|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
11-17-2008, 05:26 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Antivirus 2009 and a lot of Trojan
Hi
I got infected with Antivirus 2009 and then a whole lot things came along with it.. I used a lot of tools and got rid of stuff.. i.e Symantec online.. kaspersky .... however there are popups still coming .... and it keeps using my resources... making the comp really slow. please can someone help. Here is the DDS.txt DDS (Version 1.0) - NTFSx86 Run by Konraddsa at 22:04:40.97 on Mon 11/17/2008 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.253 [GMT 0:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Dell\Bluetooth Software\bin\btwdins.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\Dell\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\Dell\BLUETO~1\BTSTAC~1.EXE C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Downloads\Installs\dds.scr ============== Psuedo HJT Report =============== uStart Page = about:blank uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway BHO: {b4a66ac1-7c50-46a7-913a-51b86a22ddfb} - c:\windows\system32\zasulege.dll TB: {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - c:\program files\veoh networks\veohwebplayer\VeohIEToolbar.dll uRun: [googletalk] "c:\program files\google\google talk\googletalk.exe" /autostart uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [DMXLauncher] c:\program files\dell\media experience\DMXLauncher.exe mRun: [wosefekumo] Rundll32.exe "c:\windows\system32\sabelowo.dll",s mRun: [SNM] c:\program files\spynomore\SNM.exe /startup mRun: [AVP] "c:\program files\kaspersky lab\kaspersky anti-virus 7.0\avp.exe" mRun: [30029bf8] rundll32.exe "c:\windows\system32\pufegogu.dll",b mRun: [CPM3331a864] Rundll32.exe "c:\windows\system32\tipulaya.dll",a StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\bttray.lnk - c:\program files\dell\bluetooth software\BTTray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: Download ALL with IDA IE: Download with IDA IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000 IE: Send To &Bluetooth - c:\program files\dell\bluetooth software\btsendto_ie_ctx.htm IE: {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky anti-virus 7.0\SCIEPlgn.dll IE: {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Handler: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - c:\windows\system32\BTXPPanel.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll AppInit_DLLs: c:\windows\system32\yapafeju.dll c:\windows\system32\jedemeja.dll c:\windows\system32\tipulaya.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tipulaya.dll STS: {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tipulaya.dll LSA: Notification Packages = scecli c:\windows\system32\yapafeju.dll ============= SERVICES / DRIVERS =============== R0 ENO;ENO;c:\windows\system32\drivers\ENO.sys R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys =============== Created Last 30 ================ 2008-11-17 21:22 250 a------- c:\windows\gmer.ini 2008-11-17 11:44 1,538,176 ---sh--- c:\windows\system32\ugogefup.ini 2008-11-16 12:39 4,252 ---sh--- c:\windows\system32\mojeboto.dll 2008-11-16 00:39 4,252 ---sh--- c:\windows\system32\nivifutu.dll 2008-11-15 12:39 4,252 ---sh--- c:\windows\system32\gofoloju.dll 2008-11-14 23:37 1,538,702 ---sh--- c:\windows\system32\obusorus.ini 2008-11-14 09:19 1,535,276 ---sh--- c:\windows\system32\oserepov.ini 2008-11-14 04:01 <DIR> --d----- c:\program files\common files\Wise Installation Wizard 2008-11-14 03:49 2,392 a------- c:\windows\system32\tmp.reg 2008-11-13 21:19 1,535,280 ---sh--- c:\windows\system32\uyegutum.ini 2008-11-12 21:33 1,152 a------- c:\windows\system32\windrv.sys 2008-11-12 21:28 <DIR> --d----- c:\program files\common files\Download Manager 2008-11-12 20:57 <DIR> --d----- c:\windows\system32\LogFiles 2008-11-12 19:37 <DIR> --d----- C:\Priya 2008-11-12 18:29 96,976 a------- c:\windows\system32\drivers\klin.dat 2008-11-12 18:29 87,855 a------- c:\windows\system32\drivers\klick.dat 2008-11-12 18:27 4,913,696 a--sh--- c:\windows\system32\drivers\fidbox.dat 2008-11-12 18:27 66,620 a--sh--- c:\windows\system32\drivers\fidbox.idx 2008-11-12 18:27 57,888 a--sh--- c:\windows\system32\drivers\fidbox2.dat 2008-11-12 18:27 6,356 a--sh--- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 18:27 <DIR> --d----- c:\program files\Kaspersky Lab 2008-11-12 18:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab 2008-11-12 18:21 <DIR> --d----- C:\kav 2008-11-12 16:54 1,540,096 a------- c:\windows\system32\apoyapon.tmp 2008-11-12 09:18 1,543,223 ---sh--- c:\windows\system32\apoyapon.ini 2008-11-11 21:18 1,550,755 ---sh--- c:\windows\system32\ahidoviv.ini 2008-11-11 21:08 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avg8 2008-11-11 04:17 4,252 ---sh--- c:\windows\system32\fetabeke.exe 2008-11-09 22:39 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Malwarebytes 2008-11-09 14:16 60,928 a------- c:\docume~1\alluse~1\applic~1\Y8rR66O3.exe 2008-11-08 23:08 5,632 a------- c:\windows\system32\ptpusb.dll 2008-11-08 23:08 159,232 a------- c:\windows\system32\ptpusd.dll 2008-11-08 00:23 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Lavasoft 2008-11-05 00:24 <DIR> --d----- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-02 17:59 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes 2008-11-02 15:58 18,534 a------- c:\docume~1\alluse~1\applic~1\juguw.dat 2008-11-02 15:58 17,533 a------- c:\windows\akajury.inf 2008-11-02 15:58 15,676 a------- c:\windows\yvonebesas.dl 2008-11-02 15:58 13,727 a------- c:\windows\kiqemyc.dat 2008-11-02 