recent infection fixed?

[jsurfer]

hello, hope this question is in the right place....

I recently downloaded malware bytes and ran it in order to take out a virus I acquired and basically I was hoping to post the logs and see if anyone could tell me if my computer is still at risk. Im pretty ignorant with these types of computer problems so any help is appreciated. Thanks!

Malwarebytes' Anti-Malware 1.42

Database version: 3289

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

12/15/2009 10:08:33 PM

mbam-log-2009-12-15 (22-08-24).txt

Scan type: Full Scan (C:\|)

Objects scanned: 244896

Time elapsed: 3 hour(s), 6 minute(s), 56 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 1

Registry Keys Infected: 63

Registry Values Infected: 4

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 6

Memory Processes Infected:

C:\Documents and Settings\Joshua Lichtenstein\Local Settings\Application Data\ahxeaq\ydeosysguard.exe (Trojan.FakeAlert) -> No action taken.

Memory Modules Infected:

C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> No action taken.

Registry Keys Infected:

HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_CLASSES_ROOT\TypeLib\{204b1584-0186-4437-a3bd-c906d1bcf14c} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{098b204f-5f2b-4b3e-ae13-3bed69f003db} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{0dc0a3fb-c325-45e4-82ab-371c6cdb486a} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{163a4da7-b7b9-4cc7-a865-77061e17ecc7} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{1ba2fcdb-cc67-4a75-a73e-50d0d7c531c8} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{28fdc90c-04a9-473a-97d0-b312869592c1} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{2a154a3b-658d-4c0d-9a5f-98c9d954a98e} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{32c68143-39d4-4172-b47a-5f16d19e1ccd} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{4c6f1984-b3c1-419e-b381-3b9a61087dec} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{575cdbf7-ad36-4a3d-87a1-4f424fd71037} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{64b24cdb-0c6c-4b5c-a450-70a79dab6a7f} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{707d5de3-f02f-494c-80e5-a3142fd83b36} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{8116ab94-d0f1-4a5a-88e8-da8ec7fe0f28} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{9cbb8b2a-a310-478b-acb6-77f9a625d658} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{9ee406a8-449e-4c1e-96a0-844622f37bdd} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{a1691c21-fbb5-4352-b4d4-8d4986e4c0d5} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{a68985c7-7bd4-4746-a403-2422c44d009b} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{af84ce05-7a9b-4b6c-affa-6deae963c348} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{b0b4d3d0-f48b-4983-85fc-d270695a7a77} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{b0de31e7-7fed-4edc-ad31-46ba2974a309} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{ca5c1a05-5443-4714-b8de-5a07997578c1} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{cd5ae38f-12f2-488e-b05a-ccf517741de2} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{d2e5b5f7-3cbc-478e-970b-2da527de2474} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{d3310f84-054a-44cd-a1d4-805498fab802} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{df5e6bb4-2f51-4f22-aa7c-25fe8949fbb6} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{ed2356d0-ec74-4776-96d1-5931303b31fe} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{fbba9cc1-582b-41f5-bf73-815ffd9f61f6} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{00fcf476-2ad7-463a-b6e7-fc89bd63f4c5} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{016943b8-20df-48ff-825b-14a8fcd8e5a9} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{0dc914de-3ade-40b8-9ec2-f2004e13ecb4} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{27ba9c47-b17d-4542-902b-94f39634ecbe} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{27c46290-3428-4502-8ea4-432f29339239} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{2b3156f6-7075-43fd-916e-81783a8efa7d} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{314b6250-ee39-47c9-a4f2-1ca494a48211} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{36d85f81-0134-4883-8e46-6e658efc8636} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{49d3a9a7-9032-4b0a-b608-d4c1b7389a73} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{4a3374a4-0aa6-4337-832b-598f22e41940} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{52b48bf7-afb8-4536-b573-134401fa9635} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{59f59afa-f295-45e2-9535-f87f50d97024} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{6cd510f8-2dc2-4201-ba86-0174de34bba7} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{6e477099-527d-497e-b27f-6cc261e84f2a} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{8ba59d35-835f-4933-857b-b42b2c05d903} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{a1597329-c00b-4cbb-971b-9adddd842da4} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{a4f9e584-77ae-4221-90f3-6a17455e9305} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ac09fa85-d7e5-4157-a1a1-9637082dfa3a} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ac0fc0d1-7e06-4187-b459-e2cec25d2f44} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{b653535b-1c77-4a2b-813b-f235253a671f} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{baf25a6d-2799-4b0a-a42a-0fa860d3407d} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{bb111819-cf3f-4f88-a7c1-4df59f191006} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ccc5bcc2-1d28-4ac3-aa11-f9bdd1d57b4e} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{d130231f-6829-41b1-95ce-f7b1c015f291} (Trojan.Hijacker) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{ded9d2b3-a824-47b8-a48b-7aa93d8e9cd2} (Trojan.Hijacker) -> No action taken.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uybkxhkj (Trojan.FakeAlert) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uybkxhkj (Trojan.FakeAlert) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> No action taken.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Joshua Lichtenstein\Local Settings\Application Data\ahxeaq\ydeosysguard.exe (Trojan.FakeAlert) -> No action taken.

C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> No action taken.

C:\Documents and Settings\Joshua Lichtenstein\Local Settings\Temp\4241.exe (Spyware.Passwords) -> No action taken.

C:\Program Files\InterMute\SpySubtract\ssengine.dll (Trojan.Hijacker) -> No action taken.

C:\WINDOWS\system32\autorun.inf (Malware.Trace) -> No action taken.

C:\Documents and Settings\Joshua Lichtenstein\results.txt (Malware.Trace) -> No action taken.

[Firefox]

Just a few comments:

Hello jsurfer, and welcome to Malwarebytes.org

1. You performed a full scan using Database version: 3289. You can just run a quick scan, but first update because the latest Database version is 3376.

2. Did you let MBAM do its job and tell it to remove the selected items that were found? If you did not then you are still infected.

and last:

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someon has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

[jsurfer]

Thanks! I let the program do its job and it said it deleted everything so I guess I am just paranoid!

[AdvancedSetup]

You need to update the program and scan again after the reboot.

Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
    

  [*]When the update is complete, select the Scanner tab

  [*]Select Perform quick scan, then click Scan.

  [*]When the scan is complete, click OK, then Show Results to view the results.

  [*]Be sure that everything is checked, and click Remove Selected.

  [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
    

The current definitions are: 3376

[Firefox]

you could run another quick scan after you update to verify you are now clean

[jsurfer]

Haha, that is exactly what I decided to do! Thanks again.

[Firefox]

No problem glad we could help, come back if you have any further questions.