What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware - "Congratulations visitor..." popup, malwarebytes s

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have malware on my Dell Latitude Laptop. I've tried running malwarebytes, but I think the virus is shutting down the malwarebytes application, half way thru the scan/clean. There are various messages popping up: Message from webpage: "Congratulations Visitor! You just qualified to win a Apple iPhone 4 & iPad. Read below for details. Message from webpage: "Are you sure you don't want to take advantage of the free trial? …." When I delete the messages they re-appear in a few seconds. Microsoft Security Essentials won't come up…
Post #2
Hi solo58, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.


Go HERE to get a randomly named copy of GMER. Scroll down to the Download section and click Download EXE. Save it to your desktop.

Before scanning with GMER, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

  • Double click on the file you downloaded. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER will not run in normal windows, please run it in Safe Mode


Next

Download OTL to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • In the window under Custom Scans/Fixes copy and paste the following


    netsvcs
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lîk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Deskuop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    iexplore.*
    explorer.*
    winlogon.*
    dll
    zx.dll
    hlp.dat
    /md5stop
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with
  • GMER log
  • both OTL log
No need for a Hijackthis log, OTL will show use more.

Please describe the computer's behavior at the moment.

Thanks
Post #3
I ran gmer once….but forgot to save as .txt file. So I've tried running it again…but it gets stuck half way thru….suspect the bad guys have something to do with it. By-the-way. Before you had responded, I got malwarebytes to run again…and it detected and removed 7 trojans…but obviously not all of them. What next? Should I try to run OTL, even if GMER won't run?
Post #4
Hi solo58,

Yes run OTL and post the logs. Did you try GMER in safe?

note: If you have the GMER log from the time you succesfully ran it saved as .log, you can rename it to .txt

Locate the file and right click on it and select rename. On the keyboard type gmer.txt and hit enter.

Thanks
Post #5
Here's the OTL Log.
The Extras text wasn't generated…or I can't find it. I ran a search for extras.txt…nada…
What would be the file name for the GMER report?


OTL logfile created on: 3/19/2011 11:25:35 AM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\solitario\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 509.00 Mb Available Physical Memory | 50.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.46 Gb Total Space | 1.91 Gb Free Space | 2.57% Space Free | Partition Type: NTFS

Computer Name: SOLITAR-14P7WC1 | User Name: solitario | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\solitario\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\HTC\HTC Sync\ClientInitiatedStarter\ClientInitiatedStarter.exe (Teleca)
PRC - C:\Program Files\Common Files\Teleca Shared\Generic.exe (Teleca AB)
PRC - C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
PRC - C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
PRC - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\dbgout.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\epmworker.exe (Teleca Sweden AB)
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\FsynSrvStarter.exe (TODO: )
PRC - C:\Program Files\HTC\HTC Sync\Mobile Phone Monitor\HTCVBTServer.exe (Teleca AB)
PRC - C:\Program Files\Common Files\Teleca Shared\logger.exe (Popwire AB)
PRC - C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe (Teleca Sweden AB)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\DellTPad\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\solitario\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\hccutils.dll (Intel Corporation)


========== Win32 Services (SafeList) ==========

SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (FolderSize) – C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Intel® Corporation)
SRV - (WLANKEEPER) Intel® – C:\Program Files\Intel\WiFi\bin\WLKEEPER.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\WiFi\bin\S24EvMon.exe (Intel® Corporation)
SRV - (RegSrvc) Intel® – C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation)


========== Driver Services (SafeList) ==========

DRV - (NETw5x32) Intel® – C:\WINDOWS\system32\drivers\NETw5x32.sys (Intel Corporation)
DRV - (HTCAND32) – C:\WINDOWS\system32\drivers\ANDROIDUSB.sys (HTC, Corporation)
DRV - (s24trans) – C:\WINDOWS\system32\drivers\s24trans.sys (Intel Corporation)
DRV - (guardian2) – C:\WINDOWS\system32\drivers\oz776.sys (O2Micro)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {7C7F5C11-4ACD-4CDB-9293-2E3F46654E2A}:0.28
FF - prefs.js..keyword.URL: "http://www.google.com/search?sourceid=navclient&hl;=en&q;="

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/10 11:11:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/10 11:11:03 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b7\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 7\components [2011/02/07 12:51:06 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0b7\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 7\plugins [2011/02/16 09:44:48 | 000,000,000 | —D | M]

[2010/09/07 20:38:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\solitario\Application Data\Mozilla\Extensions
[2011/03/16 14:31:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions
[2010/09/10 11:22:14 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/13 21:41:05 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2011/03/16 14:29:31 | 000,000,000 | —D | M] (TableTools (T2F3)) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{7C7F5C11-4ACD-4CDB-9293-2E3F46654E2A}
[2011/03/16 14:29:31 | 000,000,000 | —D | M] (ImTranslator) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}
[2011/03/16 14:31:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\extensions\staged-xpis
[2010/12/20 14:39:20 | 000,002,523 | —- | M] () – C:\Documents and Settings\solitario\Application Data\Mozilla\Firefox\Profiles\w97afgrq.default\searchplugins\google-ssl.xml
[2011/03/16 14:29:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/06 06:41:11 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/11/06 06:40:19 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/11/06 06:40:15 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2004/08/04 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [Mobile Connectivity Suite] C:\Program Files\HTC\HTC Sync\Application Launcher\Application Launcher.exe (Teleca Sweden AB)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (SigmaTel, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe (Adobe Systems Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 [removed]
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\solitario\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\solitario\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/09/06 15:35:19 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{04b07aa7-e5ff-11df-aa78-001a6b318d94}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\{b32aad2a-bced-11df-8715-001a6b318d94}\Shell - "" = AutoRun
O33 - MountPoints2\{b32aad2a-bced-11df-8715-001a6b318d94}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b32aad2a-bced-11df-8715-001a6b318d94}\Shell\AutoRun\command - "" = G:\TL-Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/03/19 11:20:37 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\solitario\Desktop\OTL.exe
[2011/03/15 15:15:57 | 000,000,000 | —D | C] – C:\Documents and Settings\solitario\My Documents\TJS Consulting

========== Files - Modified Within 30 Days ==========

[2011/03/19 11:22:00 | 000,000,613 | —- | M] () – C:\WINDOWS\tasks\OnlineBackupManager.job
[2011/03/19 11:20:38 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\solitario\Desktop\OTL.exe
[2011/03/19 11:15:37 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/03/19 11:13:51 | 000,000,236 | —- | M] () – C:\WINDOWS\tasks\OGALogon.job
[2011/03/19 11:12:55 | 000,000,316 | -HS- | M] () – C:\WINDOWS\tasks\Etjnbx.job
[2011/03/19 11:12:26 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/03/18 20:45:48 | 000,436,704 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/18 20:45:48 | 000,069,076 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/18 13:41:39 | 000,000,356 | —- | M] () – C:\WINDOWS\tasks\Windows Codec Update Service.job
[2011/03/17 15:03:14 | 000,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-790525478-725345543-1003UA.job
[2011/03/17 15:03:13 | 000,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-790525478-725345543-1003Core.job
[2011/03/17 12:45:17 | 000,296,448 | —- | M] () – C:\Documents and Settings\solitario\Desktop\vj97yvzh.exe
[2011/03/17 12:04:17 | 000,002,316 | —- | M] () – C:\Documents and Settings\solitario\Desktop\Google Chrome.lnk
[2011/03/17 12:04:17 | 000,002,294 | —- | M] () – C:\Documents and Settings\solitario\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/16 14:16:36 | 000,105,472 | RHS- | M] () – C:\WINDOWS\System32\msdtcprf4.dll
[2011/03/12 22:06:30 | 000,012,288 | —- | M] () – C:\Documents and Settings\solitario\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/03/12 18:48:44 | 000,130,315 | —- | M] () – C:\Documents and Settings\solitario\Desktop\PTI-ENERGY+ for Fuel Oil.pdf
[2011/03/12 16:23:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/11 16:41:58 | 000,002,291 | —- | M] () – C:\Documents and Settings\All Users\Desktop\LinkedIn Contacts Manager.lnk
[2011/03/10 04:04:16 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/02/25 01:29:31 | 000,000,000 | —- | M] () – C:\WINDOWS\DbgOut.INI

