What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

i'm all messed my up

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
New to here so please forgive me if I have not done everything I am supposed to do first.

I've already used spysweeper, spybot s&d, ad-aware se, and ewido, spyware blaster. I am still getting trojans and pop-ups.


Logfile of HijackThis v1.99.1
Scan saved at 10:27:27 PM, on 5/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\IAMAPP.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Invisible Browsing\InvisibleBrowsing.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Mike\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
O2 - BHO: Windows Resources - {2D38A51A-23C9-48a1-A33C-48675AA2B494} - (no file)
O2 - BHO: (no name) - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\SYMANT~1\SYMANT~2\IAMAPP.EXE
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [InvisibleBrowsing] C:\Program Files\Invisible Browsing\InvisibleBrowsing.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZU
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: winuqw32 - winuqw32.dll (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Symantec Client Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
O23 - Service: Symantec Client Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Client Firewall Proxy Service (SymPxSvc) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
Post #2
Hello needsumhelp and Welcome to TomCoyote,

Please do the following:

Disable SpySweeper:
You have SpySweeper installed. While this is a great program, we need to temporarily disable (not uninstall) the program because it might stop our fix.
  • Open it click >Options over to the left then >program options>Uncheck "load at windows startup"
  • Over to the left click "shields" and uncheck all there.
  • Uncheck" home page shield".
  • Uncheck ''automatically restore default without notification".
After all of the fixes are complete it is very important that you enable SpySweeper again.

Please set your system to show all files; please see here if you're unsure how to do this.

Scan with HijackThis. Place a check against each of the following:
O2 - BHO: Windows Resources - {2D38A51A-23C9-48a1-A33C-48675AA2B494} - (no file)
O2 - BHO: (no name) - {b0398eca-0bcd-4645-8261-5e9dc70248d0} - (no file)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…arch.jhtml?p=ZU
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/YazzleActiveX.cab?refid=1162
O20 - Winlogon Notify: winuqw32 - winuqw32.dll (file missing)
Close all windows or browsers except for Hijackthis. Click on Fix Checked when finished and exit HijackThis.

Now run this online scan using Internet Explorer:
Kaspersky WebScanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.

Post (reply) with the results from Kapersky and a fresh HijackThis log and we will take another look.
Post #3
—————————————————————–

————-
KASPERSKY ON-LINE SCANNER REPORT
Tuesday, May 16, 2006 12:45:03 PM
Operating System: Microsoft Windows XP Professional, Service Pack

2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 16/05/2006
Kaspersky Anti-Virus database records: 182583
——————————————————————

————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan Statistics:
Total number of scanned objects: 45698
Number of viruses found: 4
Number of infected objects: 23
Number of suspicious objects: 0
Duration of the scan process: 00:53:01

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Mike\Local

Settings\Temp\perfectnavUninstall.exe/data0003 Infected:

Trojan-Downloader.Win32.Keenval.f skipped
C:\Documents and Settings\Mike\Local

Settings\Temp\perfectnavUninstall.exe NSIS: infected - 1

skipped
C:\Documents and Settings\Mike\Local

Settings\Temp\svshost.exe/data0002/data0006 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\Documents and Settings\Mike\Local

Settings\Temp\svshost.exe/data0002 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\Documents and Settings\Mike\Local Settings\Temp\svshost.exe

NSIS: infected - 2 skipped
C:\Documents and Settings\Mike\Local Settings\Temp\win4B6.tmp.exe

Infected: Trojan.Win32.Dialer.oy skipped
C:\WINDOWS\system32\ld9A49.tmp Infected:

Trojan-Downloader.Win32.Zlob.oq skipped
C:\WINDOWS\Temp\win417.tmp.exe/data0002/data0006 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win417.tmp.exe/data0002 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win417.tmp.exe NSIS: infected - 2 skipped
C:\WINDOWS\Temp\win474.tmp.exe Infected: Trojan.Win32.Dialer.oy

skipped
C:\WINDOWS\Temp\win481.tmp.exe Infected: Trojan.Win32.Dialer.oy

skipped
C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win6B.tmp.exe NSIS: infected - 2 skipped
C:\WINDOWS\Temp\win73.tmp.exe Infected: Trojan.Win32.Dialer.oy

skipped
C:\WINDOWS\Temp\win76.tmp Infected: Trojan.Win32.Dialer.oy

skipped
C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win7D.tmp.exe NSIS: infected - 2 skipped
C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win84.tmp.exe/data0002 Infected:

Trojan-Dropper.Win32.VB.kk skipped
C:\WINDOWS\Temp\win84.tmp.exe NSIS: infected - 2 skipped

Scan process completed.


