downloader.zlob.bbv infection

Hi Paul Hasakand welcome to Tom Coyote forums

I am currently looking over your log. As I am an Undergraduate, everything that I post to you must be checked by an Admin or Moderator. Thus, there may be a tiny bit of a delay between posts, but it shouldn't be too long. I will post back shortly with a potential fix.

Thanks for your patience!

Hi Paul Hasak

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

please post smitfraud txt file
in your next post
Thanks dan

SmitFraudFix v2.128 Scan done at 18:30:42.98, Mon 12/04/2006 Run from C:\Documents and Settings\Paul\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Paul »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Paul\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Paul\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" "LoadAppInit_DLLs"=dword:00000001 »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Hi Paul Hasak

Please print out or copy these instructions/tutorial to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Download ATF Cleaner by Atribune and save it to your Desktop.
Do not use yet!

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

• Install AVG Anti-Spyware by double clicking the installer.
• Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
• On the main screen under Your Computer's security.
  • Click on Change state next to Resident shield. It should now change to inactive.
  • Click on Change state next to Automatic updates. It should now change to inactive.
  • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
  • Wait until you see the Update succesfull message.
• Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.

• If the computer is running, shut down Windows, and then turn off the power.
• Wait 30 seconds, and then turn the computer on.
• Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
• Ensure that the Safe Mode option is selected.
• Press Enter. The computer then begins to start in Safe mode.
• Login on your usual account.

______________________________

Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
______________________________

Run ATF cleaner

• Double click ATF-Cleaner.exe to run the program.
• Check the following boxes:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Recycle Bin
  • Java Cache
• The rest are optional - if you want to remove the lot, check Select All.
• Now click Empty Selected.
• When you get the Done Cleaning message, click OK.
  
• If you use Firefox browser.
  • Click Firefox at the top and choose: Select All
  • If you would like to keep your saved passwords, please click No at the prompt.
  • Click the Empty Selected button.
• If you use Opera browser.
  • Click Opera at the top and choose: Select All
  • If you would like to keep your saved passwords, please click No at the prompt.
  • Click the Empty Selected button.

______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

• Click on Scanner on the toolbar.
• Click on the Settings tab.
  • Under How to act?
    • Click on Recommended Action and choose Quarantine from the popup menu.
  • Under How to scan?
    • All checkboxes should be ticked.
  • Under Possibly unwanted software:
    • All checkboxes should be ticked.
  • Under Reports:
    • Select Automatically generate report after every scan and uncheck Only if threats were found.
  • Under What to scan?
    • Select Scan every file.
• Click on the Scan tab.
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.
• When the scan has finished, follow the instructions below.
  IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
  • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
  • At the bottom of the window click on the Apply all Actions button. (3)
    [external image: Posted Image]
• When done, click the Save Scan Report button. (4)
  • Click the Save Report as button.
  • Save the report to your Desktop.
• Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
______________________________

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #3 - Delete Trusted zone by typing 3 and press Enter.
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________

Please post:

• c:\rapport.txt
• AVG Anti-Spyware report
• A new HijackThis log

Your may need several replies to post the requested logs, otherwise they might get cut off.

Thanks dan

SmitFraudFix v2.128 Scan done at 11:31:21.45, Tue 12/05/2006 Run from C:\Documents and Settings\Paul\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in safe mode »»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 12:42:46 PM 12/5/2006 + Scan result: C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029096.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029113.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029126.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029137.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029154.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029165.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029205.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029220.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029233.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029241.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029250.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP261\A0031266.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031343.exe -> Downloader.Zlob.aqh : Cleaned with backup (quarantined). ::Report end

Hi Paul Hasak

Ok, log is looking a lot better, how are things with your machine?
Note: if you have set this restriction don't fix with HJT: "O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present"

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit

please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Extended (If available otherwise Standard)
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan select My Computer
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

In your next post include new HJT log and kaspersky log
Can you let me know how things are with your machine
Thanks dan

I'm not having any luck downloading the Kaspersky Online Scanner. It begins to download and then stops saying something about having to be an administrator and/or have security setting set to medium. I was able to reset the security setting to medium but I don't know what to do about the administrator part. I am the only one on this computer and have always had administrative privelelges. Any suggestions? Thanks, Paul

Hi Paul Hasak

Note:Don't forget to make a note of the standard settings, and ensure the you resets after the scan.


Let's check your IE settings and see if we can get an online scan going.

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click on the Security tab
• Click the Internet icon so it becomes highlighted.
• Click on Default Level and click Ok
• Click on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Check that Script ActiveX controls marked safe for scripting is set to Enabled or Prompt
  • Check that Run ActiveX controls and plugins is Enabled
  • Change the Initialise and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • Check that Active Scripting is set to Enabled
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Open a new IE window and try to run the online scan.

________________

I will be off line later untill late tomorrow and hope to be back with you soon
Thanks dan

KASPERSKY ONLINE SCANNER REPORT Wednesday, December 06, 2006 9:08:01 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 6/12/2006 Kaspersky Anti-Virus database records: 248413 Scan Settings Scan using the following antivirus database extended Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 65408 Number of viruses found 6 Number of infected objects 32 / 0 Number of suspicious objects 0 Duration of the scan process 00:42:21 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Paul\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Paul\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Paul\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Paul\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Paul\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Paul\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Paul\ntuser.dat Object is locked skipped C:\Documents and Settings\Paul\NTUSER.DAT.LOG Object is locked skipped C:\HELPER\DATA\account_library.BLB Object is locked skipped C:\HELPER\DATA\account_library.DAT Object is locked skipped C:\HELPER\DATA\account_library.IDX Object is locked skipped C:\HELPER\DATA\billing_parties.BLB Object is locked skipped C:\HELPER\DATA\billing_parties.DAT Object is locked skipped C:\HELPER\DATA\billing_parties.IDX Object is locked skipped C:\HELPER\DATA\cc_info.DAT Object is locked skipped C:\HELPER\DATA\cc_info.IDX Object is locked skipped C:\HELPER\DATA\clinic_facesheet.BLB Object is locked skipped C:\HELPER\DATA\clinic_facesheet.DAT Object is locked skipped C:\HELPER\DATA\clinic_facesheet.IDX Object is locked skipped C:\HELPER\DATA\data_setup.DAT Object is locked skipped C:\HELPER\DATA\data_setup.IDX Object is locked skipped C:\HELPER\DATA\insurance_facesheet.BLB Object is locked skipped C:\HELPER\DATA\insurance_facesheet.DAT Object is locked skipped C:\HELPER\DATA\insurance_facesheet.IDX Object is locked skipped C:\HELPER\DATA\lawyer_facesheet.BLB Object is locked skipped C:\HELPER\DATA\lawyer_facesheet.DAT Object is locked skipped C:\HELPER\DATA\lawyer_facesheet.IDX Object is locked skipped C:\HELPER\DATA\managed_care.DAT Object is locked skipped C:\HELPER\DATA\managed_care.IDX Object is locked skipped C:\HELPER\DATA\mc_linkto_trans.DAT Object is locked skipped C:\HELPER\DATA\mc_linkto_trans.IDX Object is locked skipped C:\HELPER\DATA\patient_facesheet.BLB Object is locked skipped C:\HELPER\DATA\patient_facesheet.DAT Object is locked skipped C:\HELPER\DATA\patient_facesheet.IDX Object is locked skipped C:\HELPER\DATA\patient_insurance.DAT Object is locked skipped C:\HELPER\DATA\patient_insurance.IDX Object is locked skipped C:\HELPER\DATA\patient_sess_default.BLB Object is locked skipped C:\HELPER\DATA\patient_sess_default.DAT Object is locked skipped C:\HELPER\DATA\patient_sess_default.IDX Object is locked skipped C:\HELPER\DATA\program_library.BLB Object is locked skipped C:\HELPER\DATA\program_library.DAT Object is locked skipped C:\HELPER\DATA\program_library.IDX Object is locked skipped C:\HELPER\DATA\referring_source.BLB Object is locked skipped C:\HELPER\DATA\referring_source.DAT Object is locked skipped C:\HELPER\DATA\referring_source.IDX Object is locked skipped C:\HELPER\DATA\report_layout.DAT Object is locked skipped C:\HELPER\DATA\report_layout.IDX Object is locked skipped C:\HELPER\DATA\rpt_description.BLB Object is locked skipped C:\HELPER\DATA\rpt_description.DAT Object is locked skipped C:\HELPER\DATA\rpt_description.IDX Object is locked skipped C:\HELPER\DATA\sch_appointment.DAT Object is locked skipped C:\HELPER\DATA\sch_appointment.IDX Object is locked skipped C:\HELPER\DATA\sch_cat_library.DAT Object is locked skipped C:\HELPER\DATA\sch_cat_library.IDX Object is locked skipped C:\HELPER\DATA\sch_priority_library.DAT Object is locked skipped C:\HELPER\DATA\sch_priority_library.IDX Object is locked skipped C:\HELPER\DATA\service_library.BLB Object is locked skipped C:\HELPER\DATA\service_library.DAT Object is locked skipped C:\HELPER\DATA\service_library.IDX Object is locked skipped C:\HELPER\DATA\session.BLB Object is locked skipped C:\HELPER\DATA\session.DAT Object is locked skipped C:\HELPER\DATA\session.IDX Object is locked skipped C:\HELPER\DATA\therapist_facesheet.BLB Object is locked skipped C:\HELPER\DATA\therapist_facesheet.DAT Object is locked skipped C:\HELPER\DATA\therapist_facesheet.IDX Object is locked skipped C:\HELPER\DATA\transactions.DAT Object is locked skipped C:\HELPER\DATA\transactions.IDX Object is locked skipped C:\HELPER\DATA\transaction_amount.DAT Object is locked skipped C:\HELPER\DATA\transaction_amount.IDX Object is locked skipped C:\HELPER\DATA\trans_to_bills.DAT Object is locked skipped C:\HELPER\DATA\trans_to_bills.IDX Object is locked skipped C:\HELPER\DATA\type_of_adjustment.DAT Object is locked skipped C:\HELPER\DATA\type_of_adjustment.IDX Object is locked skipped C:\HELPER\DATA\user_security.DAT Object is locked skipped C:\HELPER\DATA\user_security.IDX Object is locked skipped C:\HELPER\DATA\zip.DAT Object is locked skipped C:\HELPER\DATA\zip.IDX Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status.WFD Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status.WFF Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status.WFG Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status.WFR Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status.WFX Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status2.WFD Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status2.WFG Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status2.WFX Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status3.WFD Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status3.WFG Object is locked skipped C:\Program Files\Symantec\WinFax\Data\Status3.WFX Object is locked skipped C:\Program Files\Symantec\WinFax\Data\StatusS.WFD Object is locked skipped C:\Program Files\Symantec\WinFax\Data\StatusS.WFG Object is locked skipped C:\Program Files\Symantec\WinFax\Data\StatusS.WFX Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP226\A0023619.exe/data0003/data0002 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP226\A0023619.exe/data0003 Infected: Trojan-Downloader.Win32.PurityScan.dc skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP226\A0023619.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027068.exe/data0007 Infected: Trojan-Downloader.Win32.Zlob.bbx skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027068.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027068.exe UPack: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027068.exe PE_Patch: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027069.exe/data0007 Infected: Trojan-Downloader.Win32.Zlob.bbx skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027069.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027069.exe UPack: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0027069.exe PE_Patch: infected - 1 skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029095.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029112.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029125.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029136.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029153.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP259\A0029166.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029206.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029221.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029230.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029242.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP260\A0029251.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP261\A0031265.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP261\A0031304.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP261\A0031314.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP262\A0031327.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031341.dll Infected: Trojan-Downloader.Win32.Zlob.aeg skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031342.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031346.exe Infected: Trojan-Downloader.Win32.Zlob.aqh skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031347.exe Infected: Trojan-Downloader.Win32.Zlob.bcb skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP263\A0031348.exe Infected: Trojan-Downloader.Win32.Zlob.bcb skipped C:\System Volume Information\_restore{6A04AF26-38A4-49C3-9658-A527AEEC16B4}\RP267\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{C295439F-4A13-4B77-8071-AF3F509CA36C}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed.

Hi Paul Hasak

Well done Paul

Your logs have come back fine, what you see in the kaspersky scan is all in system restore, which I'm about to deal with.
Ok, firstly can you delete the smitfraud folders I got you to download dont forget the zip folder too. then empty your recycle bin.

Now I would like you to reset your system restore points by following the instructions set out below

1) On the Desktop, right-click My Computer
2) Click on Properties. Click the System Restore tab.
3) Look for the box near the top which says
Turn off system restore off on all drives

4) Place a tick in the box to disable
5) Click Apply first, and then click OK and the window will dissapear.

Now reboot your computer….

6) Right-click My Computer once more
7) Click on Properties. Click the System Restore tab again
8) Look for the box near the top which says
Turn off system restore off on all drives

9)Take out the tick from the box so it is empty
10) Click Apply first, and then click OK.
Now restart your computer once more to complete the process

_______________________


This is my normal post for when you are clear - which you now are - or seem to be. Please advise of any problems you may have :
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  
• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialise and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.
  ___________________
  
• Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
  Computer Safety On line - Software Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
  This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
  Instructions for - Spybot S & D and Ad-aware
  
• Install Ad-Aware - Install and download Ad-Aware. You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here:
  Instructions for - Spybot S & D and Ad-aware
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
  Computer Safety on line - Anti-Malware
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.


Stand up and be Counted.

NOW is the time you can start to hit back at the people who infected you.
[external image: Posted Image]
Please take the time to go and complain - that forum has a topic for your infection which is ……………. please post as a reply, you do not need to register to do so (but you can if you wish). It will also have a list of other places you can go to to register your complaint, depending on the country you are resident in. Please read the topics and complain, it is only with such complaints to goverment or government agances that something will get done.

>> Here << you can see how you can help us.

Regards dan