========== Files Created - No Company Name ==========

[2011/03/17 12:45:15 | 000,296,448 | —- | C] () – C:\Documents and Settings\solitario\Desktop\vj97yvzh.exe
[2011/03/16 14:16:36 | 000,000,316 | -HS- | C] () – C:\WINDOWS\tasks\Etjnbx.job
[2011/03/16 14:16:35 | 000,105,472 | RHS- | C] () – C:\WINDOWS\System32\msdtcprf4.dll
[2011/03/12 18:48:39 | 000,130,315 | —- | C] () – C:\Documents and Settings\solitario\Desktop\PTI-ENERGY+ for Fuel Oil.pdf
[2011/02/25 01:29:31 | 000,000,000 | —- | C] () – C:\WINDOWS\DbgOut.INI
[2011/01/06 18:37:14 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\adistres.dll
[2010/12/08 11:31:11 | 000,074,752 | —- | C] () – C:\WINDOWS\System32\jst.dll
[2010/12/08 11:31:10 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\PMLJNI.dll
[2010/12/08 11:29:14 | 000,000,841 | —- | C] () – C:\WINDOWS\hpbvnstp.ini
[2010/12/08 11:27:23 | 000,012,299 | —- | C] () – C:\WINDOWS\hplj1320.ini
[2010/09/15 10:47:25 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/09/10 20:26:34 | 000,012,288 | —- | C] () – C:\Documents and Settings\solitario\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/09 20:53:18 | 000,127,264 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/09/09 16:30:09 | 000,176,235 | —- | C] () – C:\WINDOWS\System32\Primomonnt.dll
[2010/09/09 11:28:13 | 000,068,270 | —- | C] () – C:\WINDOWS\hpoins05.dat
[2010/09/09 11:28:12 | 000,019,696 | —- | C] () – C:\WINDOWS\hpomdl05.dat
[2010/09/08 19:39:24 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/09/07 20:38:20 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/09/07 12:13:18 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2010/09/07 12:13:17 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2010/09/07 12:13:17 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/09/06 20:39:40 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4814.dll
[2010/09/06 15:39:01 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/09/06 15:31:34 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/09/06 10:43:11 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/09/06 10:41:49 | 000,282,928 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/06 10:20:02 | 000,065,344 | —- | C] () – C:\WINDOWS\System32\PDFreDirectMonNT.dll
[2009/12/20 21:42:18 | 000,000,314 | —- | C] () – C:\WINDOWS\primopdf.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC Remove.exe
[2008/04/13 20:12:36 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\spdwnwxp.exe
[2005/03/21 19:48:05 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2005/03/21 19:48:05 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 06:00:00 | 000,436,704 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 06:00:00 | 000,069,076 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/04/02 07:01:22 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\HPB1320V.DLL
[2004/02/09 11:21:38 | 000,000,319 | —- | C] () – C:\WINDOWS\System32\HPB1320V.DAT
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/31 04:17:12 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL

========== LOP Check ==========

[2010/10/05 14:51:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DigiData
[2010/12/06 19:08:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GoldMine
[2010/12/31 15:17:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HTC
[2010/12/06 18:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PDF reDirect
[2010/12/31 15:17:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Teleca
[2011/02/07 12:54:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/12/01 21:07:24 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\Auslogics
[2010/10/05 14:51:56 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\DigiData
[2011/01/06 18:35:06 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\InterTrust
[2010/12/06 18:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\PDF reDirect
[2010/12/06 17:46:31 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\PrimoPDF
[2010/12/31 15:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\Teleca
[2011/02/07 14:53:42 | 000,000,000 | —D | M] – C:\Documents and Settings\solitario\Application Data\webex
[2011/03/19 11:12:55 | 000,000,316 | -HS- | M] () – C:\WINDOWS\Tasks\Etjnbx.job
[2011/03/19 11:13:51 | 000,000,236 | —- | M] () – C:\WINDOWS\Tasks\OGALogon.job
[2011/03/19 11:22:00 | 000,000,613 | —- | M] () – C:\WINDOWS\Tasks\OnlineBackupManager.job
[2011/03/18 13:41:39 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\Windows Codec Update Service.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/09/06 15:35:19 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/12/08 11:57:34 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/09/06 15:35:19 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/09/06 15:35:19 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/06 15:35:19 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/09/07 18:51:57 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/03/19 11:11:45 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys
[2010/12/08 11:54:17 | 000,000,007 | —- | M] () – C:\statusclient.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/09/06 15:34:45 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 08:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/10/23 13:51:42 | 000,273,408 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpcpp6de.DLL
[2004/04/15 13:43:08 | 000,061,952 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\HPZPP041.DLL
[2007/04/09 13:23:54 | 000,028,552 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2008/07/06 06:50:04 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2011/02/08 14:31:07 | 000,001,666 | -H– | M] () – C:\Documents and Settings\solitario\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/09/06 10:40:51 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/09/06 10:40:51 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/09/06 10:40:51 | 000,913,408 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2010/10/19 10:31:10 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2010/10/19 10:31:10 | 000,001,563 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2010/09/06 15:35:29 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2011/02/13 14:17:41 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-17 15:57:08


< MD5 for: EXPLORER.EXE >
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe

< MD5 for: EXPLORER.EXE-082F38A9.PF >
[2011/03/19 11:14:16 | 000,085,208 | —- | M] () MD5=DEA223D6E0EA1A6BEBD92ADEB4E4080D – C:\WINDOWS\Prefetch\EXPLORER.EXE-082F38A9.pf

< MD5 for: EXPLORER.SCF >
[2004/08/04 06:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.CHW >
[2010/09/07 20:30:11 | 000,153,185 | —- | M] () MD5=AB7F4DE8306C27B6ADE27390AA73CE82 – C:\WINDOWS\Help\iexplore.chw

< MD5 for: IEXPLORE.EXE >
[2008/04/13 20:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie8\iexplore.exe
[2008/04/13 20:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ServicePackFiles\i386\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui

< MD5 for: IEXPLORE.HLP >
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< MD5 for: WINLOGON.EXE-32C57D49.PF >
[2011/03/18 13:42:29 | 000,071,606 | —- | M] () MD5=EE8C3D8C029208ADF4712EAD5BF2E6DC – C:\WINDOWS\Prefetch\WINLOGON.EXE-32C57D49.pf

< End of report >
Post #6 last edited
Hi solo58,

If you clicked the save button after GMER finished you would have had to enter a name. If you gave the file a name it should have been saved to the same location that GMER was ran from. It looks like it was ran from your desktop. Have a look for a file there with the .log extension.

If you can't find it please run GMER in safe mode.

You can boot to Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual account.

No Extra.txt was produced because this wasn't the first time OTL was ran. We'll get one later.

I need some information on a file. We will use Virustotal Please submit these files for analysis

To submit a file to virustotal, please click on this link

Http://www.virustotal.com

copy and paste the following into the upload a file box

msdtcprf4.dll


scroll down a bit and click "send file", wait for the results and post them in your next reply.

Please note that sometimes the scans take a few minutes. Please ensure that the scan has completed and the results are complete.

Please post back with
  • GMER log
  • VirusTotal results
Thanks
Post #7
Here's the GMER Log in Safe Mode as Administrator.
I recall that when I ran this in the "Normal" mode, there were many many more entries.


GMER 1.0.15.15565 - http://www.gmer.net
Rootkit scan 2011-03-20 19:41:06
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK8009GAH rev.BQ001G
Running: p0sqvqo9.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kwxdipob.sys


—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\001a6b318d94
Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\001a6b318d94 (not active ControlSet)

—- EOF - GMER 1.0.15 —-
Post #8
In "Safe" Mode, the msdtcprf4.dll could not be found by virustotal. I ran a search through the computer and couldn't find the file either. Suggestion?
Post #12
Hi solo58,

Sorry I messed up the VirusTotal instructions

Copy and paste this into the send a file box

C:\WINDOWS\System32\msdtcprf4.dll


Let's see what MBAM removed. Open MBAM and click on the Logs tab. Form the list select the log that had the removals in it. Click on it and click open. Please post the contents of the log.

Please post
  • VirusTotal results
  • MBAM log
Let's see what we are dealing with before we start backing things up. If it's nasty enough there may be nothing worth keeping.
Post #13
Nothing would upload when I entered the file name. I couldn't find msdtcprf4.dll when I searched in the System32 folder…I checked "see hidden files". Here's the MBAM log. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6079 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 3/16/2011 3:13:04 PM mbam-log-2011-03-16 (15-13-04).txt Scan type: Quick scan Objects scanned: 145654 Time elapsed: 6 minute(s), 58 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 7 Memory Processes Infected: c:\WINDOWS\Tnekea.exe (Trojan.Downloader) -> 3100 -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\KCSCPW1HKH (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A9YA3MI1CF (Trojan.Downloader) -> Value: A9YA3MI1CF -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\Tnekea.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\Documents and Settings\solitario\Local Settings\Temp\Tle.exe (Trojan.Downloader) -> Delete on reboot. c:\Documents and Settings\solitario\Local Settings\Temp\Tld.exe (Trojan.Downloader) -> Delete on reboot. c:\documents and settings\solitario\local settings\Temp\Tlc.exe (Trojan.Downloader) -> Quarantined and deleted successfully. c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully. c:\WINDOWS\Tasks\{62c40aa6-4406-467a-a5a5-dfdf1b559b7a}.job (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\WINDOWS\Tasks\{bbaeaeaf-1275-40e2-bd6c-bc8f88bd114a}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
Post #14
I ran MAB again and found another trojan. Here's the log. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6121 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 3/21/2011 4:39:29 PM mbam-log-2011-03-21 (16-39-29).txt Scan type: Quick scan Objects scanned: 157528 Time elapsed: 24 minute(s), 20 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\A9YA3MI1CF (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #15 last edited
Hi solo58,

How is the computer now?


Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Files
C:\WINDOWS\tasks\Etjnbx.job
ipconfig /flushdns /c

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the OTL fix log.


Next
  • Open OTL.exe if it's not open after the reboot. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • UNCheck the boxes beside LOP Check and Purity Check.
  • In the Extra Registry section cgange it to All
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.


Please post back with
  • OTL fix log
  • both OTL logs
Any remaining issues?

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI