html ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "D:\(others)\!!(frm thumb)\(music)\(music) .exe" "D:\(others)\!!(frm thumb)\(others)\(others) .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\01 Amritsar .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\comp entry_13.10.07\comp entry_13.10.07 .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\dwgs & report\dwgs & report .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\Preliminary BOQ .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\refernce drwngs for est\refernce drwngs for est .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Preliminary BOQ\stc_AIT180108\stc_AIT180108 .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\presentation_20.11.07\AmritsarIT\AmritsarIT .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\presentation_20.11.07\presentation_20.11.07 .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\Research- Sikhism\Research- Sikhism .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\01 Amritsar\WikiMapia India - Punjab - Amritsar, 3 km_files\WikiMapia India - Punjab - Amritsar, 3 km_files .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\Amritsar .exe" "D:\(others)\!!(frm thumb)\bB\Amritsar\report\report .exe" "D:\(others)\!!(frm thumb)\bB\bB .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\01 Landscape Drawings\01 Landscape Drawings .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\02 Research .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\Landscape notes\Landscape notes .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\pics\pics .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\pics1412\pics1412 .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\02 Research\picture library\picture library .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\03 from architects\03 from architects .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\04 Presentations .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\pics1412\pics1412 .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\picture library\picture library .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\04 Presentations\Render plans\Render plans .exe" "D:\(others)\!!(frm thumb)\bB\Deens Academy\Deens Academy .exe" "D:\(others)\!!(frm thumb)\bB\Sitara - Devanahalli layout\Sitara - Devanahalli layout .exe" "D:\(others)\!!(frm thumb)\SBI\SBI .exe" "D:\(others)\!!(frm thumb)\Tharunya\16\16 .exe" "D:\(others)\!!(frm thumb)\Tharunya\64a\64a .exe" "D:\(others)\!!(frm thumb)\Tharunya\Tharunya .exe" "D:\(others)\!!(frm thumb)\visiting card-5\visiting card-5 .exe" "H:\My Downloads\Downloads\Mount Eerie - Black Wooden Ceiling.wma" ) do ( del /a/f %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) for %%g in ( "C:\!!media" ) do ( rd /s/q %%g >nul 2>&1 if exist %%g echo.%%g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this:  Double-click on fix.bat to run it. Post back to tell me what it says. |
|
|
|
|
|
06-13-2008, 03:51 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: India
Posts: 17
OS: windows xp sp2
|
Re: spy.ardamax.j
Hello!
Terribly sorry - I haven't had a moment on the computer what with all the sites I've been visiting. (Just realized how that sounded; I meant construction sites.) I ran the fix.bat and it told me: "Deleted Successfully !!" Is that all I need to do? Thanks |
|
|
|
|
06-13-2008, 04:12 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,269
OS: XP SP3
|
Re: spy.ardamax.j
Congratulations. Well done! Your logs appear clean. You should be good to go.
As far as those infected objects listed in the Kaspersky log, those are safely tucked away in ComboFix's quarantine folder or in old System Restore points, which we will be taking care of now. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK combofix /uThis will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore points which contain previous infections, and create a fresh, clean System Restore point. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. FIREWALL Using a third-party Firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice: Do not install more than one Firewall program as they will conflict with each other.SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
