What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Antivrius 2009

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, I currently have the Antirus 2009 malware on my computer. I tried running Malwarebyte's Anti-Malware but for some reason the .exe file refuses to run. I tried downloading the setup file and running that instead but that was unsuccessful as well. I also tried running the setup for the new version of HijackThis but that also would not run. So I have attempt to post a log file from an old version of HijactThis, but the forum would not let me. Is there anything at all I can do to fix this? Any help would be greatly appreciated. Thanks very much in advance! :)
Post #2
Hi cece,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
Hi Tomk,

Thanks very much for your prompt reply! :)

Here is the DDS.txt log:


DDS (Version 1.0) - NTFSx86
Run by [removed] at 15:16:28.35 on 12/10/2008 Wed
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.[removed].18.447.180 [GMT -8:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\a\Desktop\dds.scr
C:\WINDOWS\system32\conime.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ieupdate] "c:\windows\system32\explorer32.exe"
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
mRun: [VTTimer] VTTimer.exe
mRun: [VTTrayp] VTtrayp.exe
mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_06\bin\jusched.exe"
StartupFolder: c:\docume~1\a\startm~1\programs\startup\checkf~1.lnk - c:\jts\WiseUpdt.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {144FDEB7-A23D-4D39-A00E-AA44195535B6} - c:\windows\wcidButton.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_06\bin\ssv.dll
IE: {144FDEB7-A23D-4D39-A00E-AA44195535B6} - c:\windows\wcidButton.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\quicktax 2007\ic2007pp.dll
SEH: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} - c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll
SEH: {1E51C0FD-EE36-434B-AD2A-FD1FF3731C38} - c:\windows\system32\wyrsdj.dll
SEH: {6E6CA8A1-81BC-4707-A54C-F4903DD70BAD} - c:\windows\system32\zgxfdx.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

============= SERVICES / DRIVERS ===============

R1 AVG Anti-Spyware Driver;AVG Anti-Spyware Driver;\??\c:\program files\grisoft\avg anti-spyware 7.5\guard.sys [2006-9-28 4096]
R1 AvgAsCln;AVG Anti-Spyware Clean Driver;c:\windows\system32\drivers\AvgAsCln.sys [2007-1-8 3968]
R1 avgio;avgio;\??\c:\program files\avira\antivir personaledition classic\avgio.sys [2008-6-22 11840]
R2 AntiVirScheduler;Avira AntiVir Personal – Free Antivirus Scheduler;"c:\program files\avira\antivir personaledition classic\sched.exe" [2008-6-22 68865]
R2 AntiVirService;Avira AntiVir Personal – Free Antivirus Guard;"c:\program files\avira\antivir personaledition classic\avguard.exe" [2008-6-22 151297]
R2 AVG Anti-Spyware Guard;AVG Anti-Spyware Guard;c:\program files\grisoft\avg anti-spyware 7.5\guard.exe [2006-9-28 204800]
R3 avgntflt;avgntflt;\??\c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-6-22 52032]
S0 96779z;96779z;c:\windows\system32\drivers\96779z.sys []
S0 yndev;ynde;c:\windows\system32\drivers\yndev.sys [2004-8-3 47616]
S2 bcvnsvc;Visual Studio Analyzer Remote bridge Helper Service;c:\windows\system32\svchost.exe -k bcvnsvc [2004-8-3 14336]
S2 cstmsvc;Cryptographic Services Table Manager;c:\windows\system32\svchost.exe -k cstmsvc [2004-8-3 14336]
S2 MSPlugPlay;Windows Plug and Play;c:\windows\system32\svchost.exe -k MSPlugPlay [2004-8-3 14336]
S3 Wingl26;Wingl26;\??\c:\windows\system32\drivers\Wingl26.sys []

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2008-12-10 07:19 363,008 a——- c:\windows\system32\winsrc.dll.tmp
2008-12-09 10:28 364,032 a——- c:\windows\system32\winsrc.dll
2008-12-09 10:24 –d—– c:\program files\Antivirus 2009

==================== Find3M ====================

2008-08-29 14:15 1,073,047 a——- c:\program files\00aefwscm.ram
2008-06-22 18:19 22,311,160 a——- c:\program files\antivir_workstation_winu_en_h.exe
2008-06-21 11:14 14 a——- c:\documents and settings\a\getfile.dat
2008-06-18 00:25 74 a——- c:\program files\fix.bat
2007-06-03 10:59 9 a——- c:\program files\Statement.DailyMonthlyStatement
2007-06-01 19:34 12,336,288 a——- c:\program files\tws40_install.exe
2007-01-08 21:51 2,948 a——- c:\program files\Report-Scan-20070108-215042.txt
2007-01-08 20:41 47,104 a——- c:\program files\ATF-Cleaner.exe
2007-01-08 20:39 6,469,352 a——- c:\program files\avgas-setup-7.5.0.50.exe
2007-01-08 19:57 2,855,080 a——- c:\program files\aawsepersonal.exe
2007-01-08 19:54 5,037,072 a——- c:\program files\spybotsd14.exe
2006-12-12 21:33 13,817,440 a——- c:\program files\bitdefender_free_v8.exe
2006-06-03 19:24 102,400 a——- c:\documents and settings\a\com_securenetasia_p11wrapper2.dll
2005-11-25 23:10 5,529,600 a——- c:\program files\mplayerc.exe
2001-11-22 20:08 712,704 a—-r– c:\windows\inf\other\AUDIO3D.DLL
2004-08-08 06:26 520 —sh— c:\windows\system32\smdsbsrv.sys
2004-08-08 06:26 4,680 —sh— c:\windows\system32\xsdjbbmp.sys

============= FINISH: 15:17:06.31 ===============


The Attach.txt has been attached.

Since my last post I have been able to install the new version of HijackThis onto another computer, and I have moved it from there onto my infected computer and have successfully run it. So here is a log from the new HijackThis, in case it'd be of any help:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:00:27 PM, on 12/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
E:\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ieupdate] "C:\WINDOWS\system32\explorer32.exe"
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Norton Confidence Online - {144FDEB7-A23D-4D39-A00E-AA44195535B6} - C:\WINDOWS\wcidButton.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.epost.ca/printing/smsx.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8A4943CC-1950-44F9-9045-D3D428FD3948} (SecureX Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {CCC46940-DED0-476C-A27E-115B10DAE0B4} - http://td.nortonconfidenceonline.com/plug-in/WSAS.cab
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
O23 - Service: Avira AntiVir Personal !V Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal !V Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

–
End of file - 4780 bytes

Attachments:

Post #4
cece,

Please download the OTMoveIt3 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Processes
explorer.exe
explorer32.exe

:Services
96779z
yndev
Wingl26

:Reg

:Files
c:\windows\system32\wyrsdj.dll
c:\windows\system32\zgxfdx.dll
c:\program files\00aefwscm.ram
c:\windows\system32\winsrc.dll.tmp
c:\windows\system32\winsrc.dll
C:\WINDOWS\system32\explorer32.exe
c:\program files\Antivirus 2009

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
Hi Tomk,

Results of OTMovIt3:

========== PROCESSES ==========
Process explorer.exe killed successfully.
Unable to kill process: explorer32.exe
========== SERVICES/DRIVERS ==========
Service 96779z stopped successfully.
Service 96779z deleted successfully.
Service yndev stopped successfully.
Service yndev deleted successfully.
Service Wingl26 stopped successfully.
Service Wingl26 deleted successfully.
========== REGISTRY ==========
========== FILES ==========
File/Folder c:\windows\system32\wyrsdj.dll not found.
File/Folder c:\windows\system32\zgxfdx.dll not found.
c:\program files\00aefwscm.ram moved successfully.
c:\windows\system32\winsrc.dll.tmp moved successfully.
c:\windows\system32\winsrc.dll unregistered successfully.
c:\windows\system32\winsrc.dll moved successfully.
File/Folder C:\WINDOWS\system32\explorer32.exe not found.
c:\program files\Antivirus 2009 moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12102008_194954

Files moved on Reboot…
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.


New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:55:54 PM, on 12/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
E:\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ieupdate] "C:\WINDOWS\system32\explorer32.exe"
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Norton Confidence Online - {144FDEB7-A23D-4D39-A00E-AA44195535B6} - C:\WINDOWS\wcidButton.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.epost.ca/printing/smsx.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8A4943CC-1950-44F9-9045-D3D428FD3948} (SecureX Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {CCC46940-DED0-476C-A27E-115B10DAE0B4} - http://td.nortonconfidenceonline.com/plug-in/WSAS.cab
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
O23 - Service: Avira AntiVir Personal !V Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal !V Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

–
End of file - 4867 bytes

Computer behaviour:
I'm still unable to run any instance of the Malwarebyte's AntiMalware setup file, thus I don't have a Malwarebytes log.
No balloon or advertisement from Antivirus 2009 pops up any longer. However, web browser is still misbehaving. I'm able to go onto Google and perform searches, but whenever I click on a link, it goes to an error page.
Post #6
cece,

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://www.bleepingcomputer.com/forums/topic114351.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #7
Hi Tomk, I have not been able to successfully run ComboFix.exe. Because of the problem with my web browser, I have been downloading the fixing programs on another computer and transferring them onto my infected program to run. Unfortunately ComboFix, like Malwarebytes, has not been able to run successfully. I have tried copying and pasting the URLs into a downloader so that the program could be downloaded straight to the desktop, but downloading in this manner has not been successful either. Any other ideas would be greatly appreciated. Thanks, Tomk. :)
Post #8
cece, Please try this: When transffering Combofix to the infected computer, save as Fixme.com (instead of Combofix.exe). Then please try to run.
Post #9
Tomk,

Awesome! It works. :)

Here is the log (apparently programs run in Chinese by default on the PC; hope that's alright):

ComboFix 08-12-09.03 - a 2008-12-11 21:43:39.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.[removed].18.222 [GMT -8:00]
.

((((((((((((((((((((((((((((((((((((((( ³Q§R°£ªºÀÉ®× )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\a\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus 2009.lnk
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\1001
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\1004
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\3018
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\3033
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\3038
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\3046
c:\documents and settings\a\Local Settings\Temporary Internet Files\_KC\3051
c:\documents and settings\a\Start Menu\Antivirus 2009
c:\documents and settings\a\Start Menu\Antivirus 2009\Antivirus 2009.lnk
c:\documents and settings\a\Start Menu\Antivirus 2009\Uninstall Antivirus 2009.lnk
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\_p
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\1001
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\1004
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3018
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3033
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3038
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3041
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3046
c:\documents and settings\NetworkService\Local Settings\Temporary Internet Files\_KC\3051
c:\windows\g32.txt
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\TDSSmxoe.sys
c:\windows\system32\sufost.ini
c:\windows\system32\TDSScfgb.log
c:\windows\system32\TDSSirxy.dll
c:\windows\system32\TDSSktpa.dll
c:\windows\system32\TDSSliqp.log
c:\windows\system32\TDSSnrse.dll
c:\windows\system32\TDSSoeqh.dll
c:\windows\system32\TDSSosvn.log
c:\windows\system32\TDSSpqxt.dll
c:\windows\system32\TDSSwupe.dat
c:\windows\system32\TDSSyavu.dll
c:\windows\system32\Uerver.ini
c:\windows\system32\Update.dat
c:\windows\system32\xsdjbbmp.sys

.
((((((((((((((((((((((((((((((((((((((( ÅX°Ê/ªA°È )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_TDSSSERV.SYS
——-\Legacy_TDSSSERV.SYS
——-\Legacy_ASPIMGR


((((((((((((((((((((((((( 2008-11-12 ¦Ü 2008-12-12 ªº·sªºÀÉ®× )))))))))))))))))))))))))))))))
.

2008-12-10 23:28 . 2008-12-10 23:34 d——– C:\Downloads
2008-12-10 23:27 . 2008-12-11 21:39 d——– c:\documents and settings\a\Application Data\GetRight
2008-12-10 23:26 . 2008-12-11 11:15 d——– c:\program files\GetRight
2008-12-10 19:49 . 2008-12-10 19:49 d——– C:\_OTMoveIt
2008-12-01 14:12 . 2008-12-01 14:12 73,728 –a—— c:\windows\system32\TDSSacun.dll
2008-12-01 14:12 . 2008-12-01 14:12 2,268 –a—— c:\windows\system32\TDSSqqcn.dll

.
(((((((((((((((((((((((((((((((((((((((( ¦b¤T­Ó¤ë¤º³Q­×§ïªºÀÉ®× ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 02:19 22,311,160 —-a-w c:\program files\antivir_workstation_winu_en_h.exe
2008-06-21 19:14 14 —-a-w c:\documents and settings\a\getfile.dat
2008-06-18 08:25 74 —-a-w c:\program files\fix.bat
2007-06-03 18:59 9 —-a-w c:\program files\Statement.DailyMonthlyStatement
2007-06-02 03:34 12,336,288 —-a-w c:\program files\tws40_install.exe
2007-01-09 05:51 2,948 —-a-w c:\program files\Report-Scan-20070108-215042.txt
2007-01-09 04:41 47,104 —-a-w c:\program files\ATF-Cleaner.exe
2007-01-09 04:39 6,469,352 —-a-w c:\program files\avgas-setup-7.5.0.50.exe
2007-01-09 03:57 2,855,080 —-a-w c:\program files\aawsepersonal.exe
2007-01-09 03:54 5,037,072 —-a-w c:\program files\spybotsd14.exe
2006-12-13 05:33 13,817,440 —-a-w c:\program files\bitdefender_free_v8.exe
2006-06-04 03:24 102,400 —-a-w c:\documents and settings\a\com_securenetasia_p11wrapper2.dll
2005-11-26 07:10 5,529,600 —-a-w c:\program files\mplayerc.exe
2001-11-23 04:08 712,704 —-a-r c:\windows\inf\OTHER\AUDIO3D.DLL
2004-08-08 14:26 520 –sh–w c:\windows\system32\smdsbsrv.sys
.

((((((((((((((((((((((((((((((((((((( ­«­nµn¤JÂI ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*ª`·N* ªÅ¥Õ»P¦Xªk¯Ê¬Ùµn¿ý±N¤£·|³QÅã¥Ü
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]

c:\documents and settings\a\Start Menu\Programs\Startup\
Check for TWS Updates.lnk - c:\jts\WiseUpdt.exe [2007-06-01 194775]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GetRight.lnk - c:\program files\GetRight\GetRight.exe [2008-12-10 4628752]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

S0 yndev;ynde;c:\windows\system32\DRIVERS\yndev.sys [2004-08-03 47616]
S2 bcvnsvc;Visual Studio Analyzer Remote bridge Helper Service;c:\windows\System32\svchost.exe -k bcvnsvc [2004-08-03 14336]
S2 cstmsvc;Cryptographic Services Table Manager;c:\windows\System32\svchost.exe -k cstmsvc [2004-08-03 14336]
S2 MSPlugPlay;Windows Plug and Play;c:\windows\System32\svchost.exe -k MSPlugPlay [2004-08-03 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
cstmsvc REG_MULTI_SZ cstmsvc
bcvnsvc REG_MULTI_SZ bcvnsvc
MSPlugPlay REG_MULTI_SZ MSPlugPlay
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Cmaudio - cmicnfg.cpl
ShellExecuteHooks-{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38} - c:\windows\system32\wyrsdj.dll
ShellExecuteHooks-{6E6CA8A1-81BC-4707-A54C-F4903DD70BAD} - c:\windows\system32\zgxfdx.dll
SafeBoot-Wingl26.sys


.
——- ¦Ó¥~ªº±½´y ——-
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

- c:\windows\Downloaded Program Files\smsx.inf

c:\windows\Downloaded Program Files\TNSSPPC.dll - c:\windows\Downloaded Program Files\DataStore.dll
c:\windows\Downloaded Program Files\IEZoneHlp.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\EWinECertRegAX.dll
O16 -: {3AC7F64E-6154-47B0-82B5-764ED4077F77}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\DataStore.dll - c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\TNSSPPC.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\IEZoneHlp.dll
O16 -: {8A4943CC-1950-44F9-9045-D3D428FD3948}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\IEZoneHlp.dll - c:\windows\Downloaded Program Files\EWinECertRegAX.dll
c:\windows\Downloaded Program Files\CONFLICT.1\EWinSecurityAX.dll
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\CONFLICT.1\IEZoneSet.exe
O16 -: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\CONFLICT.1\eWinCtl.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-11 21:47:28
Windows 5.1.2600 Service Pack 2 NTFS

±½´y³QÁôÂ꺶iµ{¡C¡C¡C …

±½´y³QÁôÂ꺱ҰʲաC¡C¡C

±½´y³QÁôÂ꺤å¥ó¡C¡C¡C

±½´y§¹¦¨
³QÁôÂêºÀÉ®×: 0

**************************************************************************
.
———————— ¨ä¥L¹B¦æ¶iµ{ ————————
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\conime.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\rundll32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
§¹¦¨®É¶¡: 2008-12-11 21:50:05 - ¹q¸£¤w­«·s±Ò°Ê
ComboFix-quarantined-files.txt 2008-12-12 05:50:01

Pre-Run: 73,827,033,088 bytes free
Post-Run: 73,830,252,544 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-CHT.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

196
Post #10
cece,

We're getting there. :thumbup:

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    File::
c:\windows\system32\TDSSacun.dll
c:\windows\system32\TDSSqqcn.dll
c:\windows\system32\DRIVERS\yndev.sys

Folder::

Registry::

Driver::
yndev
bcvnsvc
cstmsvc
MSPlugPlay
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Next

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #11
Tomk,

Everything seems to be fine now. :) Web browser is back to normal and .exe files are runnable.
Here is the Combofix log:

ComboFix 08-12-09.03 - a 2008-12-11 23:44:51.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.[removed].18.191 [GMT -8:00]
°õ¦æ¦ì¸m: c:\documents and settings\a\Desktop\Fixme.exe
Command switches used :: c:\documents and settings\a\Desktop\CFScript.txt
* ¦¨¥\³Ð³y·sÁÙ­ìÂI

FILE ::
c:\windows\system32\DRIVERS\yndev.sys
c:\windows\system32\TDSSacun.dll
c:\windows\system32\TDSSqqcn.dll
.

((((((((((((((((((((((((((((((((((((((( ³Q§R°£ªºÀÉ®× )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\DRIVERS\yndev.sys
c:\windows\system32\TDSSacun.dll
c:\windows\system32\TDSSqqcn.dll

.
((((((((((((((((((((((((((((((((((((((( ÅX°Ê/ªA°È )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_BCVNSVC
——-\Legacy_CSTMSVC
——-\Legacy_MSPLUGPLAY
——-\Service_bcvnsvc
——-\Service_cstmsvc
——-\Service_MSPlugPlay
——-\Service_yndev


((((((((((((((((((((((((( 2008-11-12 ¦Ü 2008-12-12 ªº·sªºÀÉ®× )))))))))))))))))))))))))))))))
.

2008-12-10 23:28 . 2008-12-10 23:34 d——– C:\Downloads
2008-12-10 23:27 . 2008-12-11 23:43 d——– c:\documents and settings\a\Application Data\GetRight
2008-12-10 23:26 . 2008-12-11 11:15 d——– c:\program files\GetRight
2008-12-10 19:49 . 2008-12-10 19:49 d——– C:\_OTMoveIt

.
(((((((((((((((((((((((((((((((((((((((( ¦b¤T­Ó¤ë¤º³Q­×§ïªºÀÉ®× ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-23 02:19 22,311,160 —-a-w c:\program files\antivir_workstation_winu_en_h.exe
2008-06-21 19:14 14 —-a-w c:\documents and settings\a\getfile.dat
2008-06-18 08:25 74 —-a-w c:\program files\fix.bat
2007-06-03 18:59 9 —-a-w c:\program files\Statement.DailyMonthlyStatement
2007-06-02 03:34 12,336,288 —-a-w c:\program files\tws40_install.exe
2007-01-09 05:51 2,948 —-a-w c:\program files\Report-Scan-20070108-215042.txt
2007-01-09 04:41 47,104 —-a-w c:\program files\ATF-Cleaner.exe
2007-01-09 04:39 6,469,352 —-a-w c:\program files\avgas-setup-7.5.0.50.exe
2007-01-09 03:57 2,855,080 —-a-w c:\program files\aawsepersonal.exe
2007-01-09 03:54 5,037,072 —-a-w c:\program files\spybotsd14.exe
2006-12-13 05:33 13,817,440 —-a-w c:\program files\bitdefender_free_v8.exe
2006-06-04 03:24 102,400 —-a-w c:\documents and settings\a\com_securenetasia_p11wrapper2.dll
2005-11-26 07:10 5,529,600 —-a-w c:\program files\mplayerc.exe
2001-11-23 04:08 712,704 —-a-r c:\windows\inf\OTHER\AUDIO3D.DLL
2004-08-08 14:26 520 –sh–w c:\windows\system32\smdsbsrv.sys
.

((((((((((((((((((((((((((((((((((((( ­«­nµn¤JÂI ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*ª`·N* ªÅ¥Õ»P¦Xªk¯Ê¬Ùµn¿ý±N¤£·|³QÅã¥Ü
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-13 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-24 266497]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"VTTimer"="VTTimer.exe" [2005-03-07 c:\windows\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 c:\windows\system32\VTTrayp.exe]

c:\documents and settings\a\Start Menu\Programs\Startup\
Check for TWS Updates.lnk - c:\jts\WiseUpdt.exe [2007-06-01 194775]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GetRight.lnk - c:\program files\GetRight\GetRight.exe [2008-12-10 4628752]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
cstmsvc REG_MULTI_SZ cstmsvc
bcvnsvc REG_MULTI_SZ bcvnsvc
MSPlugPlay REG_MULTI_SZ MSPlugPlay
.
.
——- ¦Ó¥~ªº±½´y ——-
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: Download with GetRight - c:\program files\GetRight\GRdownload.htm
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Open with GetRight Browser - c:\program files\GetRight\GRbrowse.htm
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\QuickTax 2007\ic2007pp.dll

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

- c:\windows\Downloaded Program Files\smsx.inf

c:\windows\Downloaded Program Files\TNSSPPC.dll - c:\windows\Downloaded Program Files\DataStore.dll
c:\windows\Downloaded Program Files\IEZoneHlp.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\EWinECertRegAX.dll
O16 -: {3AC7F64E-6154-47B0-82B5-764ED4077F77}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\DataStore.dll - c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\TNSSPPC.dll
c:\windows\Downloaded Program Files\IEZoneSet.exe
c:\windows\Downloaded Program Files\IEZoneHlp.dll
O16 -: {8A4943CC-1950-44F9-9045-D3D428FD3948}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\eWinCtl.inf

c:\windows\Downloaded Program Files\IEZoneHlp.dll - c:\windows\Downloaded Program Files\EWinECertRegAX.dll
c:\windows\Downloaded Program Files\CONFLICT.1\EWinSecurityAX.dll
c:\windows\Downloaded Program Files\EWinSKey.dll
c:\windows\Downloaded Program Files\CONFLICT.1\IEZoneSet.exe
O16 -: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1}
hxxp://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
c:\windows\Downloaded Program Files\CONFLICT.1\eWinCtl.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-11 23:47:13
Windows 5.1.2600 Service Pack 2 NTFS

±½´y³QÁôÂ꺶iµ{¡C¡C¡C …

±½´y³QÁôÂ꺱ҰʲաC¡C¡C

±½´y³QÁôÂ꺤å¥ó¡C¡C¡C

±½´y§¹¦¨
³QÁôÂêºÀÉ®×: 0

**************************************************************************
.
———————— ¨ä¥L¹B¦æ¶iµ{ ————————
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\windows\system32\conime.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
§¹¦¨®É¶¡: 2008-12-11 23:49:58 - ¹q¸£¤w­«·s±Ò°Ê
ComboFix-quarantined-files.txt 2008-12-12 07:49:36
ComboFix2.txt 2008-12-12 05:50:11

Pre-Run: 73,825,181,696 bytes free
Post-Run: 73,814,552,576 bytes free

153


Here is the Malwarebytes log:

Malwarebytes' Anti-Malware 1.31
Database version: 1492
Windows 5.1.2600 Service Pack 2

12/12/2008 12:04:31 AM
mbam-log-2008-12-12 (00-04-31).txt

Scan type: Quick Scan
Objects scanned: 44713
Time elapsed: 6 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\NetworkService\Cookies\MM2048.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\MM256.DAT (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\bumo.reg (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jababug.inf (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\uwux.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\jiceji._sy (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\esycire._dl (Fake.Dropped.Malware) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Cookies\syssp.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\WINDOWS\system32\TDSSwghd.log (Trojan.TDSS) -> Quarantined and deleted successfully.


and here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:12:27 AM, on 12/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\GetRight\GetRight.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_06\bin\jucheck.exe
E:\HijackThis.exe

O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
O4 - Global Startup: GetRight.lnk = C:\Program Files\GetRight\GetRight.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Norton Confidence Online - {144FDEB7-A23D-4D39-A00E-AA44195535B6} - C:\WINDOWS\wcidButton.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.epost.ca/printing/smsx.cab
O16 - DPF: {3AC7F64E-6154-47B0-82B5-764ED4077F77} (DataStorage Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {8A4943CC-1950-44F9-9045-D3D428FD3948} (SecureX Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {8DE6AB9C-8C62-486B-8C06-5C9AD6FD06F1} (DataStore Class) - http://txn02.hkjc.com/BetSlip/object/eWinCtl.cab
O16 - DPF: {CCC46940-DED0-476C-A27E-115B10DAE0B4} - http://td.nortonconfidenceonline.com/plug-in/WSAS.cab
O18 - Protocol: intu-qt2007 - {026BF40D-BA05-467B-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll
O23 - Service: Avira AntiVir Personal !V Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal !V Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

–
End of file - 5076 bytes
Post #12
cece,

Well done. :thumbup:

Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 11…allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

I wan't to make sure we've gotten everything so I want to run an online scanner. This scanner takes hours to run. To keep the timeframe to a minimun, first lets run a cleaning tool that will eliminate temp files.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #13
Hi Tomk, Here is the report from the online scan: ——————————————————————————– KASPERSKY ONLINE SCANNER 7 REPORT Saturday, December 13, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, December 13, 2008 07:35:32 Records in database: 1457341 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Files scanned: 23641 Threat name: 2 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 01:01:32 File name / Threat name / Threats count C:\Program Files\Microsoft Office\OFFICE11\1033\CLRCHK.JSP Infected: Worm.Win32.Fujack.al 1 C:\Program Files\Microsoft Office\OFFICE11\1033\FONTLIST.JSP Infected: Worm.Win32.Fujack.al 1 C:\_OTMoveIt\MovedFiles\12102008_194954\windows\system32\winsrc.dll Infected: Trojan.Win32.FraudPack.hpn 1 The selected area was scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI