Instant Messenger Virus

I took care of the Freeprod. This Seems to be the end of this bugger.

hi,

good. heres some reference material for you:

All it takes is a few changes:


Make sure you keep your Windows OS current by visiting Windows update
occasionaly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

Also download, install and keep updated- Antivirus Software (and use only one):
Free for home users:
avast! 4 Home Edition Download
AVG free version 7.0
AntiVir Personal Edition

Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more:
Internet Explorer Privacy & Security Settings
Working with Internet Explorer 6 Security
Many exploits are directed at Internet Explorer, you dont have to use it. Try a different browser.
Like Firefox,
And Pegasus Mail for a safer e-mail, no tweaking needed.

Outlook Express with the default settings is not secure. It will run scripts, download images etc, just like a browser.
look here
and here


Install a firewall. A firewall will control what comes in from the internet and what leaves your computer to the internet. A firewall will also alert you when a application trys to connect to the internet from your computer, this is a good way to catch crapware or trojans, trying to connect out bound from your computer- whats that and why does it need a internet connection? You can deny it access it until more investigation is done. Zone Alarm is a free and easy to use firewall, that will provide in and outbound protection. Microsoft XP firewall only provides inbound protection. SP2 adds in and out bound protection which is better than nothing, but is not as robust as third party firewalls, Be sure to run only >one< firewall.If you use another, be sure to disable XP's built in firewall. If you use Zone Alarm learn what needs/uses your internet connection. If something unusal or out of the ordinary "asks" deny it access until more investigation is done.
Zone Alarm
Kerio Personal Firewall
Outpost Firewall
Sygate Personal Firewall
Tiny Firewall
BlackIce



Download one or two of these, install and update before using:(if these are constantly finding malware, then you need to make changes to your browser and or your habits)
CounterSpy Free trial version
Spybot Search and destroy
Ad-Aware SE Personal edition
Microsoft AntiSpyware (beta version)
Becarful with spyware "removers and scanners"– there are many "rogue/suspect" programs that "claim to remove" spyware.Check here first.

Other programs to consider:
Process Guard stop events/processes with user intervention
System Safety Monitor beta version stop events/processes with user intervention
SpywareBlaster add security to IE
IE-SPYAD adds adware peddlers sites/domains to IE restricted zone
CleanUp cleans out temps,history, autoforms etc

AntiTrojan software to fill in the gap:
a2 free
Ewido Security Suite
Trojan Hunter (30 day trial version)
TDS-3 trail version discontinued as of 07/05
Tauscan trial version


Learn More:
Browser Checkup
Parasite Free
Safe Hex
Shelf Lifes site
Home Computer Security
Wilders Security Advisors

Watch what you download, and where you download it from. Many programs come bundled with extra software.You may be installing more than you think. Make sure you understand what it is you will be downloading and installing to your computer. Visit the makers website, learn more about the program, Does the program you want come bundled with other "3rd party" programs? What do the 3rd party programs do? Will they deliver ads? Track your surfing habits?. Read the EULA agreement, you know, that paragraph of stuff you "agree to" before the software installs? If you search hard enough you can always find a "clean" alternative to any software. Stay away from warez and crack sites. Becarful what you download from file sharing networks. If you are not sure, scan it with your Antivirus app. A small file (in KB) is probably not what you think it is. Do you trust the source?

shelf life's File Sharing Tips:
Dont have it start with windows, if you see the icon it may be running
Dont run it 24/7
Limit bandwidth if possible. Isp's have bandwidth caps.no need to call attention to yourself,besides running wide open will affect your download/upload activity.
Dont share a huge amount of files
Random is good, stay out of sharing rooms
Scan downloads with AV/antitrojan apps before launching

THANKS SO MUCH!

hey there! 1 sec. There may be something else you need to look over. I need to figure something out! Please watch this thread for a few more days. Thanks alot wng

reply Also Freeprod is still there.

hi Chasmed,

lets start with this:

download and run this Aimfix:

http://www.jayloden.com/VirusClean.htm

reboot computer once after running aimfix

next run a updated ewido and save the log file like before.

last: rescan with hjt, and post anew log along with the ewido log……….shelf life

SetPrivilege successfully set SeDebug rights AIMFIx version: 1.3.1612.1517 Setting security privileges for AIMfix… First, closing any running copies of AOL Instant Messenger (aim.exe): Process C:\PROGRA~1\AIM95\aim.exe found Process C:\PROGRA~1\AIM95\aim.exe killed ***ANY VIRUS FILES REMOVED WILL BE LISTED BELOW*** ***RUN COMPLETED. ANY FILES REMOVED LISTED ABOVE*** ———————————————————- SetPrivilege successfully set SeDebug rights AIMFIx version: 1.3.1612.1517 Setting security privileges for AIMfix… First, closing any running copies of AOL Instant Messenger (aim.exe): ***ANY VIRUS FILES REMOVED WILL BE LISTED BELOW*** ***RUN COMPLETED. ANY FILES REMOVED LISTED ABOVE***\ ———————————————————- Right now every time I go to Add/Remove and try to delete "freeprod" the window blinks then comes back and freeprod is still there.

——————————————————— ewido security suite - Scan report ——————————————————— + Created on: 2:55:00 PM, 12/18/2005 + Report-Checksum: F122ABA4 + Scan result: C:\WINDOWS\NDNuninstall4_80.exe -> Spyware.NewDotNet : Ignored HKLM\SOFTWARE\Pinfo -> Dialer.Generic : Cleaned with backup HKLM\SOFTWARE\Pinfo\Dialers -> Dialer.Generic : Cleaned with backup HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo -> Dialer.Generic : Cleaned with backup HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers -> Dialer.Generic : Cleaned with backup HKU\S-1-5-21-2027339946-1085806099-568186159-500\Software\Pinfo\Dialers\Lisa -> Dialer.Generic : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@2o7[2].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> Spyware.Cookie.Specificclick : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@centrport[1].txt -> Spyware.Cookie.Centrport : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\[removed][1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@paycounter[1].txt -> Spyware.Cookie.Paycounter : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@statcounter[1].txt -> Spyware.Cookie.Statcounter : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@tribalfusion[2].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@xxxcounter[1].txt -> Spyware.Cookie.Xxxcounter : Cleaned with backup ::Report End

hi Chasmed,

you might want to copy this to a text file so you can get to it in safe mode
lets try this: first update your ewido security, but dont run it yet.
next;
Please download this LQfix.zip tool from here:

http://www.downloads.subratam.org/LQfix.zip
Unzip it to the desktop but do NOT run it yet.
—————————————————————
Next, please reboot your computer in Safe Mode by doing the following:

Restart your computer, tap the f8 key. from the options screen, select SAFE MODE
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.

Once in Safe Mode, please run the LQfix.bat file

after it completes— also run ewido in safe mode. save the log ewido log.

now uninstall freepod via add/remove programs panel

after ewido and still in safe mode look for these, if found delete them:

c:\windows\System32\ mc-62-602-0000156
c:\windows\System32 mc-58-12-0000166
C:\Windows\System32\lockx.exe
—————————–
reboot computer normally, let me know how its going, rescan and post a new hjt log….

shelf life
——————————————

Once AGAIN delinquent. Booted in Safemode with Network. Followed your advice in the previous post. LQfix found noting. E-wido found 11 things. Mainly cookies and then one NewDotNet associated file. Deleted it.——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 1:29:31 AM, 1/23/2006 + Report-Checksum: 1F259329 + Scan result: C:\Documents and Settings\Administrator\Cookies\hendersonja@247realmedia[1].txt -> Spyware.Cookie.247realmedia : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@bluestreak[1].txt -> Spyware.Cookie.Bluestreak : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@casalemedia[1].txt -> Spyware.Cookie.Casalemedia : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@edge.ru4[1].txt -> Spyware.Cookie.Ru4 : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@msnportal.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@questionmarket[1].txt -> Spyware.Cookie.Questionmarket : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@revenue[1].txt -> Spyware.Cookie.Revenue : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\hendersonja@tribalfusion[1].txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup C:\Documents and Settings\Administrator\Cookies\[removed][2].txt -> Spyware.Cookie.Burstbeacon : Cleaned with backup C:\WINDOWS\NDNuninstall4_80.exe -> Spyware.NewDotNet : Cleaned with backup ::Report End I also took the liberty of running Housecall and Pandaactive scan. Housecall took care of most of what it found. There were two things it did not take care of but I accidently closed the window. I am running it again and will post as soon as I can with the results. As for Panda Incident Status Location Spyware:Cookie/24/7 Realmedia Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@247realmedia[1].txt Spyware:Cookie/2o7.net Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@2o7[1].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@adultfriendfinder[1].txt Spyware:Cookie/Ask Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@ask[1].txt Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@bluestreak[1].txt Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@casalemedia[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@cgi-bin[1].txt Spyware:Cookie/go Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@go[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@questionmarket[1].txt Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@revenue[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@tribalfusion[1].txt Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Administrator\Cookies\[removed][2].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Administrator\Cookies\hendersonja@zedo[1].txt Potentially unwanted tool:Application/MyWay Not disinfected C:\Documents and Settings\Administrator\Desktop\Alan\backups\backup-20050825-151638-818.inf Spyware:Cookie/Tickle Not disinfected C:\RECYCLER\NPROTECT\00095564.TXT Spyware:Cookie/Tickle Not disinfected C:\RECYCLER\NPROTECT\00095565.TXT Spyware:Cookie/Powerscan Not disinfected C:\RECYCLER\NPROTECT\00095845.TXT Spyware:Cookie/Kazaa Networks Not disinfected C:\RECYCLER\NPROTECT\00095906.TXT Spyware:Cookie/Hypercount Not disinfected C:\RECYCLER\NPROTECT\00095916.TXT Spyware:Cookie/Kazaa Networks Not disinfected C:\RECYCLER\NPROTECT\00095925.TXT Spyware:Cookie/Tickle Not disinfected C:\RECYCLER\NPROTECT\00095942.TXT Spyware:Cookie/Powerscan Not disinfected C:\RECYCLER\NPROTECT\00095962.TXT Spyware:Cookie/RealMedia Not disinfected C:\RECYCLER\NPROTECT\00097095.TXT Spyware:Spyware/New.net Not disinfected C:\WINDOWS\NDNuninstall4_80.exe Spyware:application/bestoffer Not disinfected C:\WINDOWS\smdat32m.sys Virus:Trj/Downloader.Q Disinfected C:\WINDOWS\SYSTEM32\randomiser.exe

hi Chasmed, its been awhile, do this: Go to: Start> Run And type this in: C:\windows\prefetch Once this is open Delete everything inside the folder that you can. —————————————— also one more download, f-secure backlight, get the latest definitions 14-dec-2005 save it somewhere than scan with it. post a updated hjt log shelf life

129 items in prefetch and all deleted. Urlmap.exe-2A71A1E4.pf recreated itself in a matter of seconds.

hi Chasmed,

recreated itself in a matter of seconds

no problem, url.exe seems to be part of MS Money, and the .pf stands for prefetch. the prefetch folder is suppose to speed the boot process, no harm in deleting stuff from it.
did you run F-secure backlight yet?

I have not run F-secure Backlight. What is it?