This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

This computer is being attacked

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Help please. How can I get rid of this? I used the Malwarebyte's Anti-Malware and here are the results. Malwarebytes' Anti-Malware 1.40 Database version: 2551 Windows 5.1.2600 Service Pack 3 8/11/2009 5:52:32 PM mbam-log-2009-08-11 (17-52-32).txt Scan type: Quick Scan Objects scanned: 105570 Time elapsed: 12 minute(s), 7 second(s) Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 25 Registry Values Infected: 1 Registry Data Items Infected: 3 Folders Infected: 3 Files Infected: 26 Memory Processes Infected: C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Unloaded process successfully. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Unloaded process successfully. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{23kln5j0-4opm-11we-aax5-24ef1d187332} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-21cx3c644241} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-22cx3c644241} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-24cx1c987132} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67efg7h6-8ijl-56yt-klh4-76we8d3ram87} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-14kc2a323342} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-74cc3a322132} (Generic.Bot.H) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-77ef1d187332} (Generic.Bot.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67xor2b0-3gmc-89vv-jij1-32kl2r3423321} (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe (Worm.Archive) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmanager.exe (Worm.AutoRun) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photoshop.exe (Worm.AutoRun) -> Delete on reboot. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys (Worm.Archive) -> Delete on reboot. Registry Data Items Infected: HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (C:\WINDOWS\pchealth\Global.exe) Good: (regedit.exe "%1") -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337 (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} (Trojan.Agent) -> Delete on reboot. C:\F\UCK (Backdoor.Bot) -> Quarantined and deleted successfully. Files Infected: c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\Driver.exe (Generic.Bot.H) -> Quarantined and deleted successfully. C:\SYSTEM\FILES\ARMY.exe (Generic.Bot.H) -> Quarantined and deleted successfully. C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337\GooD.exe (Generic.Bot.H) -> Delete on reboot. C:\F\UCK\FK.exe (Backdoor.Bot) -> Quarantined and deleted successfully. C:\Documents and Settings\Geo.ONG\Local Settings\Temp\2c114.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Geo.ONG\Local Settings\Temp\323b6.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Geo.ONG\Local Settings\Temp\f624b.exe (Trojan.Downloader) -> Delete on reboot. C:\Documents and Settings\Angie Ong\Local Settings\Temporary Internet Files\Content.IE5\CLEV81UN\sexy[1].avi (Backdoor.Bot) -> Quarantined and deleted successfully. C:\Documents and Settings\Angie Ong\Local Settings\Temporary Internet Files\Content.IE5\SFTB6MJX\reddx[1].mp3 (Trojan.Agent) -> Quarantined and deleted successfully. C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337\Desktop.ini (Worm.AutoRun) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Delete on reboot. C:\F\UCK\dEsKtOp.InI (Backdoor.Bot) -> Quarantined and deleted successfully. C:\WINDOWS\Fonts\Fonts.exe (Worm.Archive) -> Delete on reboot. C:\WINDOWS\Fonts\tskmgr.exe (Worm.Archive) -> Delete on reboot. C:\autorun.inf (Worm.AutoRun) -> Quarantined and deleted successfully. C:\MS-DOS.com (Worm.AutoRun) -> Quarantined and deleted successfully. C:\WINDOWS\pchealth\Global.exe (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\Media\rndll32.pif (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\Cursors\Boom.vbs (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\dllcache\Global.exe (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\dllcache\rndll32.exe (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\dllcache\tskmgr.exe (Worm.AutoRun) -> Delete on reboot. C:\WINDOWS\system32\drivers\Drivers.cab.exe (Worm.AutoRun) -> Delete on reboot.
Take a read through this and then start a fresh thread in this forum and post a HJT log and a brief description of your problem, and somebody will be along as soon as.
Helpers look for posts with zero replies which is why you need to start afresh and why i'll lock this one.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI