Rorschach112
Post the ComboFix log
Spyware / Malware / Virus Removal
[Resolved] trojans vundo and metajuan . hijack this file attache
8 min read
mrtimbo
sorry.. here it is
ComboFix 08-06-20.4 - Denise 2008-06-26 14:07:08.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1420 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Denise\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\Documents and Settings\Denise\My Documents\Downloads\Nero 8 Ultra Edition v8.0.3.1\nero8x Keygen Without Trojan!.exe
.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.
2008-06-21 10:14 . 2008-06-21 10:14 d——– C:\Program Files\Trend Micro
2008-06-19 19:54 . 2008-06-19 19:54 d——– C:\Program Files\Lavasoft
2008-06-19 19:54 . 2008-06-19 20:09 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-19 19:53 . 2008-06-19 19:53 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-06-15 21:44 . 2008-06-15 21:44 0 –a—— C:\WINDOWS\nsreg.dat
2008-06-14 23:49 . 2008-06-19 16:51 500 –a—— C:\WINDOWS\wininit.ini
2008-06-14 23:10 . 2008-06-19 21:22 d——– C:\Program Files\Spybot - Search & Destroy
2008-06-14 23:10 . 2008-06-19 21:20 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 09:02 . 2008-06-14 09:02 d——– C:\Program Files\AdultPDF
2008-06-14 08:19 . 2008-06-14 08:19 d——– C:\Documents and Settings\Denise\Application Data\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:18 d——– C:\Program Files\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:19 d——– C:\Program Files\Common Files\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:18 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-06-11 18:31 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 18:31 . 2008-06-13 09:10 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 17:18 . 2008-05-31 17:18 d——– C:\Program Files\ETS
2008-05-31 09:56 . 2008-05-31 09:56 d——– C:\WINDOWS\system32\Adobe
2008-05-31 09:56 . 2008-06-22 18:00 d——– C:\Program Files\Norton Security Scan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 07:08 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-06-16 10:44 ——— d—–w C:\Documents and Settings\Denise\Application Data\U3
2008-06-15 02:10 ——— d—–w C:\Program Files\iTunes
2008-06-15 02:07 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-14 12:18 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-05-19 21:51 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-05-16 15:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-14 11:50 ——— d—–w C:\Program Files\Apple Software Update
2008-05-14 11:49 ——— d—–w C:\Program Files\iPod
2008-05-14 11:47 ——— d—–w C:\Program Files\QuickTime
2008-05-12 11:06 ——— d—–w C:\Program Files\Palm
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-04 16:37 ——— d—–w C:\Documents and Settings\Denise\Application Data\Autodesk
2008-05-04 16:31 ——— d—–w C:\Documents and Settings\Denise\Application Data\InstallShield
2008-04-29 15:20 15,648 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 15:19 15,648 —-a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 15:19 12,960 —-a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-03-27 08:12 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-21_11.38.42.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-21 15:24:31 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-22 07:08:14 2,048 –s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-14 11:01:02 272,128 ——w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-06-13 13:10:50 272,128 ——w C:\WINDOWS\Driver Cache\i386\bthport.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 12:08 135168]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 12:08 159744]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 12:07 131072]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 13:39 151552]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-15 18:46 413696 C:\WINDOWS\stsystra.exe]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 20:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 21:33 125168]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"HotSync"="C:\Program Files\PalmSource\Desktop\HotSync.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2005-05-23 09:57 90112]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10:18:22 10872]
HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe [2008-01-03 18:28:08 1392640]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
–a—— 2008-03-05 00:48 638976 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-03-05 01:58 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-12-26 03:20]
S3 GameConsoleService;GameConsoleService;"C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe" [2008-01-29 13:09]
.
Contents of the 'Scheduled Tasks' folder
"2008-05-15 13:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-22 22:06:59 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 14:07:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-26 14:09:03
ComboFix-quarantined-files.txt 2008-06-26 18:08:36
ComboFix2.txt 2008-06-26 16:44:05
ComboFix3.txt 2008-06-25 23:52:31
ComboFix4.txt 2008-06-21 16:21:06
ComboFix5.txt 2008-06-21 15:38:59
Pre-Run: 138,419,134,464 bytes free
Post-Run: 138,412,363,776 bytes free
140 — E O F — 2008-06-22 07:02:03
ComboFix 08-06-20.4 - Denise 2008-06-26 14:07:08.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1420 [GMT -4:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Denise\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\Documents and Settings\Denise\My Documents\Downloads\Nero 8 Ultra Edition v8.0.3.1\nero8x Keygen Without Trojan!.exe
.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.
