|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-05-2008, 02:52 AM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 5
OS: Windows XP
|
Need help removing Sinowal.Trojan
Hello,
I believe that I may have been infected by the Sinowal.Trojan virus. I have experienced symptoms like others with the firewall pop-up messages and Firefox not starting on my home page. I have downloaded and ran the programs as described on your forum. They are attached. Please help me any way you can to get rid of this nasty virus. Thank you, DLEEUS DDS (Version 1.0) - NTFSx86 Run by Owner at 1:39:18.43 on Fri 12/05/2008 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.959.461 [GMT -8:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\HP Web Jetadmin\hpwebjetd.exe C:\MSSQL7\binn\sqlservr.exe C:\Program Files\NDAS\System\ndassvc.exe C:\WINDOWS\System32\HPZipm12.exe C:\Program Files\Symantec AntiVirus\SavRoam.exe C:\Program Files\HP Web Jetadmin\hpwebjetd.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\TortoiseSVN\bin\TSVNCache.exe C:\windows\system\hpsysdrv.exe C:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\hphmon05.exe C:\WINDOWS\system32\VTTimer.exe C:\WINDOWS\LTMSG.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Iomega\AutoDisk\ADUserMon.exe C:\Program Files\Iomega\DriveIcons\ImgIcon.exe C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\Common Files\InterVideo\SchSvr\SchSvr.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\HP\KBD\KBD.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe "C:\WINDOWS\system32\drivers\svchost.exe" C:\Documents and Settings\Owner\Application Data\Google\xtgoj6119471.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray\sgtray.exe C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe C:\Documents and Settings\Owner\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uDefault_Page_URL = hxxp://qus10.hpwis.com/ uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/ uSearch Bar = hxxp://www.google.com/ie mSearch Bar = hxxp://srch-qus10.hpwis.com/ uInternet Settings,ProxyOverride = localhost;*.local BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll BHO: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll BHO: {C56CB6B0-0D96-11D6-8C65-B2868B609932} - c:\program files\xi\nettransport 2\NTIEHelper.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [RecordNow!] uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [SVCHOST.EXE] c:\windows\system32\drivers\svchost.exe uRun: [vxdhm] "c:\documents and settings\owner\application data\google\xtgoj6119471.exe" mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [CamMonitor] c:\program files\hp\digital imaging\unload\hpqcmon.exe mRun: [HPHUPD05] c:\program files\hp\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe mRun: [HPHmon05] c:\windows\system32\hphmon05.exe mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [VTTimer] VTTimer.exe mRun: [LTMSG] LTMSG.exe 7 mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe" mRun: [RoxioEngineUtility] "c:\program files\common files\roxio shared\system\EngUtil.exe" mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [vptray] c:\progra~1\symant~1\VPTray.exe mRun: [ADUserMon] c:\program files\iomega\autodisk\ADUserMon.exe mRun: [Iomega Drive Icons] c:\program files\iomega\driveicons\ImgIcon.exe mRun: [Deskup] c:\program files\iomega\driveicons\deskup.exe /IMGSTART mRun: [DAEMON Tools-1033] "c:\program files\d-tools\daemon.exe" -lang 1033 mRun: [RoxioDragToDisc] "c:\program files\roxio\easy cd creator 6\dragtodisc\DrgToDsc.exe" mRun: [RoxioAudioCentral] "c:\program files\roxio\easy cd creator 6\audiocentral\RxMon.exe" mRun: [NeroCheck] c:\windows\system32\NeroCheck.exe mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [Home Theater SchSvr] "c:\program files\common files\intervideo\schsvr\SchSvr.exe" mRun: [WINCINEMAMGR] "c:\program files\intervideo\common\bin\WinCinemaMgr.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe" mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe" mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" StartupFolder: c:\docume~1\owner\startm~1\programs\startup\spamsu~1.lnk - c:\program files\intermute\spamsubtract\SpamSub.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\1940576\program\BackWeb-1940576.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ndasde~1.lnk - c:\program files\ndas\system\ndasmgmt.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quicke~1.lnk - c:\program files\quicken\bagent.exe uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0) uPolicies-explorer: Btn_Search = 0 (0x0) IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm IE: Download all by Net Transport - c:\program files\xi\nettransport 2\NTAddList.html IE: Download by Net Transport - c:\program files\xi\nettransport 2\NTAddLink.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: SpSubLSP.dll Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: igfxcui - igfxsrvc.dll Notify: NavLogon - c:\windows\system32\NavLogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R0 lfsfilt;Lean File Sharing;c:\windows\system32\drivers\lfsfilt.sys [2007-2-4 140160] R0 lpx;LPX Protocol;c:\windows\system32\drivers\lpx.sys [2006-3-20 44288] R1 SAVRT;SAVRT;\??\c:\program files\symantec antivirus\savrt.sys [2004-2-9 301200] R2 BT848;AVerDVD EZMaker WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2004-8-30 261696] R2 BTXBAR;AVerDVD EZMaker WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [2004-8-30 13312] R2 ccEvtMgr;Symantec Event Manager;"c:\program files\common files\symantec shared\ccEvtMgr.exe" [2004-2-29 255096] R2 ccSetMgr;Symantec Settings Manager;"c:\program files\common files\symantec shared\ccSetMgr.exe" [2004-2-29 242808] R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\drivers\DLPortIO.sys [2005-5-27 3584] R2 HPWebJetadmin;HP Web Jetadmin;"c:\program files\hp web jetadmin\hpwebjetd.exe" -k runservice [2004-4-15 13312] R2 SavRoam;SAVRoam;"c:\program files\symantec antivirus\SavRoam.exe" [2004-3-12 169192] R2 SAVRTPEL;SAVRTPEL;\??\c:\program files\symantec antivirus\Savrtpel.sys [2004-2-9 37008] R2 Symantec AntiVirus;Symantec AntiVirus;"c:\program files\symantec antivirus\Rtvscan.exe" [2004-3-12 1221864] R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\drivers\Cap713x.sys [2005-5-26 271104] R3 NAVENG;NAVENG;\??\c:\progra~1\common~1\symant~1\virusd~1\20081203.004\naveng.sys [2008-12-4 89104] R3 NAVEX15;NAVEX15;\??\c:\progra~1\common~1\symant~1\virusd~1\20081203.004\navex15.sys [2008-12-4 876112] R3 ndasbus;NDAS Bus Driver;c:\windows\system32\drivers\ndasbus.sys [2006-3-20 59136] S2 IcRecUsb;IC Recorder Driver;c:\windows\system32\drivers\IcRecUsb.sys [2008-10-19 17432] S2 mrtRate;mrtRate; [] S2 RadPciNT;RadPciNT;\??\c:\windows\system32\drivers\RadPciNT.sys [2000-4-24 9417] S3 CCCP106;D-Link CIF Webcam;c:\windows\system32\drivers\cccp106.sys [2004-12-2 227200] S3 ccPwdSvc;Symantec Password Validation;"c:\program files\common files\symantec shared\ccPwdSvc.exe" [2004-2-29 87160] S3 MTK;Media Technology Kernel Driver;c:\windows\system32\drivers\fide.sys [2004-9-24 14601] S3 ndasscsi;NDAS SCSI Miniport Driver;c:\windows\system32\drivers\ndasscsi.sys [2006-3-20 115584] S3 XIRLINK;VivaPix WebCam;c:\windows\system32\drivers\ucdnt.sys [2004-5-27 1001404] =============== Created Last 30 ================ 2008-12-05 01:16 250 a------- c:\windows\gmer.ini 2008-12-04 00:57 2,274 a------- c:\windows\system32\TDSScrhiyxrn.dll 2008-12-04 00:57 73,728 a------- c:\windows\system32\TDSScoyidoex.dll 2008-12-04 00:57 31,232 a------- c:\windows\system32\TDSSbndpulhh.dll 2008-12-04 00:57 29,696 a------- c:\windows\system32\TDSStpklyabp.dll 2008-12-04 00:57 527 a------- c:\windows\system32\TDSSbebpthgu.dat 2008-12-04 00:57 35,840 a------- c:\windows\system32\TDSSvmaybpjn.dll 2008-12-04 00:55 42,496 a------- c:\windows\system32\drivers\svchost.exe 2008-12-04 00:12 <DIR> --d----- c:\program files\HandBrake 2008-11-30 13:54 <DIR> --d----- c:\program files\iTunes 2008-11-30 13:54 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-11 18:59 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys 2008-11-11 18:59 1,106,944 -c------ c:\windows\system32\dllcache\msxml3.dll ==================== Find3M ==================== 2008-12-05 01:10 <DIR> --d----- c:\program files\Symantec AntiVirus 2008-12-02 22:33 <DIR> --d----- c:\docume~1\owner\applic~1\TeraCopy 2008-11-30 21:10 <DIR> --d----- c:\docume~1\owner\applic~1\LimeWire 2008-11-30 13:54 <DIR> --d----- c:\program files\iPod 2008-11-20 21:08 <DIR> --d----- c:\program files\LimeWire 2008-10-23 22:20 <DIR> --d----- c:\program files\Advanced IP Scanner 2008-10-17 18:40 <DIR> --d----- c:\program files\SiSoftware 2008-10-01 19:55 <DIR> --d----- c:\docume~1\owner\applic~1\DVDFab 2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll 2008-09-19 22:14 80,795 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat 2008-09-15 04:12 1,846,400 a------- c:\windows\system32\win32k.sys 2008-09-09 17:14 1,307,648 -------- c:\windows\system32\msxml6.dll 2008-07-02 20:52 <DIR> --d----- c:\docume~1\owner\applic~1\GARMIN 2008-03-28 13:15 <DIR> --d----- c:\docume~1\owner\applic~1\Intuit 2007-12-27 15:50 <DIR> --d----- c:\docume~1\owner\applic~1\FlashFXP 2007-12-27 13:55 <DIR> --d----- c:\docume~1\owner\applic~1\Subversion 2006-11-08 23:17 <DIR> --d----- c:\docume~1\owner\applic~1\Good Keywords v2 2006-04-05 15:03 <DIR> --d----- c:\docume~1\owner\applic~1\STOIK 2006-03-12 21:16 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint 2005-05-26 20:37 <DIR> --d----- c:\docume~1\alluse~1\applic~1\InterVideo 2005-04-02 16:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Intuit 2004-09-29 21:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Symantec 2004-08-30 21:25 <DIR> --d----- c:\docume~1\owner\applic~1\Broderbund 2004-08-30 21:05 <DIR> --d----- c:\docume~1\alluse~1\applic~1\broderbund 2004-08-05 20:07 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBT 2004-06-02 20:57 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy 2003-10-14 05:31 <DIR> --d----- c:\docume~1\owner\applic~1\Symantec 2003-10-11 02:19 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SBSI ============= FINISH: 1:39:31.96 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
12-06-2008, 03:10 PM
|
#2 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing Sinowal.Trojan
Hi, welcome to TSF!
Did you follow any advice, run any tools, or fixed anything on your own before you posted here? Please visit this webpage for download links, and instructions for running combofix: http://www.bleepingcomputer.com/comb...o-use-combofix Note: Please rename combofix.exe to cfix.exe * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Please include the C:\ComboFix.txt in your next reply for further review.
__________________
UNITE and ASAP since 2006  If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. |
|
|
|
|
12-08-2008, 11:37 AM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 5
OS: Windows XP
|
Re: Need help removing Sinowal.Trojan
Thank you for the quick response. The only other thing I ran was the Norton Antivirus. I did a liveupdate and full scan. The scan returned a virus alert for xmltok.dll file which it "left alone". It identified it as an Trackware.SAHAgent virus. Since it did not remove the virus, I followed Symantec's instructions on manually removing it. However, I could not find any of the keys in the registry editor. I then renamed te xmltok.dll file to another name hoping that the virus would not execute it. But now I am getting an error with Quicken not finding being able to execute bagent.exe. From Google, I found that bagent.exe need the xmltok.dll file. I have not yet renamed it back, hoping to clean the viruses first. I then noticed the Sinowal popup and disabling my firewall.
As requested, included is the Combofix log. Thank you, DLEEUS ComboFix 08-12-07.01 - Owner 2008-12-08 10  30.1 - NTFSx86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.479 [GMT -8:00] Running from: c:\documents and settings\Owner\Desktop\CFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Owner\Application Data\inst.exe c:\windows\system32\drivers\svchost.exe c:\windows\system32\iAlmcoin.dll c:\windows\system32\TDSSbebpthgu.dat c:\windows\system32\TDSSbndpulhh.dll c:\windows\system32\TDSScoyidoex.dll c:\windows\system32\TDSScrhiyxrn.dll c:\windows\system32\TDSSeoruefkt.log c:\windows\system32\TDSStpklyabp.dll c:\windows\system32\TDSSvmaybpjn.dll D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_TDSSSERV.SYS -------\Service_TDSSserv.sys ((((((((((((((((((((((((( Files Created from 2008-11-08 to 2008-12-08 ))))))))))))))))))))))))))))))) . 2008-12-05 01:16 . 2008-12-05 01:16 250 --a------ c:\windows\gmer.ini 2008-12-04 00:12 . 2008-12-04 00:12 <DIR> d-------- c:\program files\HandBrake 2008-11-30 13:54 . 2008-11-30 13:54 <DIR> d-------- c:\program files\iTunes 2008-11-30 13:54 . 2008-11-30 13:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-30 13:51 . 2008-11-30 13:52 <DIR> d-------- c:\program files\QuickTime 2008-11-11 18:59 . 2008-09-04 09:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-11 18:59 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-08 18:14 --------- d-----w c:\program files\Symantec AntiVirus 2008-12-04 09:01 --------- d-----w c:\documents and settings\Owner\Application Data\Active Disk 2008-12-04 05:41 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2008-12-03 06:33 --------- d-----w c:\documents and settings\Owner\Application Data\TeraCopy 2008-12-01 05:10 --------- d-----w c:\documents and settings\Owner\Application Data\LimeWire 2008-11-30 21:54 --------- d-----w c:\program files\iPod 2008-11-30 21:54 --------- d-----w c:\program files\Common Files\Apple 2008-11-21 05:08 --------- d-----w c:\program files\LimeWire 2008-11-07 22:23 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-24 06:20 --------- d-----w c:\program files\Advanced IP Scanner 2008-10-19 20:46 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-19 20:46 --------- d-----w c:\program files\Panasonic 2008-10-18 02:40 --------- d-----w c:\program files\SiSoftware 2008-08-25 06:58 47,360 ----a-w c:\documents and settings\Owner\Application Data\pcouffin.sys 2007-05-30 05:44 87,608 ----a-w c:\documents and settings\Owner\Application Data\ezpinst.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856] "vxdhm"="c:\documents and settings\Owner\Application Data\Google\xtgoj6119471.exe" [2008-12-04 124416] "NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688] "CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112] "HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-03 45056] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664] "RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 65536] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128] "ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456] "Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 86016] "Deskup"="c:\program files\Iomega\DriveIcons\deskup.exe" [2002-07-16 32768] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2004-10-12 868352] "RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-06-23 319488] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 53248] "Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-04-14 155648] "WINCINEMAMGR"="c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe" [2004-04-14 192512] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-28 32768] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "VTTimer"="VTTimer.exe" [2004-10-22 c:\windows\system32\VTTimer.exe] "LTMSG"="LTMSG.exe" [2003-07-14 c:\windows\ltmsg.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE] c:\documents and settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] Compaq Connections.lnk - c:\program files\Compaq Connections\1940576\Program\BackWeb-1940576.exe [2003-10-11 16384] NDAS Device Management.lnk - c:\program files\NDAS\System\ndasmgmt.exe [2006-03-20 220160] Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-07-30 45056] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 0 (0x0) "Btn_Search"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\Y!Multi Messenger.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Real\\RealOne Player\\realplay.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Hewlett-Packard\\HP Virtual Rooms\\HPVirtualRooms.exe"= "c:\\Program Files\\FlashFXP\\FlashFXP.exe"= "c:\\Program Files\\Dorgem\\Dorgem.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 lfsfilt;Lean File Sharing;c:\windows\system32\DRIVERS\lfsfilt.sys [2007-02-04 140160] R0 lpx;LPX Protocol;c:\windows\system32\DRIVERS\lpx.sys [2006-03-20 44288] R2 BT848;AVerDVD EZMaker WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2004-08-30 261696] R2 BTXBAR;AVerDVD EZMaker WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [2004-08-30 13312] R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\DRIVERS\DLPortIO.sys [2005-05-27 3584] R2 HPWebJetadmin;HP Web Jetadmin;"c:\program files\HP Web Jetadmin\hpwebjetd.exe" -k runservice [2004-04-15 13312] R2 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2004-03-12 169192] R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\DRIVERS\Cap713x.sys [2005-05-26 271104] R3 ndasbus;NDAS Bus Driver;c:\windows\system32\DRIVERS\ndasbus.sys [2006-03-20 59136] S2 IcRecUsb;IC Recorder Driver;c:\windows\system32\Drivers\IcRecUsb.sys [2008-10-19 17432] S2 mrtRate;mrtRate; [] S2 RadPciNT;RadPciNT;\??\c:\windows\system32\Drivers\RadPciNT.sys [2000-04-24 9417] S3 CCCP106;D-Link CIF Webcam;c:\windows\system32\DRIVERS\cccp106.sys [2004-12-02 227200] S3 MTK;Media Technology Kernel Driver;c:\windows\system32\Drivers\fide.sys [2004-09-24 14601] S3 ndasscsi;NDAS SCSI Miniport Driver;c:\windows\system32\DRIVERS\ndasscsi.sys [2006-03-20 115584] S3 XIRLINK;VivaPix WebCam;c:\windows\system32\DRIVERS\ucdnt.sys [2004-05-27 1001404] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1389622b-c1c7-11dd-a911-000ea697b4d8}] \Shell\AutoRun\command - I:\Launch.exe /run [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2d54da-195a-11dc-a729-000ea697b4d8}] \Shell\AutoRun\command - i:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e144f714-b543-11dd-a904-000ea697b4d8}] \Shell\AutoRun\command - j:\jdsecure\Windows\JDSecure31.exe . Contents of the 'Scheduled Tasks' folder 2008-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2004-09-30 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-01-02 13:20] . - - - - ORPHANS REMOVED - - - - HKCU-Run-RecordNow! - (no file) HKLM-Run-HPHUPD05 - c:\program files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/ mSearch Bar = hxxp://srch-qus10.hpwis.com/ uInternet Settings,ProxyOverride = localhost;*.local IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm LSP: SpSubLSP.dll FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3xs6e7bn.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ FF -: plugin - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3xs6e7bn.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-08 10:14:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2] "ImagePath"="\"\"" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(1004) c:\windows\system32\SpSubLSP.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Symantec Shared\ccSetMgr.exe c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Symantec AntiVirus\DefWatch.exe c:\progra~1\Iomega\System32\AppServices.exe c:\mssql7\Binn\sqlservr.exe c:\program files\NDAS\System\ndassvc.exe c:\windows\system32\hpzipm12.exe c:\program files\Symantec AntiVirus\Rtvscan.exe c:\windows\system32\MsPMSPSv.exe c:\program files\Iomega\AutoDisk\ADService.exe c:\program files\TortoiseSVN\bin\TSVNCache.exe c:\program files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-12-08 10:19:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-12-08 18:19:29 Pre-Run: 30,403,641,344 bytes free Post-Run: 30,451,634,176 bytes free 254 --- E O F --- 2008-11-13 08:30:29 |
|
|
|
|
12-09-2008, 12:46 AM
|
#4 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing Sinowal.Trojan
Hi,
Please don't do any fixing on your own. If you encounter something peculiar, let me know. This is because any extra fixing that you do can make things worst and we wouldn't want anything bad to happen now, do we? xmltok.dll seems to be an adware, you can delete it. As for quicken, please try reinstalling it. *I see you have P2P software ( LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall it, however that choice is up to you. If you choose to remove this program, you can do so via Control Panel >> add/remove programs If you decide to uninstall the p2p applications, also delete these Folders if they still exist: C:\Program Files\LimeWire c:\documents and settings\Owner\Application Data\LimeWire *I see you have Viewpoint installed... Viewpoint related software are considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546 I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.
also, please uninstall this program too: Media-Motor - http://www.ftc.gov/opa/2006/11/mediamotor.shtm *Open notepad. Copy and paste the text inside the code box below to notepad Code:
File:: c:\documents and settings\Owner\Application Data\Google\xtgoj6119471.exe Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "vxdhm"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AlcxMonitor"=- [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000000
*Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities. Updating Java:
*Next, it's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html 1. Click Accept, when prompted to download and install the program files and database of malware definitions. 2. To optimize scanning time and produce a more sensible report for review:
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
On your next reply, please include a
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 12-09-2008 at 12:48 AM. |
|
|
|
|
12-09-2008, 06:07 PM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 5
OS: Windows XP
|
Re: Need help removing Sinowal.Trojan
Hi,
I followed your instructions and removed the requested programs. I also copied the script and executed it as shown. However, when running the combofix, it seemed to run through the whole thing but hung up at the last step. It was displaying the creating the log text and something about not executing other programs until finished. It sat like that for about 8 hours, it appeared to be frozen. Also, there were no icons or toolbars being displayed on the desktop. I did a hard shutdown (power off) and rebooted. I then re-ran the combofix with the script again, but it did the same thing. I canceled it and just ran the combofix by itself without the script and it finished fine. Hope that is okay. I then finished the rest as requested. The Kaspersky scan took almost 7 hours to complete. Included is the Kaspersky log as well as the combofix log. Thanks, DLEEUS -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, December 9, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, December 09, 2008 12:41:29 Records in database: 1447097 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ K:\ Scan statistics: Files scanned: 173564 Threat name: 9 Infected objects: 13 Suspicious objects: 0 Duration of the scan: 06:47:19 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A2C0000.VBN Infected: Backdoor.Win32.TDSS.bkw 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A300000.VBN Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A500000.VBN Infected: Trojan.Win32.Agent.duy 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A500002.VBN Infected: Trojan.Win32.Agent.duy 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B7C0000.VBN Infected: Trojan-Downloader.WMA.GetCodec.c 1 C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C600000.VBN Infected: Worm.Win32.AutoRun.bmp 1 C:\Documents and Settings\Owner\My Documents\Aptiva Files\Backups\SAP Labs Backups\2001-05-25\Users 05-25-01.zip Infected: Virus.MSWord.Class.b 3 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\svchost.exe.vir Infected: Trojan-Downloader.Win32.Agent.aswm 1 K:\My Backups\Bond Backup\Program Files\Internet Explorer\PLUGINS\nponflow.dll Infected: not-a-virus:AdWare.Win32.OnFlow 1 K:\My Backups\Bond Backup\Program Files\onflow\uninstall onflow.exe Infected: not-a-virus:AdWare.Win32.OnFlow.d 1 K:\My Backups\Lisa's Backups\Operations1.zip Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1 The selected area was scanned. ComboFix 08-12-07.04 - Owner 2008-12-09 8:16:40.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.491 [GMT -8:00] Running from: c:\documents and settings\Owner\Desktop\CFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\documents and settings\Owner\Application Data\Google\xtgoj6119471.exe . ((((((((((((((((((((((((( Files Created from 2008-11-09 to 2008-12-09 ))))))))))))))))))))))))))))))) . 2008-12-09 08:16 . 2008-12-09 08:20 <DIR> d-------- C:\CFix 2008-12-09 00:29 . 2008-12-09 00:29 <DIR> d--hs---- C:\RECYCLER 2008-12-08 10:04 . 2008-12-09 00:34 <DIR> d-------- C:\Qoobox 2008-12-05 01:16 . 2008-12-05 01:16 250 --a------ c:\windows\gmer.ini 2008-12-04 00:12 . 2008-12-04 00:12 <DIR> d-------- c:\program files\HandBrake 2008-11-30 13:54 . 2008-11-30 13:54 <DIR> d-------- c:\program files\iTunes 2008-11-30 13:54 . 2008-11-30 13:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-30 13:51 . 2008-11-30 13:52 <DIR> d-------- c:\program files\QuickTime . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-09 16:16 --------- d-----w c:\program files\Symantec AntiVirus 2008-12-04 09:01 --------- d-----w c:\documents and settings\Owner\Application Data\Active Disk 2008-12-04 05:41 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2008-12-03 06:33 --------- d-----w c:\documents and settings\Owner\Application Data\TeraCopy 2008-11-30 21:54 --------- d-----w c:\program files\iPod 2008-11-30 21:54 --------- d-----w c:\program files\Common Files\Apple 2008-11-07 22:23 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-24 06:20 --------- d-----w c:\program files\Advanced IP Scanner 2008-10-19 20:46 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-19 20:46 --------- d-----w c:\program files\Panasonic 2008-10-18 02:40 --------- d-----w c:\program files\SiSoftware 2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-01 00:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll 2008-08-25 06:58 47,360 ----a-w c:\documents and settings\Owner\Application Data\pcouffin.sys 2007-05-30 05:44 87,608 ----a-w c:\documents and settings\Owner\Application Data\ezpinst.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN] @="{30351346-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN] @="{30351347-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN] @="{30351348-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN] @="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN] @="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN] @="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN] @="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}" [HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}] 2007-12-21 21:53 536576 --a------ c:\program files\TortoiseSVN\bin\tortoisesvn.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856] "NVIEW"="nview.dll" [2003-08-19 c:\windows\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688] "CamMonitor"="c:\program files\HP\Digital Imaging\Unload\hpqcmon.exe" [2002-10-07 90112] "HPHmon05"="c:\windows\System32\hphmon05.exe" [2003-05-23 483328] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-11-03 45056] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-13 212992] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2005-01-12 241664] "RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 65536] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680] "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-03-12 124128] "ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456] "Iomega Drive Icons"="c:\program files\Iomega\DriveIcons\ImgIcon.exe" [2002-08-13 86016] "Deskup"="c:\program files\Iomega\DriveIcons\deskup.exe" [2002-07-16 32768] "DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920] "RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2004-10-12 868352] "RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-06-23 319488] "NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 53248] "Home Theater SchSvr"="c:\program files\Common Files\InterVideo\SchSvr\SchSvr.exe" [2004-04-14 155648] "WINCINEMAMGR"="c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe" [2004-04-14 192512] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-06-28 32768] "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "VTTimer"="VTTimer.exe" [2004-10-22 c:\windows\system32\VTTimer.exe] "LTMSG"="LTMSG.exe" [2003-07-14 c:\windows\ltmsg.exe] c:\documents and settings\Owner\Start Menu\Programs\Startup\ spamsubtract.lnk - c:\program files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 557056] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] Compaq Connections.lnk - c:\program files\Compaq Connections\1940576\Program\BackWeb-1940576.exe [2003-10-11 16384] NDAS Device Management.lnk - c:\program files\NDAS\System\ndasmgmt.exe [2006-03-20 220160] Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-07-30 45056] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "SpecifyDefaultButtons"= 0 (0x0) "Btn_Search"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Compaq Connections\\1940576\\Program\\BackWeb-1940576.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"= "c:\\Program Files\\NetMeeting\\conf.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\Y!Multi Messenger.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\Real\\RealOne Player\\realplay.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Hewlett-Packard\\HP Virtual Rooms\\HPVirtualRooms.exe"= "c:\\Program Files\\FlashFXP\\FlashFXP.exe"= "c:\\Program Files\\Dorgem\\Dorgem.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 lfsfilt;Lean File Sharing;c:\windows\system32\DRIVERS\lfsfilt.sys [2007-02-04 140160] R0 lpx;LPX Protocol;c:\windows\system32\DRIVERS\lpx.sys [2006-03-20 44288] R2 BT848;AVerDVD EZMaker WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2004-08-30 261696] R2 BTXBAR;AVerDVD EZMaker WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [2004-08-30 13312] R2 DLPortIO;DriverLINX Port I/O Driver;c:\windows\system32\DRIVERS\DLPortIO.sys [2005-05-27 3584] R2 HPWebJetadmin;HP Web Jetadmin;"c:\program files\HP Web Jetadmin\hpwebjetd.exe" -k runservice [2004-04-15 13312] R2 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2004-03-12 169192] R3 Cap713x;Philips Cap713x Video Capture;c:\windows\system32\DRIVERS\Cap713x.sys [2005-05-26 271104] R3 ndasbus;NDAS Bus Driver;c:\windows\system32\DRIVERS\ndasbus.sys [2006-03-20 59136] S2 IcRecUsb;IC Recorder Driver;c:\windows\system32\Drivers\IcRecUsb.sys [2008-10-19 17432] S2 mrtRate;mrtRate; [] S2 RadPciNT;RadPciNT;\??\c:\windows\system32\Drivers\RadPciNT.sys [2000-04-24 9417] S3 CCCP106;D-Link CIF Webcam;c:\windows\system32\DRIVERS\cccp106.sys [2004-12-02 227200] S3 MTK;Media Technology Kernel Driver;c:\windows\system32\Drivers\fide.sys [2004-09-24 14601] S3 ndasscsi;NDAS SCSI Miniport Driver;c:\windows\system32\DRIVERS\ndasscsi.sys [2006-03-20 115584] S3 XIRLINK;VivaPix WebCam;c:\windows\system32\DRIVERS\ucdnt.sys [2004-05-27 1001404] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1389622b-c1c7-11dd-a911-000ea697b4d8}] \Shell\AutoRun\command - I:\Launch.exe /run [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b2d54da-195a-11dc-a729-000ea697b4d8}] \Shell\AutoRun\command - i:\wd_windows_tools\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e144f714-b543-11dd-a904-000ea697b4d8}] \Shell\AutoRun\command - j:\jdsecure\Windows\JDSecure31.exe . Contents of the 'Scheduled Tasks' folder 2008-12-08 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2004-09-30 c:\windows\Tasks\Symantec NetDetect.job - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-01-02 13:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://srch-qus10.hpwis.com/ mSearch Bar = hxxp://srch-qus10.hpwis.com/ uInternet Settings,ProxyOverride = localhost;*.local IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm IE: Download all by Net Transport - c:\program files\Xi\NetTransport 2\NTAddList.html IE: Download by Net Transport - c:\program files\Xi\NetTransport 2\NTAddLink.html IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm LSP: SpSubLSP.dll FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3xs6e7bn.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/ FF -: plugin - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3xs6e7bn.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npsnapfish.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF -: plugin - c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-09 08:20:33 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Iomega Activity Disk2] "ImagePath"="\"\"" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'lsass.exe'(996) c:\windows\system32\SpSubLSP.dll . Completion time: 2008-12-09 8:22:27 ComboFix-quarantined-files.txt 2008-12-09 16:21:17 ComboFix2.txt 2008-12-08 18:19:42 Pre-Run: 30,418,456,576 bytes free Post-Run: 30,402,449,408 bytes free 223 --- E O F --- 2008-11-13 08:30:29 |
|
|
|
|
12-09-2008, 11:23 PM
|
#6 (permalink) |
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing Sinowal.Trojan
Hi,
That's okay, the nasty was deleted fine. *Open the Symantec Control Panel Click View | Quarantine. Select the file or group of files. Do one of the following:
Open notepad. Copy and paste the text inside the Code Box below into Notepad Choose File > Save As and under "Save as type", choose "All Files". Type clean.bat in the File name and save it to your desktop. Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Owner\My Documents\Aptiva Files\Backups\SAP Labs Backups\2001-05-25\Users 05-25-01.zip" "K:\My Backups\Bond Backup\Program Files\Internet Explorer\PLUGINS\nponflow.dll" ) do ( del /a/f/q %%g if exist %%g echo.%%g >>"%temp%\log.txt" )>nul 2>&1 for %%g in ( "K:\My Backups\Bond Backup\Program Files\onflow" ) do ( attrib -s -h -r %%g rd /s/q %%g if exist %%g echo.%%g >>"%temp%\log.txt" )>nul 2>&1 if exist "%temp%\log.txt" (start notepad "%temp%\log.txt" ) else echo.Deleted Successfully! echo. pause del %0 let me know how's your computer running.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 12-09-2008 at 11:24 PM. |
|
|
|
|
12-10-2008, 12:00 AM
|
#7 (permalink) |
|
Registered User
Join Date: Dec 2008
Posts: 5
OS: Windows XP
|
Re: Need help removing Sinowal.Trojan
Hi,
I was able to delete all of the quarantined items in Symantec and the output of the clean.bat was "Deleted Successfully!". My computer appear to be running fine now. No redirect of my home page and no Windows firewall alert for the Sinowal virus. Thank you very much for your assistance. Over the past few weeks, I have had a number of external drives attached/unattached to my computer. Should I check to be sure they are also not infected? If so, how? Also, why didn't Symantec pickup the nasty virus originally? Should I be using a different anti-virus program? Thanks again. |
|
|
|
|
12-10-2008, 12:20 AM
|
#8 (permalink) | ||
|
Moderator/Analyst, Security Team ; Rangemaster, TSF Academy
Join Date: Oct 2006
Posts: 4,580
OS: Vista
|
Re: Need help removing Sinowal.Trojan
You're welcome.
Quote:
You can check them by inserting them > right click the drive > click "explore' > then delete any files or folders that are not yours. Make sure you show hidden files while doing it:
Quote:
Another thing is that lots of malware are pervasive and they hide from windows itself, including your antivirus products. This is why you should be careful and be aware of your surfing habits. If all is well, Click start > run > copy and paste: combofix /u That will hide your system files, clear your system restore cache and uninstall combofix. Note: Make sure you update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. Please check out Tony Klein's article "How did I get infected in the first place?" And miekiemoes' "How to Prevent Malware" Happy safe surfing! Note: Please reply to this thread one last time so I could mark it as resolved.
__________________
UNITE and ASAP since 2006 If we have helped you, please consider donating. The past won't be able to hurt you unless you keep on looking back at it. Last edited by Angelfire777; 12-10-2008 at 12:22 AM. |
||
|
|
|
| Thread Tools | |
|
|
