brianleemack Posted October 1, 2009 ID:136452 Share Posted October 1, 2009 Despite being protected byPrevx CSI 3.0and Avast!And despite having run MBAM just 5 days ago, this morning MBAM reported this:How concerned should I be, and just what is this. Main question: Since I had done an FTP upload to my website just prior to running MBAM should I be concerned that my website is infected with this Trojan?Registry Keys Infected:HKEY_CLASSES_ROOT\CLSID\{52c01a76-19e2-4a50-ae8a-38ffbccf9182} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\TypeLib\{90f3d7b3-92e7-44ba-b444-6a8e2a3bc375} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{4921908c-7090-4d37-a6b3-fc447f08378a} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{750fc67c-0311-4391-9864-a2efed49bd28} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{f3fc950c-7583-4377-bad8-efbeaa33273c} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{0944d16c-d0f4-4389-982a-a085595a9eb3} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{3831331e-0d11-4716-871d-68f3b11d23c9} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{3dcd2bc5-8489-48ae-891f-90c8b2f19f56} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{5954ea75-9bfa-461a-bd34-cea3a861ff19} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{762ec429-1a5d-4ab8-844a-9a552e1241da} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{a506ef88-9efc-4522-bfe1-a8e886a64d80} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{a5704c37-40da-49ef-904b-97e5f5f9b1c5} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{b87799af-2ce9-4daa-93cf-65f002035369} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{bbc73c94-337c-43cc-b52c-31eb9fa34013} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{c406f816-318d-4f7d-81cb-ba93ca7b70d5} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{d502d4a3-03e6-4eae-a14e-69606ca63430} (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{ec22770d-3343-4c56-8a8d-3e560475f655} (Trojan.Agent) -> Quarantined and deleted successfully.Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\actskin4.ocx (Trojan.Agent) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
mountaintree16 Posted October 1, 2009 ID:136454 Share Posted October 1, 2009 @brianTake a look at the thread here: http://www.malwarebytes.org/forums/index.p...=26416&st=0And see if this might be your issue. (It is a bit long, but shouldn't take too long to read).Edit: If it indeed is not a FP, then you may need to be concerned about your website, yes.If the link I gave you is not your problem, follow Maniac's instructions below my post. Link to post Share on other sites More sharing options...
Maniac Posted October 1, 2009 ID:136455 Share Posted October 1, 2009 Greetings .If you're having trouble getting Malwarebytes' and other tools to update or run please review the following tutorials and see if they are helpful:Windows Police ProCLB Rootkit driver=TDSS/Seneka/GAOPDX/UAC/ovfst/kungsf/SKYNET/MSIVXTotal-Security (FakeAlert)av360 (Fakealert)SystemSecurityIf you aren't able to use those instructions or there are other issues then please follow the instructions here:I'm infected - What do I do now?And post your logs in a new topic here:Malware Removal - HijackThis LogsPlease be sure not to install any software or use any removal or scanning tools except those that you are instructed to by the expert who will be assisting you as doing so can make their job much more difficult.note: if for some reason you are unable to run some or any of the tools in the first link, then skip that step and move on to the next one.If you can't even run HijackThis, then just post here: Malware Removal - HijackThis Logs describing your issues and an expert will reply with further instructions. Link to post Share on other sites More sharing options...
Recommended Posts