Saturday, April 29, 2006 10:35:52 PM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 30/04/2006
Kaspersky Anti-Virus database records: 179180
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 126038
Number of viruses found 5
Number of infected objects 9
Number of suspicious objects 0
Duration of the scan process 03:21:13
Infected Object Name Virus Name Last Action
C:\Documents and Settings\jason yang\Local Settings\Temporary Internet Files\Content.IE5\ADQTWH0N\OLD[1].CHM/old.htm Infected: Trojan-Downloader.VBS.Psyme.x skipped
C:\Documents and Settings\jason yang\Local Settings\Temporary Internet Files\Content.IE5\ADQTWH0N\OLD[1].CHM CHM: infected - 1 skipped
C:\Documents and Settings\jason yang\Local Settings\Temporary Internet Files\Content.IE5\KXMF0D6B\old[1].htm Infected: Exploit.HTML.Mht skipped
C:\Windows\Drivers.bat Infected: Trojan.BAT.Shutdown.f skipped
C:\WINNT\pf78.exe/data0002 Infected: Trojan-Downloader.Win32.VB.tw skipped
C:\WINNT\pf78.exe/data0003 Infected: Trojan.Win32.VB.tg skipped
C:\WINNT\pf78.exe/data0006 Infected: Trojan.Win32.VB.tg skipped
C:\WINNT\pf78.exe/data0007 Infected: Trojan.Win32.VB.tg skipped
C:\WINNT\pf78.exe NSIS: infected - 4 skipped
Scan process completed.
We have a little work left. Let's do the following:
Next navigate to the C:\Documents and Settings\(EVERY LISTED PROFILE USER) \Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply
STEP 1.
====== Delete Files with Killbox
Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard C:\Windows\Drivers.bat
C:\WINNT\pf78.exe/data0002
C:\WINNT\pf78.exe/data0003
C:\WINNT\pf78.exe/data0006
C:\WINNT\pf78.exe/data0007
C:\WINNT\pf78.exe
In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed (Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
- If not greyed out click the checkbox for Unregister .dll Before Deleting
- click End Explorer Shell while Killing File
- Now click on the red button with a white 'X' in the middle to delete the files
- Click Yes when it says all files will be deleted on the next reboot
- Click Yes when it asks if you want to reboot now
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)
Note: Killbox will let you know if a file does not exist. If that happens, just continue on.
If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.
Now run Kapersky again and see let's see if the infected files are gone.
KASPERSKY ON-LINE SCANNER REPORT
Sunday, April 30, 2006 4:18:26 PM
Operating System: Microsoft Windows 2000 Professional, Service Pack 4 (Build 2195)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 30/04/2006
Kaspersky Anti-Virus database records: 179295
Scan Settings
Scan using the following antivirus database standard
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
F:\
Scan Statistics
Total number of scanned objects 125669
Number of viruses found 1
Number of infected objects 1
Number of suspicious objects 0
Duration of the scan process 03:13:11
Infected Object Name Virus Name Last Action
C:\!KillBox\Drivers.bat Infected: Trojan.BAT.Shutdown.f skipped
Scan process completed.
Good work! Your Kapersky log looks fine. You can delete C:\!KillBox\Drivers.bat and empty the Recycle Bin. Killbox has confined and quarantined the Drivers.bat file but you might as well get rid of it.
The ewido trial will expire but you might as well keep it until then.
You need to have an anti-virus installed. Down below are some suggestions. Some anti-virus software is free to use for personal use. Also there is firewall software available for personal use too. You should not have to rely on Windows XP's firewall when there are others free for personal use.
STEP 1.
====== Cleanmgr
To clean temporary files:
Go > start > run and type cleanmgr and click OK
Scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
Click OK to remove those files.
Click Yes to confirm deletion.
STEP 2.( Windows XP only)
====== Prefetch Folder
Open C:\Windows\Prefetch\
Delete All files in this folder but not the Prefetch folder
STEP 3.
====== System Restore for Windows XP Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
STEP 4.
====== DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!
Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.
"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly.
For a tutorial on Firewalls and a listing of some available ones see the link below: Understanding and Using Firewalls
Test your Firewall - Please test your firewall and make sure it is working properly. Test Firewall
Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here: Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here: Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here: Using SpywareBlaster to protect your computer from Spyware and Malware
Update your Java to the latest version. Uninstall any and all versions you have listed in add/remove programs and install the latest version from here: http://www.java.com/en/
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
talk to later (much later i hope……dayam viruses stay away from me)