Jump to content

Viruses I can't get rid of are back

havoc
 Share

Recommended Posts

havoc

havoc

Posted
Posted

Not sure what happened to my other post.. But i just re ran malwarebytes again and this is the new log.. went from the few in my last post to a multiple amount of virus's along with xp delux protector popped up.. I havent' downloaded anything new since reinstalling window's not sure where they are coming from..Anyway here is the new log thanks for any help

Malwarebytes' Anti-Malware 1.38

Database version: 2374

Windows 5.1.2600 Service Pack 2

7/5/2009 10:48:54 PM

mbam-log-2009-07-05 (22-48-54).txt

Scan type: Quick Scan

Objects scanned: 88306

Time elapsed: 4 minute(s), 16 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 4

Registry Keys Infected: 16

Registry Values Infected: 10

Registry Data Items Infected: 4

Folders Infected: 0

Files Infected: 30

Memory Processes Infected:

c:\WINDOWS\pp10.exe (Worm.Koobface) -> Unloaded process successfully.

c:\WINDOWS\ld12.exe (Worm.KoobFace) -> Unloaded process successfully.

Memory Modules Infected:

C:\WINDOWS\system32\mkfght1.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\gdi32lib.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\afmain4.dll (Spyware.OnlineGames) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{b360243e-09e8-402f-8721-00b6798089ad} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4b66e1df-4de3-4cda-83b5-11673eadab0b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\XP Deluxe Protector (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\vmwareapp.vmware (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\vmwareapp.vmware.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVDRV (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRV (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pp (Worm.Koobface) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ertyuop (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kava (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xpprotect (Rogue.DeluxeProtector) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\drv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\gdi32lib.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mkfght1.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\pp10.exe (Worm.Koobface) -> Quarantined and deleted successfully.

c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.

C:\WINDOWS\system32\rttrwq.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\afmain4.dll (Spyware.OnlineGames) -> Delete on reboot.

c:\WINDOWS\system32\mkfght0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\autorun.inf (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\il0byu3h.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\Temp\32n1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\Temp\32n2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\Temp\32n3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\DHBGV97V\zz[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\OW9GU7XN\pdrv[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\P3ZIMJQV\pp.10[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\Q9E4SS2Z\gdi32lib[1].dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kavo0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kavo.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\WINDOWS\ld12.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Brian\Local Settings\Temp\olhrwef.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\afmain0.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\afmain1.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\afmain2.dll (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\afmain3.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\AhnRpta.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

c:\documents and settings\Brian\Start Menu\XP Deluxe Protector.LNK (Rogue.DeluxeProtector) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\e8main0.dll (Worm.Autorun) -> Quarantined and deleted successfully.

C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.

c:\WINDOWS\0101120101464849.dat (Worm.KoobFace) -> Quarantined and deleted successfully.

C:\Program Files\drv\drv.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

You need to bookmark where you post so you can come back, or subscribe to the post. Anyway, I'll delete your other post.

The scan shows stuff is coming from the Internet cache so it is from some site you're visiting.

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:
how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.

Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

Note:

The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

Link to post
Share on other sites
havoc

havoc

Posted
  • Author
Posted

Ya i was sure i know the site that the xp defender thing or w/e it was came from because i got a pop up for it and it never went away even after i restarted my computer. You said get aviera or w/e it was called? I have no anti virus installed yet. I used to use that free avg just not sure which was better before i reinstall this time... here's my combo log

ComboFix 09-07-05.01 - Brian 07/05/2009 23:06.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.780 [GMT -4:00]

Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\86l2qw.bat

c:\windows\system32\e1000msg.dll

c:\windows\system32\winlogonbackup.exe.exe

C:\x.bat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_AVPsys

((((((((((((((((((((((((( Files Created from 2009-06-06 to 2009-07-06 )))))))))))))))))))))))))))))))

.

2009-07-06 02:41 . 2009-07-06 02:53 -------- d-----w- c:\program files\drv

2009-07-05 20:35 . 2004-10-15 23:18 502272 ----a-w- c:\windows\system32\winlogon.exe

2009-07-05 20:32 . 2004-10-15 23:18 502272 ----a-w- c:\windows\system32\dllcache\winlogon.exe

2009-07-05 04:57 . 2009-07-05 04:57 -------- d-s---w- c:\documents and settings\Brian\UserData

2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\documents and settings\Brian\Application Data\Aim

2009-07-05 04:56 . 2009-07-05 21:24 -------- d-----w- c:\program files\Viewpoint

2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\program files\AOD

2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint

2009-07-05 04:56 . 2004-02-25 17:05 348160 ----a-w- c:\windows\system32\msvcr71.dll

2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\program files\AIM

2009-07-05 04:32 . 2009-07-05 04:32 -------- d--h--w- c:\windows\system32\GroupPolicy

2009-07-05 04:30 . 2009-07-05 04:30 107299 --sh--r- C:\xerp8nj.exe

2009-07-05 04:29 . 2009-07-05 04:29 410976 ----a-w- c:\windows\system32\deploytk.dll

2009-07-05 04:29 . 2009-07-05 04:29 -------- d-----w- c:\program files\Java

2009-07-05 04:28 . 2009-07-05 04:28 152576 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_10\lzma.dll

2009-07-04 23:56 . 2004-05-26 21:54 15781 ----a-w- c:\windows\system32\drivers\mdc8021x.sys

2009-07-04 23:56 . 2005-02-02 01:18 17992 ----a-w- c:\windows\system32\bcm42rly.sys

2009-07-04 23:56 . 2003-11-21 05:03 651264 ----a-w- c:\windows\system32\libeay32.dll

2009-07-04 23:56 . 2003-11-21 05:03 147456 ----a-w- c:\windows\system32\ssleay32.dll

2009-07-04 23:56 . 2003-11-21 05:03 479232 ----a-w- c:\windows\system32\AegisE5.dll

2009-07-04 23:56 . 2003-10-13 22:30 94208 ----a-w- c:\windows\system32\GTW32N50.dll

2009-07-04 23:56 . 2003-09-26 05:15 15872 ----a-w- c:\windows\system32\GTNDIS5.sys

2009-07-04 23:56 . 2009-07-04 23:56 -------- d-----w- c:\program files\Linksys Wireless-G USB Wireless Network Monitor

2009-07-04 23:55 . 2009-07-04 23:55 -------- d-----w- C:\Linksys Driver

2009-07-04 23:52 . 2003-08-29 17:26 125952 ----a-w- c:\windows\system32\drivers\e1000325.sys

2009-07-04 23:52 . 2003-07-28 13:55 24064 ----a-w- c:\windows\system32\IntelNic.dll

2009-07-04 23:52 . 2003-03-03 23:26 118784 ----a-w- c:\windows\system32\Prounstl.exe

2009-07-04 23:51 . 2009-07-04 23:51 -------- d-----w- c:\program files\Intel

2009-07-04 23:49 . 2009-07-04 23:56 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-07-04 23:49 . 2009-07-04 23:49 -------- d-----w- c:\program files\Realtek

2009-07-04 23:49 . 2004-07-29 23:31 8845312 ------w- c:\windows\RTLCPL.exe

2009-07-04 23:49 . 2004-07-29 20:04 2216128 ------w- c:\windows\system32\drivers\RtkHDAud.Sys

2009-07-04 23:49 . 2004-07-29 01:34 2551808 ------w- c:\windows\alcwzrd.exe

2009-07-04 23:49 . 2004-07-29 00:40 77824 ------w- c:\windows\SoundMan.exe

2009-07-04 23:49 . 2004-06-29 01:50 192512 ------w- c:\windows\system32\RTCOMDLL.dll

2009-07-04 23:49 . 2004-02-27 17:10 156160 ------w- c:\windows\system32\RtlCPAPI.dll

2009-07-04 23:49 . 2009-07-04 23:49 -------- d-----w- c:\program files\Common Files\InstallShield

2009-07-04 23:49 . 2009-07-05 20:34 -------- d-----w- c:\windows\system32\DllCache

2009-07-04 21:53 . 2009-07-04 21:53 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Yahoo

2009-07-04 21:53 . 2009-07-04 21:53 13104 ----a-w- c:\documents and settings\Brian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-07-04 21:48 . 2009-07-04 21:48 -------- d-----w- c:\program files\Common Files\Adobe AIR

2009-07-04 21:47 . 2009-07-04 21:47 -------- d-----w- c:\program files\Common Files\Adobe

2009-07-04 21:43 . 2009-07-04 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!

2009-07-04 21:43 . 2009-05-27 02:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

2009-07-04 21:43 . 2009-07-04 21:43 -------- d-----w- c:\program files\Yahoo!

2009-07-04 21:28 . 2005-12-18 17:30 6400 ----a-w- c:\windows\system32\drivers\splitter.sys

2009-07-04 21:28 . 2005-12-18 17:30 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys

2009-07-04 21:28 . 2005-12-18 17:30 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys

2009-07-04 21:28 . 2005-12-18 17:30 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys

2009-07-04 21:28 . 2005-12-18 17:30 142464 ----a-w- c:\windows\system32\drivers\aec.sys

2009-07-04 21:28 . 2005-12-18 17:30 171776 ----a-w- c:\windows\system32\drivers\kmixer.sys

2009-07-04 21:28 . 2005-12-18 17:30 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys

2009-07-04 21:28 . 2005-12-18 17:30 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys

2009-07-04 21:28 . 2005-12-18 17:30 7552 ----a-w- c:\windows\system32\drivers\MSKSSRV.sys

2009-07-04 21:28 . 2005-12-18 17:30 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys

2009-07-04 21:27 . 2005-12-18 17:30 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys

2009-07-04 21:27 . 2005-12-18 17:30 4096 ----a-w- c:\windows\system32\ksuser.dll

2009-07-04 21:27 . 2005-12-18 17:30 60288 ----a-w- c:\windows\system32\drivers\drmk.sys

2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\documents and settings\Brian\Application Data\Malwarebytes

2009-07-04 21:23 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-04 21:23 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-05 00:00 . 2009-07-04 12:53 86811 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-07-04 23:54 . 2009-07-04 23:53 -------- d-----w- c:\program files\ATI Technologies

2009-07-04 12:50 . 2009-07-04 12:50 21640 ----a-w- c:\windows\system32\emptyregdb.dat

2009-07-04 12:49 . 2009-07-04 12:49 -------- d-----w- c:\program files\Windows Plus

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-05 136600]

"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" - c:\windows\system32\Hdaudpropshortcut.exe [2004-03-17 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"8085:TCP"= 8085:TCP:drv

R2 WUSB54GSSVC;WUSB54GSSVC;c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe [7/4/2009 7:56 PM 41025]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.altavista.com/

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-05 23:08

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\netdde.exe

c:\windows\ehome\ehRecvr.exe

c:\windows\ehome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GS.exe

c:\windows\system32\dllhost.exe

c:\windows\ehome\ehmsas.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-07-06 23:09 - machine was rebooted

ComboFix-quarantined-files.txt 2009-07-06 03:09

Pre-Run: 27,535,749,120 bytes free

Post-Run: 27,704,389,632 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

150

Link to post
Share on other sites
havoc

havoc

Posted
  • Author
Posted

downloaded that and ran a scan and got a lot more off of it.... here's the log

Avira AntiVir Personal

Report file date: Monday, July 06, 2009 00:12

Scanning for 1448372 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 2) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : TONY-1602904BF7

Version information:

BUILD.DAT : 9.0.0.403 17961 Bytes 6/3/2009 17:05:00

AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 14:14:47

AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 15:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 16:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 15:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36

ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 04:08:53

ANTIVIR2.VDF : 7.1.4.173 306688 Bytes 7/2/2009 04:08:55

ANTIVIR3.VDF : 7.1.4.182 52224 Bytes 7/5/2009 04:08:56

Engineversion : 8.2.0.204

AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 16:52:04

AESCRIPT.DLL : 8.1.2.13 426362 Bytes 7/6/2009 04:09:11

AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 16:02:01

AERDL.DLL : 8.1.2.2 438642 Bytes 7/6/2009 04:09:09

AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 21:07:20

AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/6/2009 04:09:06

AEHEUR.DLL : 8.1.0.137 1823095 Bytes 7/6/2009 04:09:05

AEHELP.DLL : 8.1.3.6 205174 Bytes 7/6/2009 04:08:59

AEGEN.DLL : 8.1.1.48 348532 Bytes 7/6/2009 04:08:57

AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 19:32:40

AECORE.DLL : 8.1.6.12 180599 Bytes 5/27/2009 21:07:20

AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 19:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 13:47:59

AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 15:32:15

AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 19:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 15:32:09

AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 20:05:41

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 15:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 20:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 13:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 15:32:10

RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 20:39:58

RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 15:19:48

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: Monday, July 06, 2009 00:12

Starting search for hidden objects.

'19925' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'msiexec.exe' - '1' Module(s) have been scanned

Scan process 'YahooMessenger.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'yupdater.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'WUSB54GS.exe' - '1' Module(s) have been scanned

Scan process 'WLService.exe' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehRecvr.exe' - '1' Module(s) have been scanned

Scan process 'netdde.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

35 processes with 35 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

Master boot sector HD3

[iNFO] No virus was found!

Master boot sector HD4

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '52' files ).

Starting the file scan:

Begin scan in 'C:\'

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\xerp8nj.exe

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\Documents and Settings\Brian\Desktop\ComboFix.exe

[0] Archive type: RAR SFX (self extracting)

--> 32788R22FWJFW\n.pif

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

C:\Qoobox\Quarantine\C\86l2qw.bat.vir

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\Qoobox\Quarantine\C\x.bat.vir

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000302.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000303.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000313.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000319.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000323.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000342.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000350.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000357.exe

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000363.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000376.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000379.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000381.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000402.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000404.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000405.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000406.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000414.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000417.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000419.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000431.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000434.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000435.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000436.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000442.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000443.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000444.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000461.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000469.exe

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000470.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000473.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000475.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000485.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000491.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000492.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000493.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000494.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000514.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000519.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000520.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001540.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001545.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001547.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001565.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001570.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001572.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001578.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001583.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001584.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001585.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001586.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001587.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001602.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001603.exe

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001604.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001605.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001606.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001607.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001608.exe

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001609.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001616.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001617.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001618.dll

[DETECTION] Is the TR/Trash.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001646.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001649.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001707.pif

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

Beginning disinfection:

C:\xerp8nj.exe

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '4ac37b38.qua'!

C:\Documents and Settings\Brian\Desktop\ComboFix.exe

[NOTE] The file was moved to '4abe7b42.qua'!

C:\Qoobox\Quarantine\C\86l2qw.bat.vir

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '4abd7b09.qua'!

C:\Qoobox\Quarantine\C\x.bat.vir

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4ab37b01.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000302.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

[NOTE] The file was moved to '4a817b03.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000303.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4beba134.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000313.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

[NOTE] The file was moved to '4be7c014.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000319.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49c5a674.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000323.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49c49e3c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000342.dll

[DETECTION] Is the TR/Vundo.Gen Trojan

[NOTE] The file was moved to '49c79604.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000350.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49c68fcc.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000357.exe

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49c98794.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000363.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49cb7f5c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000376.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49ca7724.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000379.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4bea9afc.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000381.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49cd68ec.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000402.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49cc60b4.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000404.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49cf587c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000405.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

[NOTE] The file was moved to '49ce5044.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000406.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49d1480c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000414.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49d041d4.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000417.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49d3399c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000419.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49d23164.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000431.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49d5292c.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000434.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49d422f4.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000435.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

[NOTE] The file was moved to '49d71abc.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000436.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49d61284.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000442.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '4a817b04.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000443.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

[NOTE] The file was moved to '49d80215.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000444.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49dbfbdd.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000461.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49daf3a5.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000469.exe

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49ddeb6d.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000470.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49dce335.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000473.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49dfe4fd.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000475.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49dedcc5.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000485.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '4a817b05.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000491.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49e0cc56.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000492.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

[NOTE] The file was moved to '49e3c41e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000493.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49e2bde6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000494.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49e5b5ae.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000514.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49e4ad76.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000519.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49e7a53e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000520.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49e69d06.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001540.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49e996ce.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001545.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49e88e96.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001547.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49eb865e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001565.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49ed7e26.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001570.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49ec77ee.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001572.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49ef6fb6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001578.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49ee677e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001583.com

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49f15f46.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001584.inf

[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus

[NOTE] The file was moved to '49f0570e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001585.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '49f348d6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001586.exe

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '49f2409e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001587.dll

[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan

[NOTE] The file was moved to '49f53866.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001602.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49f4302e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001603.exe

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49f729f6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001604.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49f621be.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001605.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49f91986.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001606.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49f8114e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001607.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49fb0916.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001608.exe

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49fa02de.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001609.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49fdfaa6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001616.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49fcf26e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001617.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49ffea36.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001618.dll

[DETECTION] Is the TR/Trash.Gen Trojan

[NOTE] The file was moved to '49fee3fe.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001646.bat

[DETECTION] Is the TR/Drop.Agent.ahdz Trojan

[NOTE] The file was moved to '4901dbc6.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001649.bat

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

[NOTE] The file was moved to '4900d38e.qua'!

C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001707.pif

[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

[NOTE] The file was moved to '4905a1e6.qua'!

End of the scan: Monday, July 06, 2009 00:17

Used time: 04:32 Minute(s)

The scan has been done completely.

1642 Scanned directories

66743 Files were scanned

69 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

69 Files were moved to quarantine

0 Files were renamed

1 Files cannot be scanned

66673 Files not concerned

556 Archives were scanned

1 Warnings

70 Notes

19925 Objects were scanned with rootkit scan

0 Hidden objects were found

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

I'll close your post so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Remove all but the most recent Restore Point on Windows XP

You should
Create a New Restore Point
to prevent possible reinfection from an old one.

Some of the malware you picked up could have been saved in System Restore.

Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.

Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to
"roll-back"
to a clean working state.

The easiest and safest way to do this is

:
  • Go to
    Start
    >
    Programs
    >
    Accessories
    >
    System Tools
    and click "
    System Restore
    ".
  • If the shortcut is missing you can also click on
    START
    >
    RUN
    > and type in
    %SystemRoot%\system32\restore\rstrui.exe
    and click OK

  • Choose the radio button marked "
    Create a Restore Point
    " on the first screen then click "
    Next
    ".

  • Give the new Restore Point a name, then click "
    Create
    ".

  • The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

  • Then use the
    Disk Cleanup
    to remove all but the most recently created Restore Point.
  • Go to
    Start
    >
    Run
    and type:
    Cleanmgr.exe

  • Select the drive where Windows is installed and click "
    Ok
    ". Disk Cleanup will scan your files for several minutes, then open.

  • Click the "
    More Options
    " tab, then click the "
    Clean up
    " button under System Restore.

  • Click Ok. You will be prompted with "
    Are you sure you want to delete all but the most recent restore point?
    "

  • Click
    Yes
    , then click Ok.

  • Click
    Yes
    again when prompted with "
    Are you sure you want to perform these actions?
    "

  • Disk Cleanup will remove the files and close automatically.

  • On the
    Disk Cleanup
    tab, if the
    System Restore: Obsolete Data Stores
    entry is available remove them also.

  • These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.

selectdrivecleanup.pngselectdrivecleanup1.png

Additional information

Microsoft KB article: How to turn off and turn on System Restore in Windows XP

Bert Kinney's site: All about Windows System Restore

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster

Download it from here

Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol

Download it from here

Here you can find information about how WinPatrol works here

Install FireTrust SiteHound

You can find information and download it from here

Install hpHosts

Download it from here

hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,

tracking and malicious websites. This prevents your computer from connecting to these untrusted sites

by redirecting them to 127.0.0.1 which is your own local computer.

hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Secunia Software Inspector

F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.

http://www.update.microsoft.com

Note 1: If you are running Windows XP SP2, you should upgrade to SP3.

Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.

The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

I recommend Online Armor Free

A little outdated but good reading on how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructions

Also don't forget that we offer FREE assistance with General PC questions and repair here PC Help

If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.