15:58 13,275 a------- c:\windows\system32\aroleni.inf 2008-11-02 15:58 12,456 a------- c:\program files\common files\hotow.bat 2008-11-02 15:58 11,914 a------- c:\windows\alysyfi.bat 2008-11-02 15:58 11,871 a------- c:\docume~1\konrad~1\applic~1\utyxaj.dat 2008-11-02 15:58 11,562 a------- c:\windows\jeharaxu.com 2008-11-02 15:58 11,380 a------- c:\docume~1\konrad~1\applic~1\samob.com 2008-11-02 15:58 11,101 a------- c:\windows\exylop.scr 2008-11-02 15:58 10,892 a------- c:\docume~1\alluse~1\applic~1\kowoxar.sys 2008-11-02 15:39 31,744 a------- c:\windows\system32\B603tbw6.exe 2008-10-23 20:49 337,408 -------- c:\windows\system32\dllcache\netapi32.dll ==================== Find3M ==================== 2008-11-17 11:38 90,164 a--sh--- c:\windows\system32\tipulaya.dll 2008-11-13 09:19 92,212 a--sh--- c:\windows\system32\delutaha.dll 2008-11-12 21:19 92,212 a--sh--- c:\windows\system32\kenayiba.dll 2008-11-12 21:10 <DIR> --d----- c:\program files\Spybot - Search & Destroy 2008-11-12 21:10 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2008-11-12 09:18 92,212 a--sh--- c:\windows\system32\povorika.dll 2008-11-11 21:18 86,068 -------- c:\windows\system32\vivodiha.dll 2008-11-11 21:09 <DIR> --d----- c:\program files\AIM 2008-11-11 20:41 <DIR> --d----- c:\docume~1\alluse~1\applic~1\McAfee.com 2008-11-09 22:16 92,212 a--sh--- c:\windows\system32\nowuposi.dll 2008-11-09 10:16 92,212 a--sh--- c:\windows\system32\bovenage.dll 2008-11-05 22:26 <DIR> --d----- c:\program files\DivX 2008-10-12 18:31 <DIR> --d----- c:\program files\Veoh Networks 2008-10-12 14:21 <DIR> --d----- c:\program files\Messenger 2008-10-12 14:18 78,575 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-10-12 13:50 <DIR> --d----- c:\program files\Windows NT 2008-09-19 21:55 1,044,480 a------- c:\windows\system32\libdivx.dll 2008-09-19 21:55 200,704 a------- c:\windows\system32\ssldivx.dll 2008-09-15 12:12 1,846,400 a------- c:\windows\system32\win32k.sys 2008-09-15 12:12 1,846,400 -------- c:\windows\system32\dllcache\win32k.sys 2008-09-08 10:41 333,824 -------- c:\windows\system32\dllcache\srv.sys 2008-08-20 05:30 3,067,904 -------- c:\windows\system32\dllcache\mshtml.dll 2008-08-20 05:30 619,520 -------- c:\windows\system32\dllcache\urlmon.dll 2008-08-20 05:30 666,112 a------- c:\windows\system32\wininet.dll 2008-08-20 05:30 1,499,136 -------- c:\windows\system32\dllcache\shdocvw.dll 2008-08-20 05:30 666,112 -------- c:\windows\system32\dllcache\wininet.dll 2008-06-21 00:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SupportSoft 2008-06-07 13:15 <DIR> --d----- c:\docume~1\konrad~1\applic~1\yoclient 2008-04-20 22:20 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TVU Networks 2008-02-02 17:14 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Dell 2008-01-01 12:47 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Teleca 2008-01-01 12:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Sony Ericsson 2008-01-01 12:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Teleca 2007-12-05 23:16 <DIR> --d----- c:\docume~1\konrad~1\applic~1\AOL 2007-02-09 23:04 <DIR> --d----- c:\docume~1\konrad~1\applic~1\.BitTornado 2007-02-09 22:59 <DIR> --d----- c:\docume~1\konrad~1\applic~1\.bittorrent 2007-01-24 12:45 <DIR> --d----- c:\docume~1\konrad~1\applic~1\AdobeAUM 2006-12-15 22:22 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Unyte 2006-11-30 14:26 <DIR> --d----- c:\docume~1\konrad~1\applic~1\MSNInstaller 2005-12-01 02:14 <DIR> --d----- c:\docume~1\konrad~1\applic~1\vlc 2005-10-08 00:44 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Symantec 2005-08-24 22:15 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Internet Download Accelerator 2005-07-30 03:40 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Jasc Software Inc 2005-07-21 17:55 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Symantec 2005-07-16 02:40 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intuit 2005-07-16 02:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2005-07-16 02:25 <DIR> --d----- c:\docume~1\konrad~1\applic~1\Intel 2005-07-16 02:24 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intel 2004-08-10 18:13 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBSI 2008-08-09 10:11 60,928 a--sh--- c:\windows\system32\yapafeju.dll 2008-08-09 10:11 60,928 a--sh--- c:\windows\system32\zasulege.dll ============= FINISH: 22:07:28.22 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
11-18-2008, 01:40 PM
|
#2 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Re: Antivirus 2009 and a lot of Trojan
please find the Combo fix and LopS&D log
ComboFix 08-11-16.05 - Konraddsa 2008-11-17 22:20:21.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.230 [GMT 0:00] Running from: c:\documents and settings\Konraddsa\Desktop\ComboFix.exe * Created a new restore point . The following files were disabled during the run: c:\windows\system32\yapafeju.dll c:\windows\system32\tipulaya.dll ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\bold.log c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\All Users\Application Data\Y8rR66O3.exe c:\documents and settings\Konraddsa\cookies\daxilo.bin c:\documents and settings\Konraddsa\cookies\yvitif.pif c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\gurawodopy.reg c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\ijah.scr c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\ozod.bin c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\siham.lib c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\tekip._sy c:\documents and settings\Konraddsa\Local Settings\Temporary Internet Files\umybusa.ban c:\windows\system32\ahidoviv.ini c:\windows\system32\apoyapon.ini c:\windows\system32\bszip.dll c:\windows\system32\obusorus.ini c:\windows\system32\oserepov.ini c:\windows\system32\ugogefup.ini c:\windows\system32\uyegutum.ini ----- BITS: Possible infected sites ----- hxxp://77.74.48.105 . ((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 ))))))))))))))))))))))))))))))) . 2008-11-17 21:22 . 2008-11-17 21:33 250 --a------ c:\windows\gmer.ini 2008-11-16 12:39 . 2008-11-16 12:39 4,252 --ahs---- c:\windows\system32\mojeboto.dll 2008-11-16 00:39 . 2008-11-16 00:39 4,252 --ahs---- c:\windows\system32\nivifutu.dll 2008-11-15 12:39 . 2008-11-15 12:39 4,252 --ahs---- c:\windows\system32\gofoloju.dll 2008-11-14 04:01 . 2008-11-14 04:01 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-14 03:49 . 2008-11-14 03:52 2,392 --a------ c:\windows\system32\tmp.reg 2008-11-12 21:33 . 2008-11-12 21:33 1,152 --a------ c:\windows\system32\windrv.sys 2008-11-12 21:28 . 2008-11-12 21:28 <DIR> d-------- c:\program files\Common Files\Download Manager 2008-11-12 20:57 . 2008-11-12 20:57 <DIR> d-------- c:\windows\system32\LogFiles 2008-11-12 19:37 . 2008-11-12 19:41 <DIR> d-------- C:\Priya 2008-11-12 18:29 . 2008-11-12 20:53 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-11-12 18:29 . 2008-11-12 20:53 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-11-12 18:27 . 2008-11-12 18:27 <DIR> d-------- c:\program files\Kaspersky Lab 2008-11-12 18:27 . 2008-11-17 21:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab 2008-11-12 18:27 . 2008-11-17 22:36 4,985,376 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-12 18:27 . 2008-11-17 22:30 67,796 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-12 18:27 . 2008-11-17 22:35 62,752 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-11-12 18:27 . 2008-11-17 22:30 6,884 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 18:21 . 2008-11-12 18:21 <DIR> d-------- C:\kav 2008-11-12 16:54 . 2008-11-12 16:54 1,540,096 --a------ c:\windows\system32\apoyapon.tmp 2008-11-11 21:08 . 2008-11-11 21:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 2008-11-11 04:17 . 2008-11-11 04:17 4,252 --ahs---- c:\windows\system32\fetabeke.exe 2008-11-09 22:39 . 2008-11-09 22:39 <DIR> d-------- c:\documents and settings\Konraddsa\Application Data\Malwarebytes 2008-11-08 23:08 . 2008-04-14 01:12 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-08 23:08 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-08 00:23 . 2008-11-12 21:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-05 01:01 . 2008-11-05 22:04 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP 2008-11-05 00:24 . 2008-11-05 00:24 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-02 19:22 . 2008-11-02 19:22 <DIR> d---s---- c:\documents and settings\Administrator\UserData 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2008-11-02 17:57 . 2008-11-02 17:57 52,288 --a------ c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT 2008-11-02 15:58 . 2008-11-02 15:58 18,534 --a------ c:\documents and settings\All Users\Application Data\juguw.dat 2008-11-02 15:58 . 2008-11-02 15:58 17,533 --a------ c:\windows\akajury.inf 2008-11-02 15:58 . 2008-11-02 15:58 15,676 --a------ c:\windows\yvonebesas.dl 2008-11-02 15:58 . 2008-11-02 15:58 13,727 --a------ c:\windows\kiqemyc.dat 2008-11-02 15:58 . 2008-11-02 15:58 13,275 --a------ c:\windows\system32\aroleni.inf 2008-11-02 15:58 . 2008-11-02 15:58 12,456 --a------ c:\program files\Common Files\hotow.bat 2008-11-02 15:58 . 2008-11-02 15:58 11,914 --a------ c:\windows\alysyfi.bat 2008-11-02 15:58 . 2008-11-02 15:58 11,871 --a------ c:\documents and settings\Konraddsa\Application Data\utyxaj.dat 2008-11-02 15:58 . 2008-11-02 15:58 11,562 --a------ c:\windows\jeharaxu.com 2008-11-02 15:58 . 2008-11-02 15:58 11,380 --a------ c:\documents and settings\Konraddsa\Application Data\samob.com 2008-11-02 15:58 . 2008-11-02 15:58 11,101 --a------ c:\windows\exylop.scr 2008-11-02 15:58 . 2008-11-02 15:58 10,892 --a------ c:\documents and settings\All Users\Application Data\kowoxar.sys 2008-11-02 15:39 . 2008-11-02 15:39 31,744 --a------ c:\windows\system32\B603tbw6.exe 2008-10-23 20:49 . 2008-10-15 16:34 337,408 --------- c:\windows\system32\dllcache\netapi32.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-17 11:38 90,164 ----a-w c:\windows\system32\tipulaya.dll.vir 2008-11-13 09:19 92,212 --sha-w c:\windows\system32\delutaha.dll 2008-11-12 21:19 92,212 --sha-w c:\windows\system32\kenayiba.dll 2008-11-12 21:10 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-12 21:10 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-12 20:56 112,144 ----a-w c:\windows\system32\drivers\kl1.sys 2008-11-12 09:18 92,212 --sha-w c:\windows\system32\povorika.dll 2008-11-11 21:18 86,068 ----a-w c:\windows\system32\vivodiha.dll 2008-11-11 21:09 --------- d-----w c:\program files\AIM 2008-11-11 21:09 --------- d-----w c:\documents and settings\Konraddsa\Application Data\Aim 2008-11-11 20:41 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com 2008-11-09 22:16 92,212 --sha-w c:\windows\system32\nowuposi.dll 2008-11-09 10:16 92,212 --sha-w c:\windows\system32\bovenage.dll 2008-11-05 22:26 --------- d-----w c:\program files\DivX 2008-11-04 01:35 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-11-02 15:58 17,630 ----a-w c:\program files\Common Files\fukok._sy 2008-10-12 18:31 --------- d-----w c:\program files\Veoh Networks 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys 2008-08-20 05:30 666,112 ----a-w c:\windows\system32\wininet.dll 2008-08-20 05:30 666,112 ------w c:\windows\system32\dllcache\wininet.dll 2008-08-20 05:30 619,520 ------w c:\windows\system32\dllcache\urlmon.dll 2008-08-20 05:30 3,067,904 ------w c:\windows\system32\dllcache\mshtml.dll 2008-08-20 05:30 1,499,136 ------w c:\windows\system32\dllcache\shdocvw.dll 2008-07-05 01:14 52,288 ----a-w c:\documents and settings\Konraddsa\Application Data\GDIPFONTCACHEV1.DAT 2008-04-08 13:15 32 ----a-r c:\documents and settings\All Users\hash.dat 2008-08-09 10:11 60,928 --sha-w c:\windows\system32\zasulege.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b4a66ac1-7c50-46a7-913a-51b86a22ddfb}] 2008-08-09 10:11 60928 --ahs---- c:\windows\system32\zasulege.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 339968] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 227856] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\Dell\Bluetooth Software\BTTray.exe [2004-04-09 561213] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-07-16 24576] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^24Online Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\24Online Client.lnk backup=c:\windows\pss\24Online Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 Detect.lnk backup=c:\windows\pss\PCSuiteForNokia6600 Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 TS.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 TS.lnk backup=c:\windows\pss\PCSuiteForNokia6600 TS.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-07 04:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2005-01-31 21:35 155648 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-02-23 21:19 53248 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-07-27 21:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-07-27 21:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-03-14 23:05 257088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-14 13:50 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Tray Application] --a------ 2003-02-10 18:30 425984 c:\program files\Common Files\Nokia\NCLTools\NclTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-02-16 14:54 282624 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2003-11-19 22:48 32881 c:\program files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZingSpooler] --a------ 2004-08-05 19:38 188416 c:\program files\Common Files\Zing\ZingSpooler.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "c:\\Program Files\\GameHouse\\TextTwist\\TextTwist.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= "c:\\Program Files\\BitTornado\\btdownloadgui.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= "c:\\WINDOWS\\system32\\taskmgr.exe"= "c:\\WINDOWS\\system32\\cmd.exe"= "c:\\WINDOWS\\system32\\winlogon.exe"= "c:\\kav\\kav7\\setup.exe"= "c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= . - - - - ORPHANS REMOVED - - - - HKCU-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe HKLM-Run-wosefekumo - c:\windows\system32\sabelowo.dll HKLM-Run-SNM - c:\program files\SpyNoMore\SNM.exe HKLM-Run-30029bf8 - c:\windows\system32\pufegogu.dll HKLM-Run-CPM3331a864 - c:\windows\system32\tipulaya.dll SharedTaskScheduler-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tipulaya.dll SSODL-SSODL-{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\tipulaya.dll MSConfigStartUp-kgsystray - c:\program files\Kuma Games\kgsystray\Kuma_tray.exe MSConfigStartUp-MCAgentExe - c:\progra~1\mcafee.com\agent\mcagent.exe MSConfigStartUp-MCUpdateExe - c:\progra~1\mcafee.com\agent\mcupdate.exe MSConfigStartUp-OASClnt - c:\program files\McAfee.com\VSO\oasclnt.exe MSConfigStartUp-VirusScan Online - c:\program files\McAfee.com\VSO\mcvsshld.exe MSConfigStartUp-VSOCheckTask - c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Konraddsa\Application Data\Mozilla\Firefox\Profiles\z8hikuzh.Default User\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-17 22:32:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\windows\system32\scardsvr.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\windows\system32\ati2evxx.exe c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\program files\Dell\Bluetooth Software\bin\btwdins.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\wscntfy.exe c:\progra~1\Dell\BLUETO~1\BTSTAC~1.EXE c:\program files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Completion time: 2008-11-17 22:48:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-17 22:48:28 Pre-Run: 13,226,389,504 bytes free Post-Run: 17,566,990,336 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 279 --- E O F --- 2008-10-23 21:38:43 |
|
|
|
|
11-19-2008, 06:38 PM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Hello -
ComboFix should not be run unless requested by a trained helper. ComboFix is frequently updated. Please delete your existing version.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-23-2008, 07:15 PM
|
#4 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Still with me, konraddsa?
I generally unsubscribe from threads after 7 days of inactivity. If I don't receive a reply from you within 3 days of this post, this topic will be closed. You've already had one topic closed due to inactivity. You may find that help is not forthcoming in the future. We are all volunteers, and only take a limited number of topics at one time. With your topic occupying one of us, we cannot therefore help someone else who also needs it.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-24-2008, 12:53 PM
|
#5 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Re: Antivirus 2009 and a lot of Trojan
Sorry about that. Its just that whenever i used to run IE or firefox my computer used to just hang.