2008-06-21 10:14 . 2008-06-21 10:14 d——– C:\Program Files\Trend Micro
2008-06-19 19:54 . 2008-06-19 19:54 d——– C:\Program Files\Lavasoft
2008-06-19 19:54 . 2008-06-19 20:09 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-19 19:53 . 2008-06-19 19:53 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-06-15 21:44 . 2008-06-15 21:44 0 –a—— C:\WINDOWS\nsreg.dat
2008-06-14 23:49 . 2008-06-19 16:51 500 –a—— C:\WINDOWS\wininit.ini
2008-06-14 23:10 . 2008-06-19 21:22 d——– C:\Program Files\Spybot - Search & Destroy
2008-06-14 23:10 . 2008-06-19 21:20 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-14 09:02 . 2008-06-14 09:02 d——– C:\Program Files\AdultPDF
2008-06-14 08:19 . 2008-06-14 08:19 d——– C:\Documents and Settings\Denise\Application Data\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:18 d——– C:\Program Files\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:19 d——– C:\Program Files\Common Files\Ulead Systems
2008-06-14 08:18 . 2008-06-14 08:18 d——– C:\Documents and Settings\All Users\Application Data\Ulead Systems
2008-06-11 18:31 . 2008-06-13 09:10 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 18:31 . 2008-06-13 09:10 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-05-31 17:18 . 2008-05-31 17:18 d——– C:\Program Files\ETS
2008-05-31 09:56 . 2008-05-31 09:56 d——– C:\WINDOWS\system32\Adobe
2008-05-31 09:56 . 2008-06-22 18:00 d——– C:\Program Files\Norton Security Scan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-22 07:08 ——— d—–w C:\Program Files\Symantec AntiVirus
2008-06-16 10:44 ——— d—–w C:\Documents and Settings\Denise\Application Data\U3
2008-06-15 02:10 ——— d—–w C:\Program Files\iTunes
2008-06-15 02:07 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-06-14 12:18 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-05-19 21:51 ——— d—–w C:\Program Files\Microsoft Silverlight
2008-05-16 15:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-14 11:50 ——— d—–w C:\Program Files\Apple Software Update
2008-05-14 11:49 ——— d—–w C:\Program Files\iPod
2008-05-14 11:47 ——— d—–w C:\Program Files\QuickTime
2008-05-12 11:06 ——— d—–w C:\Program Files\Palm
2008-05-08 12:28 202,752 —-a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-05-04 16:37 ——— d—–w C:\Documents and Settings\Denise\Application Data\Autodesk
2008-05-04 16:31 ——— d—–w C:\Documents and Settings\Denise\Application Data\InstallShield
2008-04-29 15:20 15,648 —-a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 15:19 15,648 —-a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 15:19 12,960 —-a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-03-27 08:12 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-21_11.38.42.68 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-21 15:24:31 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-22 07:08:14 2,048 –s-a-w C:\WINDOWS\bootstat.dat
- 2008-04-14 11:01:02 272,128 ——w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-06-13 13:10:50 272,128 ——w C:\WINDOWS\Driver Cache\i386\bthport.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 12:08 135168]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 12:08 159744]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 12:07 131072]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 13:39 151552]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-15 18:46 413696 C:\WINDOWS\stsystra.exe]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 09:04 53248]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 20:26 52896]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 21:33 125168]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"HotSync"="C:\Program Files\PalmSource\Desktop\HotSync.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Ulead AutoDetector v2"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2005-05-23 09:57 90112]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10:18:22 10872]
HotSync Manager.lnk - C:\Program Files\Palm\Hotsync.exe [2008-01-03 18:28:08 1392640]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoCAD Startup Accelerator.lnk
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
–a—— 2008-01-11 23:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
–a—— 2004-08-04 07:00 15360 C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSERIAL]
–a—— 2008-03-05 00:48 638976 C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
–a—— 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
–a—— 2008-03-05 01:58 171448 C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187B.sys [2007-12-26 03:20]
S3 GameConsoleService;GameConsoleService;"C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe" [2008-01-29 13:09]
.
Contents of the 'Scheduled Tasks' folder
"2008-05-15 13:03:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-22 22:06:59 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-26 14:07:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-26 14:09:03
ComboFix-quarantined-files.txt 2008-06-26 18:08:36
ComboFix2.txt 2008-06-26 16:44:05
ComboFix3.txt 2008-06-25 23:52:31
ComboFix4.txt 2008-06-21 16:21:06
ComboFix5.txt 2008-06-21 15:38:59
Pre-Run: 138,419,134,464 bytes free
Post-Run: 138,412,363,776 bytes free
140 — E O F — 2008-06-22 07:02:03
Rorschach112
Your logs are clean
Follow these steps to uninstall Combofix and tools used in the removal of malware
You now need to update your Java and remove your older versions.
Please follow these steps to remove older version Java components.
* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.
Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here
Below I have included a number of recommendations for how to protect your computer against malware infections.
* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here
* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.
Make Internet Explorer more secure
* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here
* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here
Thank you for your patience, and performing all of the procedures requested.
Follow these steps to uninstall Combofix and tools used in the removal of malware
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]
- Make sure you have an Internet Connection.
- Download OTCleanIt to your desktop and run it
- Click the CleanUp! button and let the program run
You now need to update your Java and remove your older versions.
Please follow these steps to remove older version Java components.
* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.
Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here
Below I have included a number of recommendations for how to protect your computer against malware infections.
* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here
* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here
* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here
Thank you for your patience, and performing all of the procedures requested.
mrtimbo
Thank You, Thank You, Thank You!
I appreciate all you have done. I owe ya a beer!
Rorschach112
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI