Deleted Member
Topic Starter
Help please. How can I get rid of this?
I used the Malwarebyte's Anti-Malware and here are the results.
Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 3
8/11/2009 5:52:32 PM
mbam-log-2009-08-11 (17-52-32).txt
Scan type: Quick Scan
Objects scanned: 105570
Time elapsed: 12 minute(s), 7 second(s)
Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 25
Registry Values Infected: 1
Registry Data Items Infected: 3
Folders Infected: 3
Files Infected: 26
Memory Processes Infected:
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Unloaded process successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{23kln5j0-4opm-11we-aax5-24ef1d187332} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-21cx3c644241} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-22cx3c644241} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-24cx1c987132} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67efg7h6-8ijl-56yt-klh4-76we8d3ram87} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-14kc2a323342} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-74cc3a322132} (Generic.Bot.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67kln5j0-4opm-00we-aax5-77ef1d187332} (Generic.Bot.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67xor2b0-3gmc-89vv-jij1-32kl2r3423321} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe (Security.Hijack) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe (Worm.Archive) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processmanager.exe (Worm.AutoRun) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\photoshop.exe (Worm.AutoRun) -> Delete on reboot.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sys (Worm.Archive) -> Delete on reboot.
Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (C:\WINDOWS\pchealth\Global.exe) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337 (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E} (Trojan.Agent) -> Delete on reboot.
C:\F\UCK (Backdoor.Bot) -> Quarantined and deleted successfully.
Files Infected:
c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\Driver.exe (Generic.Bot.H) -> Quarantined and deleted successfully.
C:\SYSTEM\FILES\ARMY.exe (Generic.Bot.H) -> Quarantined and deleted successfully.
C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337\GooD.exe (Generic.Bot.H) -> Delete on reboot.
C:\F\UCK\FK.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Geo.ONG\Local Settings\Temp\2c114.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Geo.ONG\Local Settings\Temp\323b6.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Geo.ONG\Local Settings\Temp\f624b.exe (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\Angie Ong\Local Settings\Temporary Internet Files\Content.IE5\CLEV81UN\sexy[1].avi (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Angie Ong\Local Settings\Temporary Internet Files\Content.IE5\SFTB6MJX\reddx[1].mp3 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\RESTORE\H-6-1-53-0976546321-090909032-8763-1337\Desktop.ini (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe (Trojan.Agent) -> Delete on reboot.
C:\F\UCK\dEsKtOp.InI (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\Fonts.exe (Worm.Archive) -> Delete on reboot.
C:\WINDOWS\Fonts\tskmgr.exe (Worm.Archive) -> Delete on reboot.
C:\autorun.inf (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\MS-DOS.com (Worm.AutoRun) -> Quarantined and deleted successfully.
C:\WINDOWS\pchealth\Global.exe (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\Media\rndll32.pif (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\Cursors\Boom.vbs (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\Global.exe (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\rndll32.exe (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\tskmgr.exe (Worm.AutoRun) -> Delete on reboot.
C:\WINDOWS\system32\drivers\Drivers.cab.exe (Worm.AutoRun) -> Delete on reboot.