[Resolved] Uh-Oh! E-mail Bomb! HELP!

Halo00man,

Welcome to the forum, sorry for the delay. I am not looking at anything bad on your log but you are running an outdated version. Lets do this……

Download CCleaner from here to clean temp files from your computer.

• Double click on the file to start the installation of the program.
• Select your language and click OK, then next.
• Read the license agreement and click I Agree.
• Click next to use the default install location. Click Install then finish to complete installation.
• Double click the CCleaner shortcut on the desktop to start the program.
• On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
• If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
• Click on the "Options" icon at the left side of the window, then click on "Advanced."
  deselect "Only delete files in Windows Temp folders older than 48 hours."
• Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
• Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
• After CCleaner has completed its process, click Exit.

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!





Run this free online scan using Internet Explorer:
Kaspersky Online Virus Scanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
  
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
  
• In the scan settings make that the following are selected:
  
• Scan using the following Anti-Virus database:
  
• Standard
  
• Scan Options:
  
• Scan Archives
  
• Scan Mail Bases
  
• Click OK
  
• Now under select a target to scan: Select My Computer
  
• This will program will start and scan your system.
  
• The scan will take a while so be patient and let it run.
  
• Once the scan is complete it will display if your system has been infected.
  
• Now click on the Save as Text button:
  
• Save the file to your desktop.

Post the log along with a New HJT Log into your next reply.



Uninstall Hijackthis 1.99.1 via the Add Remove Programs in the Control Panel and download and install the newer version by Trendmicro.

Download Trendmicros Hijackthis to your desktop.
Double click it to install
Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe

• Open HJT Scan and Save a Log File, it will open in Notepad
• Go to Format and make sure Wordwrap is Unchecked
• Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.

DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.


Let me see the Kaspersky log and a New HJT log please.

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, January 28, 2008 10:04:41 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 28/01/2008 Kaspersky Anti-Virus database records: 535069 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 45884 Number of viruses found: 1 Number of infected objects: 6 Number of suspicious objects: 0 Duration of the scan process: 00:24:02 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\cert8.db Object is locked skipped C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\history.dat Object is locked skipped C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\key3.db Object is locked skipped C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\parent.lock Object is locked skipped C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\search.sqlite Object is locked skipped C:\Documents and Settings\User\Cookies\index.dat Object is locked skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001/stream/data0014 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001 Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe NSIS: infected - 4 skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\mkw04ik9.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\User\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\History\History.IE5\MSHist012008012820080129\index.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\User\NTUSER.DAT Object is locked skipped C:\Documents and Settings\User\ntuser.dat.LOG Object is locked skipped C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{6E0175F6-9595-4334-A0E1-88EA8E6ACC0D}\RP57\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Halo00man,

I am not looking at anything bad on either your HJT or Kaspersky log. Have you installed any new hardware or software recently??

You can read through these and if no help post back and we can dig deeper.


It's Not Always Malware

• Slow Computer
• Microsoft
  

Speedup Windows

• TechBuilder

Windows Tips

• Techruler
• Kellys Korner

• How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
• WhattheTech
• TonyKlein CastleCops
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

ken

the kapersky scan said my comp was infected though! was that just an error in the system?

Hello, The Mirc entries are just false positives, which are nothing to worry about. You do have the Mirc program installed on your computer?? Number of items = 6 C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001/stream/data0014 ——> Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001/stream ——> Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream/data0001 ——> Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe/stream ——> Client-IRC.Win32.mIRC.631 skipped C:\Documents and Settings\User\Desktop\Useless stuff\mirc631.exe NSIS: infected - 4 C:\Program Files\mIRC\mirc.exe ——> Client-IRC.Win32.mIRC.631 skipped Ken

Ah, yes… well thanks for the reply, i guess there is nothing wrong with my comp Thanks -Halo00man

Your very welcome, Stay well, Ken

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.