Ok you got a different variant of the same infection....
Please download
SmitfraudFix (by
S!Ri)
Extract the content (a folder named
SmitfraudFix) to your Desktop.
Open the
SmitfraudFix folder and double-click
smitfraudfix.cmd Select option #1 -
Search by typing
1 and press "
Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note :
process.exe
is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
NOTE: Do not run any other options from SmitfraudFix until I tell you to do so!
I am so glad it is you responding. You really helped me last time. Here is the SmartFIx report. Thank you again for your help.
SmitFraudFix v2.122
Scan done at 14:13:32.78, Sat 11/18/2006
Run from C:\Documents and Settings\Administrator.MARTINO\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\ncompat.tlb FOUND !
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator.MARTINO
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator.MARTINO\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
C:\DOCUME~1\ADMINI~1.MAR\STARTM~1\Programs\SpywareQuake FOUND !
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Security Troubleshooting.url FOUND !
C:\DOCUME~1\ADMINI~1.MAR\FAVORI~1\Antivirus Test Online.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
C:\DOCUME~1\ALLUSE~1.WIN\Desktop\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1.WIN\Desktop\Security Troubleshooting.url FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
C:\Program Files\Media-Codec\ FOUND !
C:\Program Files\Security Toolbar\ FOUND !
C:\Program Files\SpywareQuake\ FOUND !
C:\Program Files\VideoKeyCodec\ FOUND !
C:\Program Files\VirusBursters\ FOUND !
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
Create a new folder named
HijackThis to your desktop and move
HijackThis.exe into that folder.
Open AVG Anti-Spyware
On the main screen under Your Computer's security.
Click on Change state next to Resident shield. It should now change to inactive.
Click on Change state next to Automatic updates. It should now change to inactive.
Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the
Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Download
ATF Cleaner by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
Go to My Computer
Select the Tools menu and click Folder Options
Click the View tab.
Checkmark the "Display the contents of system folders"
Under the Hidden files and folders select "Show hidden files and folders"
Uncheck "Hide protected operating system files"
Click Apply and then the OK and close My Computer.
==================
Run
HijackThis, click
Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press
Fix checked. If something isn't there, please continue with the next entry in the list.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchco.com/ O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - C:\Program Files\VideoKeyCodec\isaddon.dll (file missing) O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file) O3 - Toolbar: (no name) - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - (no file) O4 - HKLM\..\Run: "C:\Program Files\Common Files\dc6_startupmon.exe" O4 - HKLM\..\Run: "C:\Program Files\Common Files\ers_startupmon.exe" O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - (no file)
Restart your computer to the safe mode:
Restart your computer
Start tapping the F8 key when the computer restarts.
When the start menu opens, choose Safe mode
Press Enter. The computer then begins to start in Safe mode.
Go to the My Computer and delete the following
files (if present):
C:\Program Files\Common Files\
dc6_startupmon.exe
C:\Program Files\Common Files\
ers_startupmon.exe
Once in Safe Mode, open the
SmitfraudFix folder again and double-click
smitfraudfix.cmd Select option #2 -
Clean by typing
2 and press "
Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing
Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if
wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing
Y and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at
C:\rapport.txt
Warning : running option #2 on a non infected computer will remove your Desktop background.
Restart to the safe mode again.
Run
ATF Cleaner
Under Main choose: Select All Click the Empty Selected button.
If you use Firefox browser
Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click
Exit on the Main menu to close the program.
Close
ALL open Windows / Programs / Folders. Please start
AVG Anti-Spyware and run a full scan.
Click on Scanner on the toolbar.
Click on the Settings tab.
Under How to act?
Click on Recommended Action and choose Quarantine from the popup menu.
Under How to scan?
All checkboxes should be ticked.
Under Possibly unwanted software:
All checkboxes should be ticked.
Under Reports:
Select Automatically generate report after every scan and uncheck Only if threats were found.
Under What to scan?
Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below. IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
Make sure that Set all elements to: shows Quarantine(1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button. (3)
When done, click the Save Scan Report button. (4)
Click the Save Report as button.
Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
================
When you're ready, please post the following logs to here: - AVG's report
- a fresh HijackThis log
- contents of C:\Rapport.txt
Logfile of HijackThis v1.99.1
Scan saved at 3:55:07 PM, on 11/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Scan done at 11:17:29.78, Sun 11/19/2006
Run from C:\Documents and Settings\Administrator.MARTINO\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
Hi again, it is looking clean now :)
Computer is running fine ?
The you had a keylogger there, if this system is used for online banking or has credit card information on it, all passwords should be changed immediately. Banking and credit card institutions, if any, should be notified of the possible security breech. I suggest that you read
this article too.
You don't seem to a
firewall running, you must
install one firewall.
NOTE: If you're using Windows XP firewall, I recommend that you install a better firewall. Windows firewall doesn't really provide enough protection. Disable Windows firewall after installing a new firewall.
Stand Up and Be Counted ! The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Mr_JAk3
159 Posts
0
November 18th, 2006 13:00
Ok you got a different variant of the same infection....
Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press " Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
NOTE: Do not run any other options from SmitfraudFix until I tell you to do so!
lemonade15
11 Posts
0
November 18th, 2006 17:00
Run from C:\Documents and Settings\Administrator.MARTINO\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
C:\WINDOWS\system32\ot.ico FOUND !
C:\WINDOWS\system32\ts.ico FOUND !
C:\WINDOWS\system32\1024\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrator.MARTINO\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Security Troubleshooting.url FOUND !
C:\DOCUME~1\ALLUSE~1.WIN\Desktop\Security Troubleshooting.url FOUND !
C:\Program Files\Security Toolbar\ FOUND !
C:\Program Files\SpywareQuake\ FOUND !
C:\Program Files\VideoKeyCodec\ FOUND !
C:\Program Files\VirusBursters\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"=" http://us.i1.yimg.com/us.yimg.com/i/ww/t6/tp_top_bg.png"
"SubscribedURL"=" http://us.i1.yimg.com/us.yimg.com/i/ww/t6/tp_top_bg.png"
"FriendlyName"=""
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
!!!Attention, following keys are not inevitably infected!!!
Search SharedTaskScheduler's .dll
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"
!!!Attention, following keys are not inevitably infected!!!
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32
»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Mr_JAk3
159 Posts
0
November 19th, 2006 11:00
Download HijackThis to your desktop from here
Create a new folder named HijackThis to your desktop and move HijackThis.exe into that folder.
Open AVG Anti-Spyware
- On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Download ATF Cleaner by Atribune to your desktop.
Do NOT run yet.
Make your hidden files visible:
==================
Run HijackThis, click Do a system scan only, and check the box next to each of these entries if still present. Close all other windows and press Fix checked. If something isn't there, please continue with the next entry in the list.
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchco.com/
O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - C:\Program Files\VideoKeyCodec\isaddon.dll (file missing)
O3 - Toolbar: (no name) - {736b5468-bdad-41be-92d0-22ae2ddf7bcb} - (no file)
O3 - Toolbar: (no name) - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - (no file)
O4 - HKLM\..\Run: "C:\Program Files\Common Files\dc6_startupmon.exe"
O4 - HKLM\..\Run: "C:\Program Files\Common Files\ers_startupmon.exe"
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - (no file)
Restart your computer to the safe mode:
Go to the My Computer and delete the following files (if present):
C:\Program Files\Common Files\ dc6_startupmon.exe
C:\Program Files\Common Files\ ers_startupmon.exe
Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press " Enter" to delete infected files.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".
The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt
Warning : running option #2 on a non infected computer will remove your Desktop background.
Restart to the safe mode again.
Run ATF Cleaner
- Under Main choose: Select All
If you use Firefox browserClick the Empty Selected button.
- Click Firefox at the top and choose: Select All
If you use Opera browserClick the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
- Click Opera at the top and choose: Select All
Click Exit on the Main menu to close the program.Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act?
- Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
- All checkboxes should be ticked.
- Under Possibly unwanted software:
- All checkboxes should be ticked.
- Under Reports:
- Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
- Select Scan every file.
- Click on the Scan tab.
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
- When the scan has finished, follow the instructions below.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
- When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
================
When you're ready, please post the following logs to here:
- AVG's report
- a fresh HijackThis log
- contents of C:\Rapport.txt
Message Edited by Mr_JAk3 on 11-19-200608:00 AM
lemonade15
11 Posts
0
November 19th, 2006 18:00
Scan saved at 3:55:07 PM, on 11/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Rogers\SelfHealing\rogersagent.exe
C:\Program Files\palmOne\Hotsync.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Documents and Settings\Administrator.MARTINO\Desktop\Hijackthis\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background
O4 - HKCU\..\Run: [RogersAgent] c:\Program Files\Rogers\SelfHealing\rogersagent.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Rogers Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137961384046
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137961375452
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
Run from C:\Documents and Settings\Administrator.MARTINO\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in safe mode
!!!Attention, following keys are not inevitably infected!!!
Search SharedTaskScheduler's .dll
"{E2CA7CD1-1AD9-F1C4-3D2A-DC1A33E7AF9D}"="USB Ware"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\WINDOWS\system32\ot.ico Deleted
C:\WINDOWS\system32\ts.ico Deleted
C:\WINDOWS\system32\1024\ Deleted
C:\DOCUME~1\ALLUSE~1.WIN\Desktop\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1.WIN\Desktop\Security Troubleshooting.url Deleted
C:\DOCUME~1\ADMINI~1.MAR\FAVORI~1\Antivirus Test Online.url Deleted
C:\DOCUME~1\ADMINI~1.MAR\STARTM~1\Programs\SpywareQuake Deleted
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1.WIN\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\Media-Codec\ Deleted
C:\Program Files\Security Toolbar\ Deleted
C:\Program Files\SpywareQuake\ Deleted
C:\Program Files\VideoKeyCodec\ Deleted
C:\Program Files\VirusBursters\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
lemonade15
11 Posts
0
November 19th, 2006 18:00
---------------------------------------------------------
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\FindIt.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\FindItHot.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\Highlight.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\HighlightHot.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\findithotxp.png -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\finditxp.png -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\highlighthotxp.png -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\highlightxp.png -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\jokesearch.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\logo.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\logoxp.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\pranks.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\smiley.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\buttons\smileyxp.png -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\contexts -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\contexts\error.xml -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\contexts\related.xml -> Adware.Starware : Cleaned with backup (quarantined).
C:\Documents and Settings\All Users.WINDOWS\Application Data\Starware\contexts\travel.xml -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\Setup.exe -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\StarwareConfig.xml -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\bin -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\bin\dlls -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\brand.bmp -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\icons -> Adware.Starware : Cleaned with backup (quarantined).
C:\Program Files\Starware\icons\star_16.ico -> Adware.Starware : Cleaned with backup (quarantined).
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\Starware -> Adware.Starware : Cleaned with backup (quarantined).
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\Starware\Options -> Adware.Starware : Cleaned with backup (quarantined).
C:\Downloads\FlipWordsSetup-dm[1].exe -> Adware.Trymedia : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013730.exe -> Adware.VirusBursters : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006 -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\msvcp71.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\Program Files\WinAntiVirus Pro 2006\msvcr71.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013552.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013637.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013638.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013639.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013640.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013641.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013642.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013643.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013644.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013645.ini -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013646.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013647.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013649.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013650.cpl -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013651.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013653.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013654.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013657.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013658.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013659.exe -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013660.sys -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013667.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013670.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013671.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013672.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013673.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\WINDOWS\system32\SpOrder.dll -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf\Enum -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf\Security -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Enum -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKLM\SYSTEM\CurrentControlSet\Services\vspf_hk\Security -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\WinAntiVirus Pro 2006 -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
HKU\S-1-5-21-602162358-583907252-839522115-500\Software\WinAntiVirus Pro 2006\Settings -> Adware.WinAntiVirus : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013556.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013679.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013696.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013710.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013735.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013750.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013768.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013783.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013865.dll -> Downloader.Zlob.ahb : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013559.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013681.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013698.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013712.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013738.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013752.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013771.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013784.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013795.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013864.dll -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP73\A0014025.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP73\A0014026.exe -> Downloader.Zlob.atg : Cleaned with backup (quarantined).
C:\vbsys2.dll -> Hijacker.Agent.ac : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013863.dll -> Not-A-Virus.Hoax.Win32.Renos.ap : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013558.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013680.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013697.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP69\A0013711.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013737.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013751.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013770.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013785.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{14A51ACC-0BF1-452C-9FA0-997080301772}\RP70\A0013796.exe -> Not-A-Virus.Hoax.Win32.Renos.fx : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.exe -> Trojan.Sinowal.n : Cleaned with backup (quarantined).
::Report end
Mr_JAk3
159 Posts
0
November 20th, 2006 11:00
Computer is running fine ?
The you had a keylogger there, if this system is used for online banking or has credit card information on it, all passwords should be changed immediately. Banking and credit card institutions, if any, should be notified of the possible security breech. I suggest that you read this article too.
You don't seem to a firewall running, you must install one firewall.
NOTE: If you're using Windows XP firewall, I recommend that you install a better firewall. Windows firewall doesn't really provide enough protection.
Disable Windows firewall after installing a new firewall.
These are good (free) firewalls:
Now you can clean AVG's Quarantine:
You can remove the tools we used.
Then you should update your Java to the latest version (5.0 update 9)
Now you can make your hidden files hidden again.
=============
Now that you seem to be clean, please follow these simple steps in order to keep your computer clean and secure:
This will clear the system restore folders from possible malware that was left behind during the cleaning process.
Download and install ATF Cleaner. Clean your temporary files & folders with it regularly.
Download and install Ad-Aware. Update it and scan your computer regularly with it.
Update it and scan your computer regularly with it.
Download and install Spybot S&D. Update it and scan your computer regularly with it.
SpywareBlaster will prevent spyware from being installed.
This prevents your computer from connecting to harmful sites.
Firefox is faster, safer and better browser than Internet Explorer.
Visit Windows Update regularly.
Scan your computer regularly with your antivirus.
So how did I get infected in the first place?
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Stay clean and be safe ;)