Someone tells me that when they get email from me their system tells them my pc has a worm. I've just ran Adaware and Spybot then rebooted. Log file is attached. I uninstalled BearFlix and BearShare but I still see something like that in the log file. Thank you for your help!
Kathy
================================================
Logfile of HijackThis v1.99.1
Scan saved at 5:21:03 PM, on 11/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
The fixes we will use are specific to your problems and should only be used for this issue on this machine.
Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time. If you have any questions about any advice given here please STOP and ask!
______________________________ HJT
Run hijackthis and choose scan only and place a check by the following lines if present. Close all other windows and browsers except HJT before clicking on Fix Checked
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O20 - AppInit_DLLs: ?A ?th
_________________________________
Please do an online scan with Kaspersky Online Scanner
Click on Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
Scan using the following Anti-Virus database:
Extended (If available otherwise Standard)
Scan Options: Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.
Here is the information you requested…Hopefully I did this correctly
Kaspersky online had trouble with their web site yesterday was not able to scan until yesterday evening
Thank you for your help
Kathy
KASPERSKY ONLINE SCANNER REPORT
Thursday, November 30, 2006 5:36:28 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 30/11/2006
Kaspersky Anti-Virus database records: 246781
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
Scan Target My Computer
A:\
C:\
D:\
E:\
Scan Statistics
Total number of scanned objects 29843
Number of viruses found 2
Number of infected objects 12 / 0
Number of suspicious objects 0
Duration of the scan process 02:02:27
Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\d73300b09e541190dc5668e040328bec_b56b1858-753e-4edc-aa7f-912f6a6ad2d3 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\user.dmp Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Application Data\Aim\azcrtfai\scoop6066\cert8.db Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Application Data\Aim\azcrtfai\scoop6066\key3.db Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\cleanup.log Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Folders.dbx Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Inbox.dbx Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Offline.dbx Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Pop3uidl.dbx Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Sent Items.dbx/[From "Kathy Hipp" ][Date Mon, 20 Nov 2006 10:13:26 -0600]/UNNAMED/Update-KB4873-x86.zip/Update-KB4873-x86.exe Infected: Email-Worm.Win32.Warezov.ev skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Sent Items.dbx/[From "Kathy Hipp" ][Date Mon, 20 Nov 2006 10:13:26 -0600]/UNNAMED/Update-KB4873-x86.zip Infected: Email-Worm.Win32.Warezov.ev skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Sent Items.dbx/[From "Kathy Hipp" ][Date Mon, 20 Nov 2006 10:13:26 -0600]/UNNAMED Infected: Email-Worm.Win32.Warezov.ev skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Identities\{AF7F885E-9331-4B1D-8855-5ACF32E17955}\Microsoft\Outlook Express\Sent Items.dbx Mail MS Outlook 5: infected - 3 skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Temp\Perflib_Perfdata_c88.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Temp\~DF8920.tmp Object is locked skipped
C:\Documents and Settings\Kathy Hipp\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Kathy Hipp\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Kathy Hipp\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\billing_Kathy Hipp.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\client_Kathy Hipp.log Object is locked skipped
C:\Program Files\Yahoo!\Messenger\logs\network_Kathy Hipp.log Object is locked skipped
C:\System Volume Information\_restore{7F4B61B0-13A2-4ADA-8D86-47397943DC46}\RP188\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{75D8F54F-9EBF-4C3B-BFB1-8A0B68CCF84E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
Logfile of HijackThis v1.99.1
Scan saved at 5:43:30 AM, on 11/30/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.
Set Cookie Retention.
Click on the Options block on the left, then choose Cookies.
Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
Reset Temp File Removal for Regular Use.
Click on the Options block on the left. Select the Advanced button.
Check "Only delete files in Windows Temp folders older than 48 hours".
Now run the program and click on Run Cleaner
( Do not use the Issues block to clean anything with this program. It is for experts only and it is risky).
1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
____________________________
In your next reply I would like to see:
A new HJT log
The report from Combofix
Tell me if you installed AVG anti Malware after you discovered your possible infection.
Logfile of HijackThis v1.99.1
Scan saved at 6:39:14 PM, on 11/30/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Yes i did install after I was told that I had a worm….. I had the antivrus protectection with a firewall on this PC. I moved the computer from one room to another room and the next morning the internet connection board went out. I asked the local neighbor to put in a new board for me and my PC did not come back with everything it had left with.
Thank you
1 optional fix for you to consider.
____________________________
You have QuickTime running at Startup. This is QuickTime's system tray icon and not necessary for the program to function properly. It is considered to be a resource hog.
You will still be able to start it manually if you need it. You can fix this with HijackThis, but you will need to change the setting in QuickTime
Player itself to keep it from resetting itself.. This is the item to fix in HijackThis:
Your logs look clean.. My guess is if you had something AVG caught it before you got here.
Great news ![external image: Posted Image]
Your log now appears to be clean.
Lets do a few things to tidy up.
Please do these in the order I suggest!
___________________________________ Please create a 'clean' System Restore Point:
The reason for doing this is in case you need system restore you don't put back all we just took out. Right click My Computer
Then Propeties then system restore
Place a check mark by turn off system restore
Click APPLY
Windows will give you a warning click yes
REBOOT
Now go right back to the same place and unchecksystem restore
Click APPLYand OK
___________________________________ A few things to help with possible threats SpywareBlaster
Install SpywareBlaster
SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs.
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.
Over 4,000 fake bank and credit sites.
Tens of thousands of pornographic
and adult sites.
The never ending fake phishing sites.
Malicious sites, which can infect you
with spyware and adware if you visit
them.
Sites to download software which
may infect your computer with
spyware, a virus or adware
___________________________________ Download and keep these updated and run weekly if you don't already have them.
___________________________________ Download and Install a HOSTS File
A Hosts file is a plain text file which prevents your computer from connecting to malware and spyware sites by redirecting the connection request to 127.0.0.1, which is your local address. If you use a proxy server, or if you are on AOL, be sure to read the special instructions.
You can download the MVPS Hosts File and see a HOSTS file tutorial here :
This website also contains useful tips, and links to other resources and utilities.
___________________________________ Make your Internet Explorer more secure 1. From within Internet Explorer click on the Tools menu and then click on Options. 2. Click on the Security tab 3. Click the Internet icon so it becomes highlighted. 4. Click on Default Level and click Ok 5. Click on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button.
6. Next press the Apply button and then the OK to exit the Internet Properties page.
___________________________________ Keep windows updated here
___________________________________
You can read about alot safer surfing here
___________________________________
And it goes without saying do not open Email from someone you don't know.
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