PLease find the COmbofix log attached. Please let me know the next steps. I still get the popup to install Antivirus 2009 Thanks Konrad ComboFix 08-11-23.02 - Konraddsa 2008-11-24 19:29:49.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.165 [GMT 0:00] Running from: c:\documents and settings\Konraddsa\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\ajoyiyoj.ini c:\windows\system32\aratebig.ini c:\windows\system32\bisepufi.dll c:\windows\system32\bovenage.dll c:\windows\system32\delutaha.dll c:\windows\system32\fufakili.dll c:\windows\system32\ilikafuf.ini c:\windows\system32\jevetedo.dll c:\windows\system32\joyiyoja.dll c:\windows\system32\kabunabo.dll c:\windows\system32\kenayiba.dll c:\windows\system32\kuhumepe.dll c:\windows\system32\nowuposi.dll c:\windows\system32\obunojet.ini c:\windows\system32\povorika.dll c:\windows\system32\tevajeke.dll c:\windows\system32\tipulaya.dll c:\windows\system32\vivodiha.dll c:\windows\system32\wadubebe.dll c:\windows\system32\yapafeju.dll c:\windows\system32\yesileya.dll c:\windows\system32\zasulege.dll . ((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 ))))))))))))))))))))))))))))))) . 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-11-18 20:48 . 2008-11-18 20:48 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-18 20:48 . 2008-10-22 16:27 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-18 20:48 . 2008-10-22 16:27 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-18 00:21 . 2008-11-18 00:24 <DIR> d-------- c:\program files\EsetOnlineScanner 2008-11-17 22:52 . 2008-11-18 00:53 <DIR> d-------- C:\Lop SD 2008-11-17 22:44 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-17 22:43 . 2008-09-04 17:15 1,106,944 --a------ c:\windows\system32\SETE.tmp 2008-11-17 22:43 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-17 21:22 . 2008-11-17 21:33 250 --a------ c:\windows\gmer.ini 2008-11-16 12:39 . 2008-11-16 12:39 4,252 --ahs---- c:\windows\system32\mojeboto.dll 2008-11-16 00:39 . 2008-11-16 00:39 4,252 --ahs---- c:\windows\system32\nivifutu.dll 2008-11-15 12:39 . 2008-11-15 12:39 4,252 --ahs---- c:\windows\system32\gofoloju.dll 2008-11-14 04:01 . 2008-11-14 04:01 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-14 03:49 . 2008-11-14 03:52 2,392 --a------ c:\windows\system32\tmp.reg 2008-11-12 21:33 . 2008-11-12 21:33 1,152 --a------ c:\windows\system32\windrv.sys 2008-11-12 21:28 . 2008-11-12 21:28 <DIR> d-------- c:\program files\Common Files\Download Manager 2008-11-12 20:57 . 2008-11-12 20:57 <DIR> d-------- c:\windows\system32\LogFiles 2008-11-12 19:37 . 2008-11-12 19:41 <DIR> d-------- C:\Priya 2008-11-12 18:29 . 2008-11-12 20:53 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-11-12 18:29 . 2008-11-12 20:53 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-11-12 18:27 . 2008-11-12 18:27 <DIR> d-------- c:\program files\Kaspersky Lab 2008-11-12 18:27 . 2008-11-24 19:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab 2008-11-12 18:27 . 2008-11-24 19:39 5,585,696 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-12 18:27 . 2008-11-24 19:39 80,160 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-11-12 18:27 . 2008-11-24 19:37 75,836 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-12 18:27 . 2008-11-24 19:37 8,540 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 18:21 . 2008-11-12 18:21 <DIR> d-------- C:\kav 2008-11-12 16:54 . 2008-11-12 16:54 1,540,096 --a------ c:\windows\system32\apoyapon.tmp 2008-11-11 21:08 . 2008-11-11 21:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 2008-11-11 04:17 . 2008-11-11 04:17 4,252 --ahs---- c:\windows\system32\fetabeke.exe 2008-11-09 22:39 . 2008-11-09 22:39 <DIR> d-------- c:\documents and settings\Konraddsa\Application Data\Malwarebytes 2008-11-08 23:08 . 2008-04-14 01:12 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-08 23:08 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-08 00:23 . 2008-11-12 21:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-05 01:01 . 2008-11-05 22:04 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP 2008-11-05 00:24 . 2008-11-23 21:46 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-02 19:22 . 2008-11-02 19:22 <DIR> d---s---- c:\documents and settings\Administrator\UserData 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2008-11-02 17:57 . 2008-11-02 17:57 52,288 --a------ c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT 2008-11-02 15:58 . 2008-11-02 15:58 18,534 --a------ c:\documents and settings\All Users\Application Data\juguw.dat 2008-11-02 15:58 . 2008-11-02 15:58 17,533 --a------ c:\windows\akajury.inf 2008-11-02 15:58 . 2008-11-02 15:58 15,676 --a------ c:\windows\yvonebesas.dl 2008-11-02 15:58 . 2008-11-02 15:58 13,727 --a------ c:\windows\kiqemyc.dat 2008-11-02 15:58 . 2008-11-02 15:58 13,275 --a------ c:\windows\system32\aroleni.inf 2008-11-02 15:58 . 2008-11-02 15:58 12,456 --a------ c:\program files\Common Files\hotow.bat 2008-11-02 15:58 . 2008-11-02 15:58 11,914 --a------ c:\windows\alysyfi.bat 2008-11-02 15:58 . 2008-11-02 15:58 11,871 --a------ c:\documents and settings\Konraddsa\Application Data\utyxaj.dat 2008-11-02 15:58 . 2008-11-02 15:58 11,562 --a------ c:\windows\jeharaxu.com 2008-11-02 15:58 . 2008-11-02 15:58 11,380 --a------ c:\documents and settings\Konraddsa\Application Data\samob.com 2008-11-02 15:58 . 2008-11-02 15:58 11,101 --a------ c:\windows\exylop.scr 2008-11-02 15:58 . 2008-11-02 15:58 10,892 --a------ c:\documents and settings\All Users\Application Data\kowoxar.sys 2008-11-02 15:39 . 2008-11-02 15:39 31,744 --a------ c:\windows\system32\B603tbw6.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 22:56 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-23 13:04 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-12 20:56 112,144 ----a-w c:\windows\system32\drivers\kl1.sys 2008-11-11 21:09 --------- d-----w c:\program files\AIM 2008-11-11 21:09 --------- d-----w c:\documents and settings\Konraddsa\Application Data\Aim 2008-11-11 20:41 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com 2008-11-05 22:26 --------- d-----w c:\program files\DivX 2008-11-04 01:35 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-11-02 15:58 17,630 ----a-w c:\program files\Common Files\fukok._sy 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-12 18:31 --------- d-----w c:\program files\Veoh Networks 2008-07-05 01:14 52,288 ----a-w c:\documents and settings\Konraddsa\Application Data\GDIPFONTCACHEV1.DAT 2008-04-08 13:15 32 ----a-r c:\documents and settings\All Users\hash.dat . ((((((((((((((((((((((((((((( snapshot@2008-11-17_22.46.37.48 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-10 01:10:56 1,379,840 ----a-w c:\windows\$hf_mig$\KB954459\SP3QFE\msxml6.dll + 2007-11-30 12:39:22 17,272 ----a-w c:\windows\$hf_mig$\KB954459\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w c:\windows\$hf_mig$\KB954459\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w c:\windows\$hf_mig$\KB954459\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w c:\windows\$hf_mig$\KB954459\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w c:\windows\$hf_mig$\KB954459\update\updspapi.dll - 2008-11-16 20:01:29 2,072 ----a-w c:\windows\Downloaded Program Files\vscanmsx.dat + 2008-11-18 01  47 2,072 ----a-w c:\windows\Downloaded Program Files\vscanmsx.dat+ 2008-10-24 11:21:09 455,296 ------w c:\windows\Driver Cache\i386\mrxsmb.sys - 2008-03-03 22:15:10 29,926 ----a-r c:\windows\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe + 2008-11-24 19:16:54 29,926 ----a-r c:\windows\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe + 2008-11-23 12:43:43 32,768 ----a-r c:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe - 2008-11-15 00:13:16 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-11-23 09:45:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-11-15 00:13:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-23 09:45:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-11-15 00:13:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-11-23 09:45:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat - 2008-04-14 00:12:01 1,306,624 ------w c:\windows\system32\dllcache\msxml6.dll + 2008-09-10 01:14:56 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll + 2007-07-27 15:49:02 196,683 ----a-w c:\windows\system32\lnod32apiA.dll + 2007-07-27 15:49:02 225,355 ----a-w c:\windows\system32\lnod32apiW.dll + 2005-12-05 20:25:22 139,264 ----a-w c:\windows\system32\lnod32umc.dll + 2005-12-05 13:37:10 106,496 ----a-w c:\windows\system32\lnod32upd.dll - 2007-05-08 19:03:04 1,275,392 ----a-w c:\windows\system32\msxml4.dll + 2008-09-30 16:43:34 1,286,152 ----a-w c:\windows\system32\msxml4.dll - 2008-04-14 00:12:01 1,306,624 ----a-w c:\windows\system32\msxml6.dll + 2008-09-10 01:14:56 1,307,648 ----a-w c:\windows\system32\msxml6.dll + 2007-08-02 18:11:28 253,952 ----a-w c:\windows\system32\OnlineScannerDLLA.dll + 2007-08-02 18:11:14 241,664 ----a-w c:\windows\system32\OnlineScannerDLLW.dll + 2007-08-06 13:17:40 19,456 ----a-w c:\windows\system32\OnlineScannerLang.dll + 2007-06-13 11:10:34 77,824 ----a-w c:\windows\system32\OnlineScannerUninstaller.exe - 2007-11-30 11:18:51 17,272 ----a-w c:\windows\system32\spmsg.dll + 2008-07-08 13:02:01 17,272 ------w c:\windows\system32\spmsg.dll + 2004-12-07 11:11:34 258,352 ----a-w c:\windows\system32\unicows.dll + 2008-09-30 16:42:08 1,286,152 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll + 2008-09-30 16:45:12 91,656 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 339968] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016] "wosefekumo"="c:\windows\system32\sabelowo.dll" [BU] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2008-02-08 227856] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\Dell\Bluetooth Software\BTTray.exe [2004-04-09 561213] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-07-16 24576] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^24Online Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\24Online Client.lnk backup=c:\windows\pss\24Online Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 Detect.lnk backup=c:\windows\pss\PCSuiteForNokia6600 Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 TS.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 TS.lnk backup=c:\windows\pss\PCSuiteForNokia6600 TS.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-07 04:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2005-01-31 21:35 155648 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-02-23 21:19 53248 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-07-27 21:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-07-27 21:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-03-14 23:05 257088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-14 13:50 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Tray Application] --a------ 2003-02-10 18:30 425984 c:\program files\Common Files\Nokia\NCLTools\NclTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-02-16 14:54 282624 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2003-11-19 22:48 32881 c:\program files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZingSpooler] --a------ 2004-08-05 19:38 188416 c:\program files\Common Files\Zing\ZingSpooler.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "c:\\Program Files\\GameHouse\\TextTwist\\TextTwist.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= "c:\\Program Files\\BitTornado\\btdownloadgui.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= "c:\\WINDOWS\\system32\\taskmgr.exe"= "c:\\WINDOWS\\system32\\cmd.exe"= "c:\\kav\\kav7\\setup.exe"= "c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R0 ENO;ENO;c:\windows\system32\drivers\ENO.sys [2003-10-22 40356] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592] . - - - - ORPHANS REMOVED - - - - BHO-{b4a66ac1-7c50-46a7-913a-51b86a22ddfb} - c:\windows\system32\zasulege.dll . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Konraddsa\Application Data\Mozilla\Firefox\Profiles\z8hikuzh.Default User\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-24 19:38:49 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1732) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\WgaLogon.dll c:\program files\Intel\Wireless\Bin\LgNotify.dll - - - - - - - > 'lsass.exe'(1788) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\windows\system32\scardsvr.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\windows\system32\ati2evxx.exe c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\program files\Dell\Bluetooth Software\bin\btwdins.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\wscntfy.exe c:\progra~1\Dell\BLUETO~1\BTSTAC~1.EXE c:\program files\HP\Digital Imaging\bin\hpqste08.exe . ************************************************************************** . Completion time: 2008-11-24 19:47:24 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-24 19:47:10 ComboFix2.txt 2008-11-23 13:00:46 ComboFix3.txt 2008-11-17 22:49:04 Pre-Run: 17,837,260,800 bytes free Post-Run: 17,830,744,064 bytes free 306 --- E O F --- 2008-11-23 13:00:59 |
|
|
|
|
11-24-2008, 01:33 PM
|
#6 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
11-24-2008, 02:24 PM
|
#8 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Thanks for uploading the file.
Please also post the new ComboFix log, C:\ComboFix.txt if it's been closed.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-24-2008, 02:27 PM
|
#9 (permalink) |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Re: Antivirus 2009 and a lot of Trojan
Please find the needed
ComboFix 08-11-23.02 - Konraddsa 2008-11-24 20:54:41.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.170 [GMT 0:00] Running from: c:\documents and settings\Konraddsa\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Konraddsa\Desktop\CFScript.txt * Created a new restore point FILE :: c:\documents and settings\All Users\Application Data\juguw.dat c:\documents and settings\All Users\Application Data\kowoxar.sys c:\documents and settings\Konraddsa\Application Data\samob.com c:\documents and settings\Konraddsa\Application Data\utyxaj.dat c:\program files\Common Files\fukok._sy c:\program files\Common Files\hotow.bat c:\windows\akajury.inf c:\windows\alysyfi.bat c:\windows\exylop.scr c:\windows\jeharaxu.com c:\windows\kiqemyc.dat c:\windows\system32\aroleni.inf c:\windows\yvonebesas.dl . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\juguw.dat c:\documents and settings\All Users\Application Data\kowoxar.sys c:\documents and settings\Konraddsa\Application Data\samob.com c:\documents and settings\Konraddsa\Application Data\utyxaj.dat c:\program files\Common Files\fukok._sy c:\program files\Common Files\hotow.bat c:\windows\akajury.inf c:\windows\alysyfi.bat c:\windows\exylop.scr c:\windows\jeharaxu.com c:\windows\kiqemyc.dat c:\windows\system32\aroleni.inf c:\windows\system32\B603tbw6.exe c:\windows\system32\fetabeke.exe c:\windows\system32\gofoloju.dll c:\windows\system32\mojeboto.dll c:\windows\system32\nivifutu.dll c:\windows\yvonebesas.dl . ((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 ))))))))))))))))))))))))))))))) . 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2008-11-23 21:46 . 2008-11-23 21:46 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2008-11-18 20:48 . 2008-11-18 20:48 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-18 20:48 . 2008-10-22 16:27 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-18 20:48 . 2008-10-22 16:27 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-11-18 00:21 . 2008-11-18 00:24 <DIR> d-------- c:\program files\EsetOnlineScanner 2008-11-17 22:52 . 2008-11-18 00:53 <DIR> d-------- C:\Lop SD 2008-11-17 22:44 . 2008-10-24 11:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-17 22:43 . 2008-09-04 17:15 1,106,944 --a------ c:\windows\system32\SETE.tmp 2008-11-17 22:43 . 2008-09-04 17:15 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll 2008-11-17 21:22 . 2008-11-17 21:33 250 --a------ c:\windows\gmer.ini 2008-11-14 04:01 . 2008-11-14 04:01 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-14 03:49 . 2008-11-14 03:52 2,392 --a------ c:\windows\system32\tmp.reg 2008-11-12 21:33 . 2008-11-12 21:33 1,152 --a------ c:\windows\system32\windrv.sys 2008-11-12 21:28 . 2008-11-12 21:28 <DIR> d-------- c:\program files\Common Files\Download Manager 2008-11-12 20:57 . 2008-11-12 20:57 <DIR> d-------- c:\windows\system32\LogFiles 2008-11-12 19:37 . 2008-11-12 19:41 <DIR> d-------- C:\Priya 2008-11-12 18:29 . 2008-11-12 20:53 96,976 --a------ c:\windows\system32\drivers\klin.dat 2008-11-12 18:29 . 2008-11-12 20:53 87,855 --a------ c:\windows\system32\drivers\klick.dat 2008-11-12 18:27 . 2008-11-12 18:27 <DIR> d-------- c:\program files\Kaspersky Lab 2008-11-12 18:27 . 2008-11-24 19:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab 2008-11-12 18:27 . 2008-11-24 21:00 5,696,800 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-11-12 18:27 . 2008-11-24 20:59 84,512 --ahs---- c:\windows\system32\drivers\fidbox2.dat 2008-11-12 18:27 . 2008-11-24 19:37 75,836 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-11-12 18:27 . 2008-11-24 19:37 8,540 --ahs---- c:\windows\system32\drivers\fidbox2.idx 2008-11-12 18:21 . 2008-11-12 18:21 <DIR> d-------- C:\kav 2008-11-12 16:54 . 2008-11-12 16:54 1,540,096 --a------ c:\windows\system32\apoyapon.tmp 2008-11-11 21:08 . 2008-11-11 21:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 2008-11-09 22:39 . 2008-11-09 22:39 <DIR> d-------- c:\documents and settings\Konraddsa\Application Data\Malwarebytes 2008-11-08 23:08 . 2008-04-14 01:12 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-11-08 23:08 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-11-08 00:23 . 2008-11-12 21:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-11-05 01:01 . 2008-11-05 22:04 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP 2008-11-05 00:24 . 2008-11-23 21:46 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2008-11-02 19:22 . 2008-11-02 19:22 <DIR> d---s---- c:\documents and settings\Administrator\UserData 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-02 17:59 . 2008-11-02 17:59 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes 2008-11-02 17:57 . 2008-11-02 17:57 52,288 --a------ c:\documents and settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-23 22:56 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-11-23 13:04 --------- d-----w c:\program files\Spybot - Search & Destroy 2008-11-12 20:56 112,144 ----a-w c:\windows\system32\drivers\kl1.sys 2008-11-11 21:09 --------- d-----w c:\program files\AIM 2008-11-11 21:09 --------- d-----w c:\documents and settings\Konraddsa\Application Data\Aim 2008-11-11 20:41 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee.com 2008-11-05 22:26 --------- d-----w c:\program files\DivX 2008-11-04 01:35 --------- d-----w c:\documents and settings\All Users\Application Data\HP 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-15 16:34 337,408 ------w c:\windows\system32\dllcache\netapi32.dll 2008-10-12 18:31 --------- d-----w c:\program files\Veoh Networks 2008-09-30 16:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-15 12:12 1,846,400 ------w c:\windows\system32\dllcache\win32k.sys 2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-10 01:14 1,307,648 ------w c:\windows\system32\dllcache\msxml6.dll 2008-09-08 10:41 333,824 ------w c:\windows\system32\dllcache\srv.sys 2008-07-05 01:14 52,288 ----a-w c:\documents and settings\Konraddsa\Application Data\GDIPFONTCACHEV1.DAT 2008-04-08 13:15 32 ----a-r c:\documents and settings\All Users\hash.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 339968] "DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 86016] c:\documents and settings\All Users\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\Dell\Bluetooth Software\BTTray.exe [2004-04-09 561213] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-07-16 24576] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 21:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^24Online Client.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\24Online Client.lnk backup=c:\windows\pss\24Online Client.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 Detect.lnk backup=c:\windows\pss\PCSuiteForNokia6600 Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PCSuiteForNokia6600 TS.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PCSuiteForNokia6600 TS.lnk backup=c:\windows\pss\PCSuiteForNokia6600 TS.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-07 04:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint] --a------ 2005-01-31 21:35 155648 c:\program files\Apoint\Apoint.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-02-23 21:19 53248 c:\program files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2004-07-27 21:50 221184 c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2004-07-27 21:50 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-03-14 23:05 257088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-14 13:50 53248 c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia Tray Application] --a------ 2003-02-10 18:30 425984 c:\program files\Common Files\Nokia\NCLTools\NclTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-02-16 14:54 282624 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2003-11-19 22:48 32881 c:\program files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZingSpooler] --a------ 2004-08-05 19:38 188416 c:\program files\Common Files\Zing\ZingSpooler.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Intuwave\\Shared\\mRouterRunTime\\mRouterRuntime.exe"= "c:\\Program Files\\GameHouse\\TextTwist\\TextTwist.exe"= "c:\\WINDOWS\\system32\\rtcshare.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"= "c:\\Program Files\\BitTornado\\btdownloadgui.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= "c:\\WINDOWS\\system32\\taskmgr.exe"= "c:\\WINDOWS\\system32\\cmd.exe"= "c:\\kav\\kav7\\setup.exe"= "c:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 7.0\\avp.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R0 ENO;ENO;c:\windows\system32\drivers\ENO.sys [2003-10-22 40356] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-24 20:59:47 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1732) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\windows\system32\Ati2evxx.dll c:\windows\system32\WgaLogon.dll c:\program files\Intel\Wireless\Bin\LgNotify.dll - - - - - - - > 'lsass.exe'(1788) c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\dnsq.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\miscr3.dll c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\fssync.dll . Completion time: 2008-11-24 21:02:21 ComboFix-quarantined-files.txt 2008-11-24 21:01:56 ComboFix2.txt 2008-11-24 19:47:38 ComboFix3.txt 2008-11-23 13:00:46 ComboFix4.txt 2008-11-17 22:49:04 Pre-Run: 17,772,158,976 bytes free Post-Run: 17,793,855,488 bytes free 239 --- E O F --- 2008-11-23 13:00:59 Thanks Konrad |
|
|
|
|
11-24-2008, 02:38 PM
|
#10 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Hi Konrad -
Before we continue...are the popups for AntiVirus 2009 gone now?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-24-2008, 02:41 PM
|
#11 (permalink) | |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Re: Antivirus 2009 and a lot of Trojan
Quote:
The popups have stopped. Thanks Konrad |
|
|
|
|
|
11-24-2008, 03:14 PM
|
#12 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Ok, great. Still a bit of work to do, but now we're taking care of outdated and exploitable applications, and looking for remnants.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
--------------------------------------------------------------------------------------------- Spybot Search & Destroy is outdated: Spybot - Search & Destroy 1.4 latest version is 1.6 Available from the author's site: http://www.safer-networking.org/en/download/ Go here to run an online scannner from ESET.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-24-2008, 03:38 PM
|
#14 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Erm...post #12.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-24-2008, 05:53 PM
|
#15 (permalink) | |
|
Registered User
Join Date: Nov 2008
Posts: 10
OS: Win XP
|
Re: Antivirus 2009 and a lot of Trojan
Quote:
# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3637 (20081124) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=448a9809f5180d4b9358afe908eed3bc # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2008-11-25 12:37:07 # local_time=2008-11-25 12:37:07 (+0000, GMT Standard Time) # country="United States" # osver=5.1.2600 NT Service Pack 3 # scanned=464175 # found=8 # scan_time=4502 C:\Qoobox\Quarantine\[4]-Submit_2008-11-24@20.54.zip probably a variant of Win32/TrojanDownloader.Firu trojan CC8D5D57A604F466F1A6D827F7867473 C:\Qoobox\Quarantine\[4]-Submit_2008-11-24@20.54.zip »ZIP »B603tbw6.exe probably a variant of Win32/TrojanDownloader.Firu trojan 00000000000000000000000000000000 C:\Qoobox\Quarantine\C\WINDOWS\system32\bovenage.dll.vir Win32/Adware.Virtumonde application 0CDC1EC1255EC5500A8F1F56B64AF702 C:\Qoobox\Quarantine\C\WINDOWS\system32\delutaha.dll.vir Win32/Adware.Virtumonde application EA3F16042820A5903D972B5020415AA7 C:\Qoobox\Quarantine\C\WINDOWS\system32\kenayiba.dll.vir Win32/Adware.Virtumonde application 1B60842D47419D5463DD8E84E1A81711 C:\Qoobox\Quarantine\C\WINDOWS\system32\nowuposi.dll.vir Win32/Adware.Virtumonde application 6D914C9AB4E895F318824F6211288DE4 C:\Qoobox\Quarantine\C\WINDOWS\system32\povorika.dll.vir Win32/Adware.Virtumonde application 5BD50DE2A50DC7CC58285CD1AF06F504 C:\Qoobox\Quarantine\C\WINDOWS\system32\vivodiha.dll.vir Win32/Adware.Virtumonde application 69EEC699CDB354200DB8A4979F4F1767 Thanks konrad |
|
|
|
|
|
11-24-2008, 06:16 PM
|
#16 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
Good news!
Only items in ComboFix quarantine were found. They shall be removed by uninstalling ComboFix as instructed below. Other than that, your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
11-26-2008, 02:38 PM
|
#18 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,770
OS: 2000 Pro; XP Pro; XP Home
|
Re: Antivirus 2009 and a lot of Trojan
You're welcome, Konrad. Glad to have helped.
Surf Safely, and Think Prevention! Since this issue is resolved, this topic will be archived.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
