[Resolved] Malware or Trojan Present

What the Tech? It's as easy as 1,2,3! ( Log In | Register )

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

3 Pages

1 2 3 >

[Resolved] Malware or Trojan Present, Can't Windows Udate or update Malware tools

Options

jensvad View Member Profile	May 26 2009, 10:01 AM Post #2
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	If anyone can take a look and help me it'd be greatly appreciated!

Tomk View Member Profile	May 30 2009, 04:37 PM Post #3
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, Did you happen to read this sticky: WARNING !? Or this one: What To Do If You Have No Response In 5 Days?? Or maybe this one: Welcome New Members? I'm assuming not seeing as how you ran tools you were specifically asked not to run, and you bumped your topic which delayed your recieved help for a week. Be that as it may: Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately: Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use. Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account. Consider what other private information could possibly have been taken from your computer and take appropriate steps This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer. If you wish to reformat then please let me know in your next response.

jensvad View Member Profile	May 30 2009, 06:51 PM Post #4
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	Sorry about running the tests. I was on several forums and ran those tests at their advice. Simply never got any follow up help from them so I simply posted the results here. I have a emachine laptop I bough from Tiger Direct. I recieved no discs whatsoever with this machine, so I'm not sure how to go about reinstalling windows. Any help would be greatly appreciated. Thanks Tomk! The original thing found in scans was Zlob.something. Almost every scan I run finds something. I can't lick this on my own. I have had viruses before, and can usually care for it myself. This one's kickin my %ss!! Be sound Jens Jens

Tomk View Member Profile	May 30 2009, 07:24 PM Post #5
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, I'm not completely clear on your intentions at this point. Are you wanting to reformat or would you like to risk it and try to clean it?

jensvad View Member Profile	May 31 2009, 10:37 AM Post #6
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	Sorry, bout that. Um, guess I was weighing my options. I would like to try and clean it. If all else fails, then I suppose I'll have to start backing up my stuff and figure out how to reformat. Thanks Tomk. Whats step one? Jens

Tomk View Member Profile	May 31 2009, 01:36 PM Post #7
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, Download Rooter.exe to your desktop Then doubleclick it to start the tool A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here COMBOFIX-Script Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: CODE File:: c:\program files\PokerStars c:\windows\system32\xa12033449.exe c:\windows\system32\xa12028550.exe Dirlook:: c:\programdata\Application Data\Application Data Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Referring to the screenshot above, drag CFScript.txt into ComboFix.exe. ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal. When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply. CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

jensvad View Member Profile	Jun 1 2009, 10:41 AM Post #8
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	Tomk, ROOTER LOG Microsoft Windows Vista Home Edition (6.0.6001) Service Pack 1 C:\ [Fixed] - NTFS - (Total:142380 Mo/Free:2045 Mo) D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) Mon 06/01/2009\|12:08 ----------------------\\ Processes.. --Locked-- [System Process] --Locked-- System ---------- \SystemRoot\System32\smss.exe ---------- C:\Windows\system32\csrss.exe ---------- C:\Windows\system32\wininit.exe ---------- C:\Windows\system32\csrss.exe ---------- C:\Windows\system32\winlogon.exe ---------- C:\Windows\system32\services.exe ---------- C:\Windows\system32\lsass.exe ---------- C:\Windows\system32\lsm.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Windows\System32\svchost.exe ---------- C:\Windows\system32\Ati2evxx.exe ---------- C:\Windows\System32\svchost.exe ---------- C:\Windows\System32\svchost.exe ---------- C:\Windows\system32\svchost.exe --Locked-- audiodg.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Windows\system32\SLsvc.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Windows\system32\Ati2evxx.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Windows\system32\WLANExt.exe ---------- C:\Windows\System32\spoolsv.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Program Files\a-squared Free\a2service.exe ---------- C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe ---------- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe ---------- C:\Program Files\EMACHINES\eMachines Recovery Management\Service\ETService.exe ---------- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe ---------- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe ---------- C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe ---------- C:\PROGRA~1\AVG\AVG8\avgrsx.exe ---------- C:\PROGRA~1\AVG\AVG8\avgnsx.exe ---------- C:\Windows\system32\taskeng.exe ---------- C:\Windows\system32\PnkBstrA.exe ---------- C:\Windows\system32\svchost.exe ---------- C:\Program Files\AVG\AVG8\avgcsrvx.exe ---------- C:\Windows\System32\svchost.exe ---------- C:\Windows\system32\SearchIndexer.exe ---------- C:\Windows\system32\Dwm.exe ---------- C:\Windows\Explorer.EXE ---------- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe ---------- C:\Program Files\AVG\AVG8\avgtray.exe ---------- C:\Program Files\Java\jre6\bin\jusched.exe ---------- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe ---------- C:\Program Files\BitComet\BitComet.exe ---------- C:\Program Files\AIM6\aim6.exe ---------- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ---------- C:\Windows\system32\taskeng.exe ---------- C:\Windows\system32\wbem\unsecapp.exe ---------- C:\Windows\system32\wbem\wmiprvse.exe ---------- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe ---------- C:\Program Files\Mozilla Firefox\firefox.exe ---------- C:\Program Files\Windows Media Player\wmpnscfg.exe ---------- C:\Program Files\Synaptics\SynTP\SynTPHelper.exe ---------- C:\Program Files\AIM6\aolsoftware.exe ---------- C:\Windows\system32\wuauclt.exe ---------- C:\Windows\system32\SearchProtocolHost.exe ---------- C:\Windows\system32\SearchFilterHost.exe ---------- C:\Program Files\AIM6\aolsoftware.exe ---------- C:\Windows\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! ----------------------\\ Cracks & Keygens.. C:\Users\Jens\AppData\Local\VirtualStore\Program Files\BitComet\torrents\Adobe Lightroom 2.0 Setup + Keygen.exe.torrent C:\Users\Jens\AppData\Local\VirtualStore\Program Files\BitComet\torrents\Microsoft Office Home and Student 2007 Keygen.exe.torrent 1 - "C:\Rooter$\Rooter_1.txt" - Mon 06/01/2009\|12:47 ----------------------\\ Scan completed at 12:47 This post has been edited by jensvad: Jun 1 2009, 10:48 AM

jensvad View Member Profile	Jun 1 2009, 11:33 AM Post #9
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	odd Tomk, I can post one word (small replies), but the site will not accept a posting of my COMBO FIX LOG. Error about memory. Tried making an attachment, won't upload. ? Jens This post has been edited by jensvad: Jun 1 2009, 11:34 AM

Tomk View Member Profile	Jun 1 2009, 11:53 AM Post #10
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, Upload to Mediafire and post the sharing link.

jensvad View Member Profile	Jun 1 2009, 12:35 PM Post #11
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	http://www.mediafire.com/?gnz2zzr3jlm http://www.mediafire.com/file/gnz2zzr3jlm/combo fix log.txt <a href='http://www.mediafire.com/?gnz2zzr3jlm'>http://www.mediafire.com/?gnz2zzr3jlm</a>

Tomk View Member Profile	Jun 1 2009, 01:49 PM Post #12
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, It was my fault that you couldn't post. The log was too big. All Vista computers have a c:\ProgramData\Application Data folder. However, you have a: c:\ProgramData\Application Data c:\ProgramData\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data c:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data I figured that there couldn't be many things in each of those non-standard folders. I was wrong. It appears you have a couple hundred files in each folder. Please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply.

jensvad View Member Profile	Jun 1 2009, 02:38 PM Post #13
Authentic Member Group: Authentic Member Posts: 23 Joined: 24-May 09 Member No.: 85,934 Operating System: Windows Vista Home	I have tried this website before. Every time I tried, it downloads the first set, but the second progress bar (the database) hangs and times out every time. I will try again right now. Thanks Tomk, Jens This post has been edited by jensvad: Jun 1 2009, 02:39 PM

jensvad

Jun 1 2009, 02:45 PM

Post #14

Authentic Member

Group: Authentic Member
Posts: 23
Joined: 24-May 09
Member No.: 85,934
Operating System: Windows Vista Home

Tomk, I attached a Screenshot of the error. I have tried this site, as well as trend micro and several others prior to coming here for help. None allow updating to occur. Whatever is in my computer must be blocking them. Can't windows update, nor can I update most antispyware/maleware programs I have tried.

Thanks,

jens

Attached thumbnail(s)

Tomk View Member Profile	Jun 1 2009, 02:50 PM Post #15
Forum God Group: Classroom Teacher Posts: 11,241 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	jensvad, Then let us do this: Please download gmer.zip from Gmer and save it to your desktop. Right click on gmer.zip and select Extract All.... Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard. Click on the Browse button. Click on Desktop. Then click OK. Click Next. It will start extracting. Once done, check (tick) the Show extracted files box and click Finish. Double click on gmer.exe to run it. Select the Rootkit tab. On the right hand side, check all the items to be scanned, but leave Show All box unchecked. Select all drives that are connected to your system to be scanned. Click on the Scan button. When the scan is finished, click Copy to save the scan log to the Windows clipboard. Open Notepad or a similar text editor. Paste the clipboard contents into the text editor. Save the Gmer scan log and post it in your next reply. Note: Do not run any programs while Gmer is running.

« Next Oldest · Infections Removal · Next Newest »

3 Pages

1 2 3 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Infections Removal CD/DVD Burner & Malware Help Please	0	kt_crow	6	Today, 12:32 PM Last post by: kt_crow
Infections Removal [Resolved] Here we go again	12	miller2644	150	Today, 12:05 PM Last post by: Tomk
Security advisories and vulnerabilities info SPAM frauds, fakes, and other MALWARE deliveries... 123» 15	211	AplusWebMaster	7,834	Today, 06:09 AM Last post by: AplusWebMaster
Infections Removal [Resolved] Can only browse one site in IE6 12	20	Wakenaam	369	Yesterday, 09:54 AM Last post by: Tomk