What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

TSPY Pakes Threat

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Here is the malwarebytes log, I will get to the Eset scan later tomorrow and post results. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6201 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 3/28/2011 11:47:43 PM mbam-log-2011-03-28 (23-47-43).txt Scan type: Quick scan Objects scanned: 222990 Time elapsed: 5 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #18
I've tried a few times, but it didn't work in IE or Chrome… for Chrome I had to download something and then run it but the update said Error 401 or something.
Post #19
Just to clarify, it always hangs (whether it be on IE or from my desktop) on the step where its trying to update virus data base. And I tried again and the exact error is: Unexpected Error 101 And I won't let me go any further
Post #20
Looks like it may be a corruption of the ESET files. While there is a fix, it's faster to just try a different online scanner instead.


Perform an online scan with Internet Explorer with Panda ActiveScan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, it should start to scan automatically
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to your desktop.
  • Post the report in your next reply.

Note: Turn off the real time scanner of any existing antivirus program while performing the online scan
Post #21
;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2011-04-06 06:49:14 PROTECTIONS: 1 MALWARE: 15 SUSPECTS: 2 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== AVG Anti-Virus Free 9.0 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No c:\documents and settings\class\cookies\class@atdmt[1].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No c:\documents and settings\class\cookies\class@fastclick[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\[removed][5].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\class\cookies\[removed][2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\[removed][3].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\nil@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\nil@apmebf[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\nil@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\[removed]-sys[2].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\nil@go[2].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No c:\documents and settings\class\cookies\class@go[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No c:\documents and settings\nil\cookies\nil@go[1].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No c:\documents and settings\class\cookies\class@atwola[2].txt 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\upgrade3.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\upgrade2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017577.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017578.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017579.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017580.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017581.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017582.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017583.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017584.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017585.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017586.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017587.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017588.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017589.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017590.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017591.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017592.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017593.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017594.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017595.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017596.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017597.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017598.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017599.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017600.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017601.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017602.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017603.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017604.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017621.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017622.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017623.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017626.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017627.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017628.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017629.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017633.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017635.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017636.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017643.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\a0017644.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccfwcli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccfwcli0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccfwcli1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccfwcli2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccfwcli3.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cchwcli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cchwcli0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cchwcli1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cchwcli2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cchwcli3.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccpwcli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccpwcli0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccpwcli1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccpwcli2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccregcl0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccregcl1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccregcl2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccregcl3.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccregcli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccspycl0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccspycl1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccspycl2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\ccspycli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cczcli.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cczcli_0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cczcli_1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cczcli_2.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\cczcli_3.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\edbgjit.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\edm.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\edm____0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\edm____1.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\emulatorstub.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\netcflaunc0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\netcflaunch.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\upgrade.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\upgrade0.exe 00467541 W32/Sality.AN Virus No 0 Yes No c:\documents and settings\nil\doctorweb\quarantine\upgrade1.exe 03266590 Generic Trojan Virus/Trojan No 0 Yes No c:\program files\soliddocuments\solidconverterpdf\scpdf\patch.exe 04753203 Generic Trojan Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\eventlog.dll.vir 05551546 Trj/Krap.Ag Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\msa.exe.vir 06908829 Trj/Pupack.A Virus/Trojan No 0 Yes No c:\program files\elaborate bytes\clonedvd2\patch.exe 07484589 Exploit/ByteVerify HackTools No 0 Yes No c:\documents and settings\nil\application data\sun\java\deployment\cache\6.0\33\30feb821-4094f4af[vmain.class] 07484590 Exploit/ByteVerify HackTools No 0 Yes No c:\documents and settings\nil\application data\sun\java\deployment\cache\6.0\33\30feb821-4094f4af[________vload.class] ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================= =================== No c:\documents and settings\all users\application data\skype\plugins\plugins\15369f80f920484eabee8ccb11d0565f\vodburner\refine.exe No c:\program files\tunebite\tunebiteplatinumeditionv40010_crack.exe ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= ===================
Post #22
The following will implement some cleanup procedures as well as reset System Restore points:
  • Click Start > Run
  • Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]

If you find any remaining tools or logs on your desktop you can right-click and delete them.



Download ATF Cleaner by Atribune.
Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


There are no logs to post after doing these steps. Just let me know when they are done. Is the machine running ok now?
Post #24
It didnt let me uninstall, it said it was not found so I must have deleted it myself. I used that other program as well to clear everything. So far the system seems to be running fine. I just wanted to make sure with you that no keyloggers or any other viruses weren't found in the logs, because I need to reset my passwords for the email that got hacked?
Post #25
I'd like to try one more time to get the ESET scan as some antivirus programs can affect how it run. Please follow the below instructions noting the information that must be selected in advanced options.

Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\Eset\Eset Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic and also let me know how things are now.
Post #26
Are you having any trouble with the last set of instructions? Were you able to get ESET to run? Reminder: Threads with no reply in 3 days will be closed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI