Help with log please

The rootkitreveal.txt is sloppy but it's the best I could get it.




1. Run this removal tool from Symantec



Symantec Trojan.Abwiz.F Removal Tool 1.0.0

C:\WINDOWS\system32\zlbw.dll: (deleted)

Trojan.Abwiz.F has been successfully removed from your computer!

Here is the report:

The total number of the scanned files: 40594
The number of deleted threat files: 1
The number of threat processes terminated: 0
The number of registry entries fixed: 0


2.Run Rootkit Revealer

HKLM\S-1-5-21-1269165312-2274917715-1955080395-1006\RemoteAccess\InternetProfile 7/20/2005 9:13 AM 3 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\webcal\URL Protocol 5/27/2005 4:06 AM 13 bytes Data mismatch between Windows API and raw hive data.
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Scans\History\Results\Quick\{961B4A0B-D7BE-4DA1-B7A1-591BCF53AFFD} 10/8/2006 12:05 AM 4.73 KB Visible in directory index, but not Windows API or MFT.
C:\Documents and Settings\NetworkService\Local Settings\Temp\MpCmdRun-47-421CFC91-A93E-42AB-A35C-F06F127FCC44.lock 10/7/2006 11:53 PM 0 bytes Hidden from Windows API.
C:\WINDOWS\Temp\MpCmdRun.log 10/7/2006 11:53 PM 539 bytes Hidden from Windows API.
C:\WINDOWS\Temp\TMP0000002AC43C6566326DBC92 10/7/2006 11:53 PM 512.00 KB Visible in Windows API, MFT, but not in directory index.



3. Run Panda again


Incident Status Location

Virus:trj/clicker.ha Disinfected Operating system
Adware:adware/adsmart Not disinfected c:\windows\system32\kernels8.exe
Virus:trj/jupillites.a Disinfected Operating system
Virus:trj/abwiz.a Disinfected Operating system
Virus:w32/locksky.bu.worm Disinfected Operating system
Hacktool:rootkit/taskdirhide Not disinfected c:\windows\system32\taskdir.exe
Virus:w32/locksky.au.worm Disinfected Operating system
Adware:adware/bravesentry Not disinfected c:\windows\desktop.html
Adware:adware/cws.yexe Not disinfected c:\windows\Inet20004
Spyware:spyware/virtumonde Not disinfected Windows Registry
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Angie\Cookies\angie@go[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Angie\Local Settings\Temp\Cookies\angie@go[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Todd\Desktop\TCoyotehelp\SmitfraudFix\Process.exe
Spyware:Cookie/DriveCleaner Not disinfected C:\WINDOWS\system32\config\systemprofile\Cookies\system@drivecleaner[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\WINDOWS\system32\config\systemprofile\Cookies\[removed][2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\WINDOWS\system32\config\systemprofile\Cookies\[removed][1].txt

Tweber,

Lets give your system a good cleaning.


* Clean out your Temp Files
* This procedure should be run from Safemode for better results.


Boot into Safemode

* Go to Start> Shut off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to Safemode
* Then press the Enter Key on your Keyboard




* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.



Reboot your system normally


Close any instance of Internet Explorer and Windows Explorer.

• Go to Start> Control Panel> Internet Options . You shoud be on the General Tab
• Delete Cookies
• Delete Files > and offline content as well

Now Empty your Recycle Bin


System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

• Right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

• Right-click My Computer.
• ClickProperties.
• Click the System Restore tab.
• UN-Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

• Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
  You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this

Run this other cleaner, make sure you also run the Issues Scan
If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner



Remove these with Kill box….as All Files..

c:\windows\desktop.html
c:\windows\Inet20004
c:\windows\system32\kernels8.exe
c:\windows\system32\taskdir.exe



Download the trial version of Spy Sweeper from Here

Scroll to the bottom of the page and be sure to download and install the Free 5.0 Trial and not t the free online scan.

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

You will be prompted to check for updated definitions, please do so.
(This may take several minutes)

Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C.
Under What to Sweep, check every box.

Click on Sweep and allow it to fully scan your system.

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

Exit Spy Sweeper.

Restart your computer, and then please copy and paste the SpySweeper log into this thread along with a new HJT log.

Tweber,

I would uninstall Spysweeper since it does use some system resources, the rest of your log looks fine So I think at this point we will leave well enough alone. But like I posted before, I will leave this thread open for you for a while in case this pops up again. So just use your computer normally and lets see if it comes back. You did mention that you do online banking, be sure to change your password and any other passwords that you use for shopping online.


My thoughts about the whole thing are that those two files in the npp folder by themselves where fine but them being in that folder were bogus. The purpose of the npp foleder is this
this can be used to gather information from a remote computer and I am thinking that the reason those files were placed there by malware was to be able to redownload it again. But thats all gone now and I don't think you will have that problem again.


Ken……who can now go finish his beer

I think your right. I've stopped getting all the issues that I was before and the system is running smooth. As I stated the first time I appreciate the professional and prompt help I received. This site and it's people are great! I've only been registered a short time but I've been using the forums to guide me through other fixes for a while. Enjoy that beer, you've more than earned it. Just don't drive anywhere My best to you.

Your more than welcome, glad to be able to help you

Forgot to mention this, forgive me..


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

System Restore <– Do this first to prevent reinfecting yourself.
TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


Since everything seems ok, I am going to close this thread.

Ken

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php