Infected Finance Computer

[poolplayr]

I discovered an infected finance computer here at work and ran Malwarebytes and it reported:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4384

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/3/2010 9:16:38 AM

mbam-log-2010-08-03 (09-16-38).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 218699

Time elapsed: 37 minute(s), 16 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe D:\DOCUME~1\HERRIN~1\LOCALS~1\Temp\svchost.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

D:\Documents and Settings\herringtonsm\Local Settings\Temp\svchost.exe (Spyware.Zbot) -> Quarantined and deleted successfully.

D:\Documents and Settings\herringtonsm\Local Settings\Temporary Internet Files\Content.Outlook\I94B6CCE\DHL_INVOICE34 (2)\DHL_INVOICE34.xls__________________________________________________________

________________________________.exe (Trojan.Email.Gen) -> Quarantined and deleted successfully.

Malwarebytes took care of the problem but my question is, Is there a chance that any information was leaked from this computer as this is a finance computer?

[miekiemoes]

Hi,

Malwarebytes took care of the problem but my question is, Is there a chance that any information was leaked from this computer as this is a finance computer?

Unfortunately yes. Zbot is an info&password stealer, so the first action to take here is to change passwords.

[miekiemoes]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.