US Soldiers need your help Win32/AutoRun.VB.DU

[CARDER]

Hey all
My name is PFC Carder
I am currently deployed to Afghanistan.
My virus software (ESET) has found this worm "Win32/AutoRun.VB.DV worm"
ESET will delete it however it keeps returning as if it is morphing itself
This worm can be found on every drive including removable devices
In a 12 hour span ESET deleted and cleaned it over 7000 times.
I have tried everything I can think of. It seems to have disabled ESET in safe mode.
I have disabled all system backups and AutoRun
It seems to attach itself to autorun.inf
I am sure every soldier hear or within my platoon has this worm we all share pic and tunes
OS = 64bit vista
I can not find any info on this worm
Please help us

[CatByte]

Hi, this may be very difficult to clean unless every one who has this infection co-operates with the cleaning.

Yours will be especially difficult as you have a 64 bit system and a lot of our tools will not run on a 64bit.

First of all. Someone with an XP OS needs to download flash disinfector and everyone needs to clean their USB's, if you are sharing your USB's this is one sure way the infection is spreading and staying alive:

Flash disinfector will not work on your 64bit system.

Download Flash_Disinfector.exe from HERE and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.

(you can plug in your removable media to disinfect it on the XP computer)


NEXT
Run MalwareBytes Antimalware. It is a standalone scanner that will clean a lot of the infections from every OS.

Anything more than this will have to be done on an individual basis as every operating system is different and one fix may not be the right fix for the next system.

The forum asks that your perform the first steps: which is to download DDS and GMER and post the logs: the intructions can be found here:

Those programs wont work on your system, you will need to run OTS:

If you would like I will be happy to help everyone's computer but lets clean yours up first. When you are clean, post the DDS and GMER logs for computer #2...we'll clean that up, then post logs for computer #3...etc. etc. make sure you don't all follow the instructions I give for the individual computers, the scripts I give out may not be the same.


I will now post for the MalwareBytes program and the OTS for YOUR computer.

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <-- very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Download OTSto your Desktop

• Close ALL OTHER PROGRAMS.
• Double-click on OTS.exe to start the program.
• Check the box that says Scan All Users
• Check the box that says 64 bit
• Under Additional Scans check the following:
  • File - Lop Check
  • File - Purity Scan
  • Evnt - EvtViewer (last 10)
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please attach the log in your next post.

[CARDER]

Malwarebytes log

Malwarebytes' Anti-Malware 1.41
Database version: 2897
Windows 6.0.6001 Service Pack 1

10/3/2009 10:08:43 AM
mbam-log-2009-10-03 (10-08-43).txt

Scan type: Quick Scan
Objects scanned: 82336
Time elapsed: 3 minute(s), 8 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 5
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
C:\Users\RICHARD CARDER\AppData\Local\Temp\svchost.com (Worm.AutoRun) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hotkey (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\user agent (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\RICHARD CARDER\AppData\Local\Temp\svchost.com (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\RICHARD CARDER\Templates\cache\vmx.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\RICHARD CARDER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sndvol32.exe (Worm.AutoRun) -> Quarantined and deleted successfully.

[CARDER]

OTS log

[CatByte]

Hi,

Please do the following:



Start OTS
Copy/Paste the information inside the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {5C255C8A-E604-49b4-9D64-90988571CECB} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a714f83-2a00-11de-89c8-cc0c4e196bab}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc10fd03-42dd-11de-88ac-ee7d8020f699}\shell\AutoRun\command ->
[Files/Folders - Modified Within 30 Days]
NY -> 34 C:\Users\RICHARD CARDER\AppData\Local\Temp\*.tmp files -> C:\Users\RICHARD CARDER\AppData\Local\Temp\*.tmp
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.


NEXT

Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC Now button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  Post the contents of the ActiveScan report

[CARDER]

OTS LOG

All Processes Killed
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a714f83-2a00-11de-89c8-cc0c4e196bab}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc10fd03-42dd-11de-88ac-ee7d8020f699}\shell\AutoRun\command\ deleted successfully.
[Files/Folders - Modified Within 30 Days]
[Empty Temp Folders]


User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: RICHARD CARDER
->Temp folder emptied: 8747738 bytes
File delete failed. C:\Users\RICHARD CARDER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 1392854281 bytes
->Java cache emptied: 31496716 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\TMP0000006424B2D9F521ED30E8 scheduled to be deleted on reboot.
Windows Temp folder emptied: 313367642 bytes
RecycleBin emptied: 1077419 bytes

Total Files Cleaned = 1666.62 mb

< End of fix log >
OTS by OldTimer - Version 3.0.20.0 fix logfile created on 10032009_153606

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP0000006424B2D9F521ED30E8 not found!

Registry entries deleted on Reboot...

====================================================================================================================

ActiveScan log

All Processes Killed
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a714f83-2a00-11de-89c8-cc0c4e196bab}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc10fd03-42dd-11de-88ac-ee7d8020f699}\shell\AutoRun\command\ deleted successfully.
[Files/Folders - Modified Within 30 Days]
[Empty Temp Folders]


User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: RICHARD CARDER
->Temp folder emptied: 8747738 bytes
File delete failed. C:\Users\RICHARD CARDER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 1392854281 bytes
->Java cache emptied: 31496716 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\TMP0000006424B2D9F521ED30E8 scheduled to be deleted on reboot.
Windows Temp folder emptied: 313367642 bytes
RecycleBin emptied: 1077419 bytes

Total Files Cleaned = 1666.62 mb

< End of fix log >
OTS by OldTimer - Version 3.0.20.0 fix logfile created on 10032009_153606

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP0000006424B2D9F521ED30E8 not found!

Registry entries deleted on Reboot...

[CARDER]

ActiveScan log

[CARDER]

OTS LOG

All Processes Killed
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{23f9e160-1f35-11de-a251-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c4661e6-2c41-11de-aee6-a6d30a40f69e}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{304dfa19-a402-11de-b106-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4a714f83-2a00-11de-89c8-cc0c4e196bab}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9f1f4e8a-1f49-11de-9356-806e6f6e6963}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a1e15713-4eaa-11de-8715-cb66373a2496}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ab227604-1f84-11de-9c5d-00235a2929bd}\shell\AutoRun\command\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\Autoplay\Command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\AutoRun\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\explore\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\open\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{bf59872b-a8c6-11de-925e-00235a2929bd}\shell\ws\command\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dc10fd03-42dd-11de-88ac-ee7d8020f699}\shell\AutoRun\command\ deleted successfully.
[Files/Folders - Modified Within 30 Days]
[Empty Temp Folders]


User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: RICHARD CARDER
->Temp folder emptied: 8747738 bytes
File delete failed. C:\Users\RICHARD CARDER\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 1392854281 bytes
->Java cache emptied: 31496716 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
File delete failed. C:\Windows\temp\TMP0000006424B2D9F521ED30E8 scheduled to be deleted on reboot.
Windows Temp folder emptied: 313367642 bytes
RecycleBin emptied: 1077419 bytes

Total Files Cleaned = 1666.62 mb

< End of fix log >
OTS by OldTimer - Version 3.0.20.0 fix logfile created on 10032009_153606

Files\Folders moved on Reboot...
File\Folder C:\Windows\temp\TMP0000006424B2D9F521ED30E8 not found!

Registry entries deleted on Reboot...

====================================================================================================================

[CatByte]

Hi,

You appear to be clean. How is your computer behaving?

Please do the following:

• Make sure you have an Internet Connection.
• Double-click OTS.exe to run it. (Vista users, please right click on OTS.exe and select "Run as an Administrator")
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTS to reach the Internet, please allow the application to do so.
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You should be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NEXT

Now we need to create a new clean SYSTEM RESTORE point.

• Close and save any documents that you may have open.
• Open up the Start Menu and right-click on "Computer", and then select "Properties"
• This will take you into the System area of Control Panel. Click on the "Advanced system settings" on the left hand side.
• Now select the "System Protection" tab to get to the System Restore section.
• Click the "Create" button to create a new restore point. You'll be prompted for a name, and you might want to give it a useful name that you'll be able to easily identify later.
• Click the Create button, and then the system will create the restore point.
• When it's all finished, you'll get a message saying it's completed successfully.
• You will now have a new restore point

Then remove all previous Restore Points

• Click Start Menu > Run > copy and paste
• cleanmgr into the run box
• At the top, click on the More Options tab, under System Restore and Shadow Copies group,
• Click the Clean up button,
• Vista will ask you if you’re sure, click on Yes button.
• When finished, click on Cancel button to exit.

NEXT

if there are any other logs remaining on your desktop, right click and delete them.


Below I have included a number of recommendations for how to protect your computer against malware infections.

• It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
  Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe.
  
  
• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
  
• For Firefox, I highly recommend this add-on to keep your PC even more secure.
  • NoScript - for blocking ads and other potential website attacks
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
• In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
  Think Prevention.
  PC Safety and Security--What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.


You can now post the DDS and GMER logs for computer #2 unless you have any outstanding issues with your computer

(ps. how many computers are there?)

[CARDER]

First of all I would like to thank you for all your help with my computer.
THANKS
My computer it running great.


There are 12 computers in my squad however I plan to scan each one of them with MalwareBytes program to check for this virus. If there is no infection. then no need to worry about there computer.
A few of the guys has done a system restore in order to rid themselves of virus.

The most of the guy’s hear are running 64 bit vista all but one I believe and he is running 32 bit vista As soon as I get a chance to scan there computers ill get back to you with there logs.

One small problem I did encounter however is that no one hear has windows xp therefore I can not use Flash Disinfector is there any flash driver cleaners that run on vista that you could suggest
I was looking around for something and found USB Drive Fresher
via http://www.affinity-tools.com/usbfresher/ any thoughts ?

again thanks for all your help

[CatByte]

Hi,

I'm not familiar with that program, but it looks like it's designed to do what you need it to do.

Unusual everyone has 64 bit systems but that's OK.

DDS won't work on them. It will need to be OTS.

But Malwarebytes should clean them all up nicely.

Post OTS logs for any that still have issues (one at a time)

[CARDER]

Computer #2

Malwarebytes log

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 6.0.6001 Service Pack 1

10/3/2009 11:11:55 PM
mbam-log-2009-10-03 (23-11-55).txt

Scan type: Quick Scan
Objects scanned: 85875
Time elapsed: 7 minute(s), 51 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
C:\Users\Ray Hamilton\AppData\Local\Temp\svchost.com (Worm.AutoRun) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hotkey (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Worm.AutoRun) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\user agent (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Ray Hamilton\AppData\Local\Temp\svchost.com (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\Ray Hamilton\Templates\cache\vmx.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Users\Ray Hamilton\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sndvol32.exe (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\oreans32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\Users\Ray Hamilton\AppData\Local\Temp\scr\Ribbons.exe (Worm.AutoRun) -> Quarantined and deleted successfully.

[CatByte]

Hi,

Please do the following:

Start OTS
Copy/Paste the information inside the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.

[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "" [HKLM] -> Reg Error: Key error. []
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000\] > -> HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{604BC32A-9680-40D1-9AC6-E06B23A1BA4C}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< WinNT Load [HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000] > -> HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
*load* -> HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
YY -> C:\Users\RAYHAM~1\AppData\Local\Temp\svchost.com -> C:\Users\RAYHAM~1\AppData\Local\Temp\svchost.com
< WinNT Load [HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000] > -> HKEY_USERS\S-1-5-21-1346426997-3149855423-324312701-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\load
< MountPoints2 [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\G\shell\phone\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{652d40d2-a8de-11de-b39e-806e6f6e6963}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{652d40d2-a8de-11de-b39e-806e6f6e6963}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{652d40d2-a8de-11de-b39e-806e6f6e6963}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{652d40d2-a8de-11de-b39e-806e6f6e6963}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{652d40d2-a8de-11de-b39e-806e6f6e6963}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e23a3f4-a524-11de-86b0-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e23a3f4-a524-11de-86b0-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e23a3f4-a524-11de-86b0-001d72dbc91a}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e23a3f4-a524-11de-86b0-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7e23a3f4-a524-11de-86b0-001d72dbc91a}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2f9cad-761e-11de-9901-001d72dbc91a}\shell ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8f2f9cad-761e-11de-9901-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5e18612-a8ef-11de-86f6-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5e18612-a8ef-11de-86f6-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5e18612-a8ef-11de-86f6-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a5e18612-a8ef-11de-86f6-001d72dbc91a}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c11d-9e1c-11de-8f05-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c11d-9e1c-11de-8f05-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c11d-9e1c-11de-8f05-001d72dbc91a}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c11d-9e1c-11de-8f05-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c11d-9e1c-11de-8f05-001d72dbc91a}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c1f1-9e1c-11de-8f05-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c1f1-9e1c-11de-8f05-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c1f1-9e1c-11de-8f05-001d72dbc91a}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c1f1-9e1c-11de-8f05-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{af12c1f1-9e1c-11de-8f05-001d72dbc91a}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4212f13-a474-11de-8174-001d72dbc91a}\shell ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4212f13-a474-11de-8174-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2e914-90c0-11de-99aa-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2e914-90c0-11de-99aa-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2e914-90c0-11de-99aa-001d72dbc91a}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2e914-90c0-11de-99aa-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2e914-90c0-11de-99aa-001d72dbc91a}\shell\ws\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2ea68-90c0-11de-99aa-001d72dbc91a}\shell\Autoplay\Command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2ea68-90c0-11de-99aa-001d72dbc91a}\shell\AutoRun\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2ea68-90c0-11de-99aa-001d72dbc91a}\shell\explore\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2ea68-90c0-11de-99aa-001d72dbc91a}\shell\open\command ->
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e1a2ea68-90c0-11de-99aa-001d72dbc91a}\shell\ws\command ->
[Files/Folders - Modified Within 30 Days]
NY -> 342 C:\Users\Ray Hamilton\AppData\Local\Temp\*.tmp files -> C:\Users\Ray Hamilton\AppData\Local\Temp\*.tmp
[Empty Temp Folders]
[Start Explorer]
[Reboot]

The fix should only take a very short time. When the fix is completed a message box will popup either telling you that it is finished, or that a reboot is needed to complete the fix. If the fix is complete, click the Ok button and Notepad will open with a log of actions taken during the fix. Post that log back here in your next reply.

If a reboot is required, click the "Yes" button to reboot the machine. After the reboot, OTS will finish moving any files that could not be moved during the fix and NotePad will open with the final results at that time. Post that log back here in your next reply.

NEXT:

Run the MalwareBytes program again, make sure it comes back clean.

Then run the Panda online scan.


Please go HERE to run Panda's ActiveScan

• Once you are on the Panda site click the Scan your PC Now button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
  Post the contents of the ActiveScan report

[CatByte]

Hi,

I have found a tool to disinfect all your USB's, this will work as well as flash disinfector - have everyone run this tool on their removable media.

Down load Autorun Eater and save it to your desktop

Run the tool, plugging in all your removable media while doing so.

[amateur]

Since this issue appears resolved, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here:

http://www.techsupportforum.com/secu...oval-help.html

Surf Safely, and Think Prevention!