Logfile of HijackThis v1.99.1
Scan saved at 12:46:18 PM, on 5/16/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\system32\LxrJD31s.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
C:\WINDOWS\system32\cleanmgr.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\IAMAPP.EXE
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Invisible Browsing\InvisibleBrowsing.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Mike\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll (file missing)
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [iamapp] C:\PROGRA~1\SYMANT~1\SYMANT~2\IAMAPP.EXE
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [InvisibleBrowsing] C:\Program Files\Invisible Browsing\InvisibleBrowsing.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lexar JD31 (LxrJD31s) - Unknown owner - C:\WINDOWS\SYSTEM32\LxrJD31s.exe
O23 - Service: Symantec Client Firewall Service (NISSERV) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISSERV.EXE
O23 - Service: Symantec Client Firewall Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\NISUM.EXE
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Symantec Client Firewall Proxy Service (SymPxSvc) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec Client Firewall\SymPxSvc.exe
Post #4
Let's work on those infected files.

Show Hidden Files
Please show all files for your system.
You will need to reverse this process when all steps are done.


Delete Files and Folders
Please delete the following files/folders:
C:\WINDOWS\system32\ld9A49.tmp<==file
If you have any problem deleting these items, reboot into Safe Mode (tap F8 during bootup, use arrow keys to select Safe Mode, then hit 'enter') and try again.

STEP 1.
======
Cleaning Files

Navigate to C:\Windows\Prefetch
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Note: If you cannot seem to navigate to the Temp folder above , use the Search feature and search on C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp\*.*


Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, click to select the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see an checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.

Please run Kapersky again and post the results.
Post #5
——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Thursday, May 18, 2006 1:21:11 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 18/05/2006 Kaspersky Anti-Virus database records: 182872 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 44414 Number of viruses found: 4 Number of infected objects: 23 Number of suspicious objects: 0 Duration of the scan process: 00:42:22 Infected Object Name / Virus Name / Last Action C:\WINDOWS\system32\dcomcfg.exe Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\WINDOWS\system32\regperf.exe Infected: Trojan-Downloader.Win32.Zlob.oq skipped C:\WINDOWS\system32\simpole.tlb Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\WINDOWS\Temp\win417.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win417.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win417.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win474.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win481.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win48C.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win4A7.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win73.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win76.tmp Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win88.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped C:\WINDOWS\Temp\win92.tmp.exe Infected: Trojan.Win32.Dialer.oy skipped Scan process completed.
Post #6
Hello needsumhelp

Thanks for the posts. This showed up which I see with the Smitfraud infections:
dcomcfg.exe

Let's do the Smitfraud fix

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

[external image: Posted Image]

______________________________

Please download the trial version of Ewido anti-malware 3.5 from here:
http://www.ewido.net/en/download/
  • Install Ewido anti-malware.
  • When installing, under Additional Options uncheck Install background guard and Install scan via context menu.
  • When you run Ewido for the first time, you could get a warning "Database could not be found!". Click Ok.
  • The program will prompt you to update. Click the Ok button.
  • The program will now go to the main screen.
You will need to update Ewido to the latest definition files.
  • On the left-hand side of the main screen click the Update Button.
  • Click on Start.
The update will start and a progress bar will show the updates being installed.
Once finished updating, close Ewido.

If you are having problems with the updater, you can use this link to manually update ewido.
Ewido manual updates. Make sure to close Ewido before installing the update.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter

[external image: Posted Image]

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.


Clean

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

[external image: Posted Image]


The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Clean out your Temporary Internet files. Proceed like this:
  • Quit Internet Explorer and quit any instances of Windows Explorer.
  • Click Start, click Control Panel, and then double-click Internet Options.
  • On the General tab, click Delete Files under Temporary Internet Files.
  • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
  • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
  • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
  • Click OK.
Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido, and run a full scan.
  • Click on Scanner
  • Click on Settings
    • Under How to scan all boxes should be checked
    • Under Unwanted Software all boxes should be checked
    • Under What to scan select Scan every file
    • Click on Ok
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections and put a checkmark in the box next to Create encrypted backup, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.
  • Click Save Report button
  • Save the report to your Desktop
Close Ewido and Reboot in Normal Mode.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing
Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________

Please post:
  • c:\rapport.txt
  • Ewido log
  • A new HijackThis log
Your may need several replies to post the requested logs, otherwise they might get cut off.
Post #7
——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Friday, May 19, 2006 1:53:30 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 19/05/2006 Kaspersky Anti-Virus database records: 183298 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 44587 Number of viruses found: 2 Number of infected objects: 13 Number of suspicious objects: 0 Duration of the scan process: 01:09:58 Infected Object Name / Virus Name / Last Action C:\WINDOWS\system32\simpole.tlb Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\WINDOWS\Temp\win417.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win417.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win417.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe NSIS: infected - 2 skipped Scan process completed. SmitFraudFix v2.45 Scan done at 19:20:50.42, Fri 05/19/2006 Run from C:\Documents and Settings\Mike\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Mike\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Mike\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End ——————————————————— ewido anti-malware - Scan report ——————————————————— + Created on: 4:13:15 PM, 5/19/2006 + Report-Checksum: ED075702 + Scan result: No infected objects found. ::Report End
Post #8 last edited
Let's try Killbox on those files.

======
Delete Files with Killbox

Download Pocket Killbox from http://www.downloads.subratam.org/KillBox.zip and unzip it; save it to your Desktop. DO NOT RUN IT YET.
==========
Double-click on KillBox.exe to launch the program. It is the red circle with a large white X in it
- Highlight the files in bold RED below and press the Ctrl key and the C key at the same time to copy them to the clipboard
C:\WINDOWS\system32\simpole.tlb
C:\WINDOWS\Temp\win417.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win417.tmp.exe/data0002
C:\WINDOWS\Temp\win417.tmp.exe
C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win6B.tmp.exe/data0002
C:\WINDOWS\Temp\win6B.tmp.exe
C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win7D.tmp.exe/data0002
C:\WINDOWS\Temp\win7D.tmp.exe
C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win84.tmp.exe/data0002
C:\WINDOWS\Temp\win84.tmp.exe

In Killbox click on the File menu and then the Paste from Clipboard item
in the Full Path of File to Delete field drop down the arrow and make sure that all of the files are listed
(Please note that the tool checks your computer for the presence of the files pasted into the box so if files are not present, it is possible that you might not see all files you pasted into the box.)
Click the option to Delete on Reboot
- If not greyed out click the checkbox for Unregister .dll Before Deleting
- click End Explorer Shell while Killing File
- Now click on the red button with a white 'X' in the middle to delete the files
- Click Yes when it says all files will be deleted on the next reboot
- Click Yes when it asks if you want to reboot now
(Note: If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just reboot manually)

Note: Killbox will let you know if a file does not exist. If that happens, just continue on.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the "Single File" button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click yes to allow the reboot.

Please run Kapersky and post (reply) with the results
Post #9
—————————————————————————— KASPERSKY ON-LINE SCANNER REPORT Thursday, May 25, 2006 1:23:24 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 25/05/2006 Kaspersky Anti-Virus database records: 184576 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 42319 Number of viruses found: 3 Number of infected objects: 15 Number of suspicious objects: 0 Duration of the scan process: 00:50:28 Infected Object Name / Virus Name / Last Action C:\!KillBox\win417.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\!KillBox\win417.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\!KillBox\win417.tmp.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000230.exe Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000231.exe Infected: Trojan-Downloader.Win32.Zlob.oq skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000243.tlb Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe NSIS: infected - 2 skipped Scan process completed.
Post #10
Hello needsumhelp,

Those files are still there. :rant2: Let's take advantage of using a software trial.

Trojan Hunter
  • Download the free trial version of TrojanHunter
  • Install (allow registry entry to be changed if necessary – THGuard) and update. You will get an evaluation notice – choose “Continue Evaluation”.
  • You will see window titled “TrojanHunter – UNLICENSED EVALUATION COPY”
    Click icon “Full Scan” and let it scan- this may take awhile
  • If you have Trojans then a window titled “Clean Trojans” will open after the scan.
  • Be sure the entries are checked and click the “Clean” button.
  • Go to the window “TrojanHunter – UNLICENSED EVALUATION COPY”
    Go the “File” on the top menu =>Save Scan Report”.
Please copy and paste the Scan Report in your reply.
Post #11
TrojanHunter Scan Registry scan No suspicious entries found Inifile scan No suspicious entries found Port scan No suspicious open ports found Memory scan No trojans found in memory File scan Found adware file: C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch.108) Error: Directory not found: C:\WINDOWS\system32\s?curity Error: Directory not found: C:\WINDOWS\W?nSxS 1 files identified
Post #12
Hello needsumhelp,

I am still bothered by the Kapersky results earlier. So let's use Blacklight to check for rootkits, run ewido, and Kapersky again and compare results please.

Download Blacklight Beta from here:
http://www.f-secure.com/blacklight/try.shtml
  • Hit I accept. It will take you to download page.
  • Download blbeta.exe and save it to the Desktop.
  • Once saved… double click blbeta.exe to install the program.
  • Click accept agreement and Click scan
    This app too may fire off a warning from antivirus. Let the driver load.
    Wait for it to finish.
  • If it displays any items…don't do anything with them yet. Just hit exit (close)
  • It will drop a log on Desktop that starts with fsbl….big number
Please post contents of log.
Now run this online scan using Internet Explorer:
Kaspersky WebScanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Standard
  • Scan Options:
  • Scan Archives
  • Scan Mail Bases
  • Click OK
  • Now under select a target to scan:
  • Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
Copy and paste that information from Kapersky in your next post.

Please run ewido again too.
Please post the results post contents of log that starts with fsbl….big number, Kapersky, and ewido.
Post #13
05/30/06 12:58:37 [Info]: BlackLight Engine 1.0.37 initialized 05/30/06 12:58:37 [Info]: OS: 5.1 build 2600 (Service Pack 2) 05/30/06 12:58:41 [Note]: 7019 4 05/30/06 12:58:41 [Note]: 7005 0 05/30/06 12:58:57 [Note]: 7006 0 05/30/06 12:58:59 [Note]: 7011 1432 05/30/06 12:59:00 [Note]: 7026 0 05/30/06 12:59:01 [Note]: 7026 0 05/30/06 13:00:28 [Note]: FSRAW library version 1.7.1015 05/30/06 13:16:50 [Note]: 7007 0 ——————————————————————————- KASPERSKY ON-LINE SCANNER REPORT Wednesday, May 31, 2006 12:31:49 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky On-line Scanner version: 5.0.78.0 Kaspersky Anti-Virus database last update: 30/05/2006 Kaspersky Anti-Virus database records: 185397 ——————————————————————————- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ F:\ Scan Statistics: Total number of scanned objects: 42777 Number of viruses found: 3 Number of infected objects: 15 Number of suspicious objects: 0 Duration of the scan process: 01:08:28 Infected Object Name / Virus Name / Last Action C:\!KillBox\win417.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\!KillBox\win417.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\!KillBox\win417.tmp.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000230.exe Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000231.exe Infected: Trojan-Downloader.Win32.Zlob.oq skipped C:\System Volume Information\_restore{9C3ADB37-4648-40D7-A522-29C3030F0E45}\RP6\A0000243.tlb Infected: Trojan-Downloader.Win32.Zlob.op skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win6B.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win7D.tmp.exe NSIS: infected - 2 skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe/data0002 Infected: Trojan-Dropper.Win32.VB.kk skipped C:\WINDOWS\Temp\win84.tmp.exe NSIS: infected - 2 skipped Scan process completed. ******** 12:48 PM: | Start of Session, Tuesday, May 30, 2006 | 12:48 PM: Spy Sweeper started 12:48 PM: Sweep initiated using definitions version 686 12:48 PM: Starting Memory Sweep 12:56 PM: Memory Sweep Complete, Elapsed Time: 00:07:40 12:56 PM: Starting Registry Sweep 12:57 PM: Registry Sweep Complete, Elapsed Time:00:01:00 12:57 PM: Starting Cookie Sweep 12:57 PM: Cookie Sweep Complete, Elapsed Time: 00:00:00 12:57 PM: Starting File Sweep 2:03 PM: Found System Monitor: potentially rootkit-masked files 2:03 PM: gen.dll (ID = 0) 2:03 PM: g20060417_1740.trf (ID = 0) 2:03 PM: g20060422_1609.trf (ID = 0) 2:03 PM: g20060429_0134.trf (ID = 0) 2:03 PM: g20060504_0530.trf (ID = 0) 2:03 PM: g20060510_1522.trf (ID = 0) 2:03 PM: g20060520_0846.trf (ID = 0) 2:03 PM: g20060528_2029.trf (ID = 0) 2:03 PM: g20060322_0800.trf (ID = 0) 2:03 PM: g20060331_0444.trf (ID = 0) 2:03 PM: liveupdate.exe (ID = 0) 2:03 PM: cumulative20060322.trf (ID = 0) 2:03 PM: g20060409_1917.trf (ID = 0) 2:03 PM: settings.ini (ID = 0) 2:03 PM: updatelist.txt (ID = 0) 2:03 PM: updatelist.txt (ID = 0) 2:03 PM: liveupdate.ini (ID = 0) 2:03 PM: m20060322_0800.trf (ID = 0) 2:11 PM: liveupdate.lnk (ID = 0) 2:11 PM: File Sweep Complete, Elapsed Time: 01:13:49 2:11 PM: Full Sweep has completed. Elapsed time 01:22:50 2:11 PM: Traces Found: 19 2:14 PM: Processing Startup Alerts 2:14 PM: Allowed Startup entry: THGuard ******** 12:48 PM: | Start of Session, Tuesday, May 30, 2006 | 12:48 PM: Spy Sweeper started 12:48 PM: | End of Session, Tuesday, May 30, 2006 |
Post #14
Please download The Avenger by Swandog46 to the Desktop.
Click on Avenger.zip to open the file
Then, extract avenger.exe to the Desktop

Next, copy all the blue text below to the Clipboard by highlighting it and pressing Ctrl+C:

Files to delete:
C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win6B.tmp.exe/data0002
C:\WINDOWS\Temp\win6B.tmp.exe
C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win7D.tmp.exe/data0002
C:\WINDOWS\Temp\win7D.tmp.exe
C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006
C:\WINDOWS\Temp\win84.tmp.exe/data0002
C:\WINDOWS\Temp\win84.tmp.exe

Folders to delete:
C:\WINDOWS\Temp\win6B.tmp.exe/data0002
C:\WINDOWS\Temp\win7D.tmp.exe/data0002
C:\WINDOWS\Temp\win84.tmp.exe/data0002

Start The Avenger program by clicking its icon on the Desktop.
Under: Script file to execute, select: Input Script Manually
Now click on the Magnifying Glass icon
It opens a new window titled: View/edit script
Paste the text copied to clipboard into this window by pressing Ctrl+V.
Click Done

Next, click on the Green Light to begin the execution of the script
Answer Yes twice when prompted.

The Avenger automatically does following:
Restarts the computer.
On reboot, briefly opens a black command window on the Desktop. This is normal.

After the restart, it creates a log that opens with the results of Avenger’s actions.
This log is located at C:\avenger.txt

Please provide C:\avenger.txt in your reply.
Post #15
ogfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\jawhkgwd ******************* Script file located at: \??\C:\WINDOWS\kfreyxtt.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Could not open file C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 for deletion Deletion of file C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 failed! Could not process line: C:\WINDOWS\Temp\win6B.tmp.exe/data0002/data0006 Status: 0xc0000033 Could not open file C:\WINDOWS\Temp\win6B.tmp.exe/data0002 for deletion Deletion of file C:\WINDOWS\Temp\win6B.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Status: 0xc0000033 File C:\WINDOWS\Temp\win6B.tmp.exe deleted successfully. Could not open file C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 for deletion Deletion of file C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 failed! Could not process line: C:\WINDOWS\Temp\win7D.tmp.exe/data0002/data0006 Status: 0xc0000033 Could not open file C:\WINDOWS\Temp\win7D.tmp.exe/data0002 for deletion Deletion of file C:\WINDOWS\Temp\win7D.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Status: 0xc0000033 File C:\WINDOWS\Temp\win7D.tmp.exe deleted successfully. Could not open file C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 for deletion Deletion of file C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 failed! Could not process line: C:\WINDOWS\Temp\win84.tmp.exe/data0002/data0006 Status: 0xc0000033 Could not open file C:\WINDOWS\Temp\win84.tmp.exe/data0002 for deletion Deletion of file C:\WINDOWS\Temp\win84.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win84.tmp.exe/data0002 Status: 0xc0000033 File C:\WINDOWS\Temp\win84.tmp.exe deleted successfully. Could not open folder C:\WINDOWS\Temp\win6B.tmp.exe/data0002 for deletion Deletion of folder C:\WINDOWS\Temp\win6B.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win6B.tmp.exe/data0002 Status: 0xc0000033 Could not open folder C:\WINDOWS\Temp\win7D.tmp.exe/data0002 for deletion Deletion of folder C:\WINDOWS\Temp\win7D.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win7D.tmp.exe/data0002 Status: 0xc0000033 Could not open folder C:\WINDOWS\Temp\win84.tmp.exe/data0002 for deletion Deletion of folder C:\WINDOWS\Temp\win84.tmp.exe/data0002 failed! Could not process line: C:\WINDOWS\Temp\win84.tmp.exe/data0002 Status: 0xc0000033 Completed script processing. ******************* Finished! Terminate.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI