sobonito Posted September 30, 2010 ID:321017 Share Posted September 30, 2010 Hi, a couple of weeks ago I got some kind of malware/virus. When I run MBAM, it always finds anywhere from 100-200 infections which it supposedly successfully deletes, but by the next day when I scan again it's the same thing. When I search on google, it's constantly redirecting me to other pages. Also, whatever tab I have open, it will sometimes redirect to a blank page with a box saying that I've been infected with malware and it asks me if I will allow System Security to scan my computer. Whenever this happens, I just close my browser thru task manager because I don't want to risk clicking yes or no.Now, I'm pasting my most recent MBAM log and I've disabled my CD emulation software thru Defogger. However, after I run DDS I get a box saying that my two logs will disappear once I close the dialog box but there are never any logs opened. And when I ran the GMER Rootkit scanner, midway thru the scan my entire screen went black(but you could still tell the screen was on) and it stayed that way for about an hour and then it shut off. Database version: 4028Windows 6.0.6000Internet Explorer 7.0.6000.168519/29/2010 10:17:41 PMmbam-log-2010-09-29 (22-17-41).txtScan type: Quick scanObjects scanned: 157239Time elapsed: 2 hour(s), 0 minute(s), 2 second(s)Memory Processes Infected: 31Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 30Registry Data Items Infected: 0Folders Infected: 0Files Infected: 46Memory Processes Infected:C:\Users\Owner\AppData\Local\Temp\Low\iexplorer.exe (Malware.Packer.Gen) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\Low\Low\iexplorer.exe (Malware.Packer.Gen) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\iexplorer.exe (Malware.Packer.Gen) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\iexplorer.exe (Malware.Packer.Gen) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\iexplorer.exe (Malware.Packer.Gen) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\winamp.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\win.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\debug.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\drweb.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\iexplarer.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\sysedit.exe (Trojan.Downloader) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\services.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\gdi32.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\avp.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\win32.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\winlogon.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\cmd.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\wininst.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\svchost.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\login.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\system.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\lsass.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\avp32.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\1789319677.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\2414507188.exe (Trojan.Downloader) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\hexdump.exe (Trojan.Downloader) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\3336073389.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\1582210954.exe (Trojan.Downloader) -> Failed to unload process.C:\Users\Owner\AppData\Local\Temp\3915454641.exe (Trojan.Downloader) -> Unloaded process successfully.C:\Users\Owner\AppData\Local\Temp\win16.exe (Malware.Packer.Gen) -> Unloaded process successfully.Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngrrc (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngre (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfnglb (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngob (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngmtd (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngupf (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngpta (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngl/ (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngoe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngoeom&p=r0lgodlhyaa8apcaaaaaaiaaaacaaicaaaaagiaagacagicagmdawp8aaad/ap//aaaa//8a/wd//////waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaamwaazgaamqaazaaa/wazaaazmwazzgazmqazzaaz/wbmaabmmwbmzgbmmqbmzabm/wczaaczmwczzgczmqczzacz/wdmaadmmwdmzgdmmqdmzadm/wd/aad/mwd/zgd/mqd/zad//zmaadmamzmazjmamtmazdma/zmzadmzmzmzzjmzmtmzzdmz/znmadnmmznmzjnmmtnmzdnm/zozadozmzozzjozmtozzdoz/zpmadpmmzpmzjpmmtpmzdpm/zp/adp/mzp/zjp/mtp/zdp//2yaagyam2yazmyamwyazgya/2yzagyzm2yzzmyzmwyzzgyz/2zmagzmm2zmzmzmmwzmzgzm/2azagazm2azzmazmwazzgaz/2bmagbmm2bmzmbmmwbmzgbm/2b/agb/m2b/zmb/mwb/zgb//5kaajkam5kazpkamzkazjka/5kzajkzm5kzzpkzmzkzzjkz/5lmajlmm5lmzplmmzlmzjlm/5mzajmzm5mzzpmzmzmzzjmz/5nmajnmm5nmzpnmmznmzjnm/5n/ajn/m5n/zpn/mzn/zjn//8waamwam8wazswamcwazmwa/8wzamwzm8wzzswzmcwzzmwz/8xmamxmm8xmzsxmmcxmzmxm/8yzamyzm8yzzsyzmcyzzmyz/8zmamzmm8zmzszmmczmzmzm/8z/amz/m8z/zsz/mcz/zmz///8aap8am/8azv8amf8azp8a//8zap8zm/8zzv8zmf8zzp8z//9map9mm/9mzv9mmf9mzp9m//+zap+zm/+zzv+zmf+zzp+z///map/mm//mzv/mmf/mzp/m////ap//m///zv//mf//zp///yh5baeaabaalaaaaadiadwaaaj/ap8jheiwomgdcbmqhjjkz8j/1fjfnpiwoswd1c5q3miryyqjeyuszgir5ectcjp6wxmypuct1ekg/pgrysexlm3ehfkr5uwfcdpg5bhtjsijqhnyxjlkj0absqvknapyatsdwh9m5znwakqgro2kfch0oj+gunpi5kruzcspb6k2xbvqq1oybymmbcl17toto00ehvy0qv+ddjpsbcw1rfxggmsivry4a2sszckclstxafjebc+ebu26yokzcixfzwvazmxt1et/zv03lliruid+lekuoz+wrsfsbpga8koammoovvi85duedtnspbl8mvxufipqpp1wns6yymek/646ndn3utk7xl1/1m/m7a7rj4zemfzhos577/r+cbxw4yrlz9xbr4u3lvpxbsafximzjhpsson33wotakrze7/v1rtxo7wvg2hkzczwext+tfjw/6c1m2yl1qxip7/dvxrfueukxhdbzevqc6czlykjlayxxni+qxasiseilkblldqel0zoukbche/25tivapymeh88+yggh7ozl9sfl6pe00poygbrfwrlkokw1w205em29utujhgeokr9cyyw2prmvvrhtykbsadbbelgjumvnevlx4k2lh5dy+yeviqx2lihpudignd1y/gnxenlegzuhj55nmlrgzoq3bqz6v8lfjs+ubfqgkzgbmoz5zlgniy7+tvepjss1cfg9avqox+wnjunwjqx1cjjtslkzqu95vdfbcjaabavkh4k3khjyyymonrh+w2vwbl65pgwoslsey1ct6wm8izzn7upoibcu0tip2lhz15x21xhnsgyzis5i6absnpljapt+yhcfp76i5epflbgmtuomnxqwhbgwsvbsa47168vqauxteeimky7p+b78k7psmhwqyluhfhpu9j5aipwutwfrlritnuzgey6y3sqhxawmlihffu8uzql61ey00xqfipds1c/p19ciekg2hciefk/papnaciomtfnzvbetw8lbjjdac7/tr1ljzo4c7ypxbsjbddgvbpobmv98cujikfvw5dcxnk4iaeb0higyogisoiaobffjkm9bvz0uu1nvdexy6xhbshccujpe01sxhlt96lkvaqksdx/he03yxw6znfbwwiotpaunqnmujzjq+doduv1bmkwmyzyr4//jdhdqn5yondxrxt6wiipgr+olxtj7bl1i6t+3s+jle/mnk/uevxrfv3i2opdhz6uhrugfes91jexxh4xq5icdnixizgzziondikqrbgriaqolhyc6wqo/umo8trwpyuyl1ypolnwjlu0matqn937f7wqazw4akgyv/szscxgvctjqw70ugm0/0wei3+vbyfm6+crkbyvg5ekzig5yrnp57+xtfaoc5kdvdk2qkh9beb6erezmsyswxfigkns4rgcf7lcwmxffquriosyrmljqzjqs0i+dim52iwmtzrsmuso2c3a4ohzuioj0m74m1ozc4u9yt2gndyfxxwtkptbzr2xz7lgxssohutfnoixkzytkykjyqdwkaut3qywkkk5gmy8q8rujq59ydykv6iun5btkghlmzot5fknltzreqrqimnkssddmcrvsdfi7fqctky50l6l/n9qchcyhrknwivdi+pihzbqaepgqwmkjaulgmkyx3vhw1mciokj4ktfiuje2mqak/+f2hzovenx3ho8gbxywcriaxhc1s71tjzijldpghd6imhq08bzf1aairbjbcwcmdjir6xvjwe0nfw+sylgvbewzzc0g/5hiasmxceogjrzwprmj3ndw6jzugdjpgegzmq04pasfhwwkja62j/bn6qoti6jdbkh3v6p0ohokczslkufocquknlklg50huzq1czg6tguiwqfsravsbiczxkpcqja0fiyq3rom4fyyeqnysthasxbf0km6jbjv7i9rj3u7m9fneutmj6kqwqv5q5nch43sfcwccwyo9dnfnh1jzn92dlvwgdsmvjssxf0n+jgy8zo3m9oc/miw14xncl/aqhhbs3jvcwuv7f5eqygpbpxrnsvn8irmw8uk1t8lzojwshmt5xxfujllnypjzjuhotvyihdl8axsyqikmsy6zzduxiwz+ostrhonph+p3vg/jzhkbamhv3ucisdlulwy5tkizetjc1a2fpkyiahffese64lntqfyvqte1htkggi6se+9dbmdeziremkxi+p1lcyiesam/gvou3ivzdkpu42jr/9vuwhxizxxfyitgfikwnjjavx8iere30lj/sdi05ilgk3ukdswhxmwo7ilejczfbc7kujtoo81usslxg0r5bxqqeja5m+btmmj5vd4r6s2iczxlfz4lbmhllm/6vikh3acixqiw1wif3td4yvymmp6zdpzwrgs+l30opgesmhcnkq6dvrxtgnhesyflv/vdaipiyxp2bcrjpqyg7xalryewgkadtn0terky9n359rez5v0wup9sxnqrlmqwzhanbk0nmly+vp7bumyndmiduw0+ekugvh6cojifddm2zrgqmh6tbblty2+j4xmeds56ifxu9zcmw3olv2lidvqhb/btgdk/zwoahm5gpoz/icbai5pbz+ldq6v8q3kdcsei4hzbhcii9bllq1paxhnxgm3rwhrs0bayvx5vjnr0tqj4ktjpua3rcp5uswgd/kzwf2rdd8m2fs1iszyp+cubd922thk+x74ciprnlyrn4p2obzwhudn+ljd9auurijj+tm+2wxb8mysgnvrel+1flwqj5vdtfm1hpzbjpzv/vgs1nnm3tcaez7p/h3wglf1gbvhdk78sfoim4yhfxrnrqi0homvhqvujnsx2k6hyzjcylfdrwg+hmir21ko+yk68lrt3tevvcvidw5lnkjykm1fpxy/dcawldrdvqyetruwj2z1aba6tt0j3wreyd4f5hf9n3vpbntdrowy6b42ifoqic2tmpqzxuertfbig2n8mx91iokx8jjsjhsjgqvwwro9t0jvw0bgqcmpxvrwyrxrsmd+slne+i/6vhn8v9mwu03kpfde7ckxy3x8fd+vsokkrgze3zo7vf0e5zmml+p/i9h/rcwsvrgzh4yt2yeucbv1gvbp3chyhc1olwnmdtbryb+il7veoeh+h7gax0y2ieeeihwh4g25ocrv3c25yebaqa7 (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngra (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngrsc (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngosf (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngnb (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngn10ner\appdata\local\temp\289039568.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngruf (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfnglzycer\appdata\local\temp\1123196104.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngtrf (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngpb (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfnguuc (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngqd (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngoa (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngn13cer\appdata\local\temp\1789319677.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngmy2cer\appdata\local\temp\2414507188.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngmve (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngm01cer\appdata\local\temp\3336073389.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngmz0cer\appdata\local\temp\1582210954.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngozzcer\appdata\local\temp\3915454641.exe (Trojan.Downloader) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\idstrf (Malware.Trace) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvkdhfngoh (Trojan.Agent) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Users\Owner\AppData\Local\Temp\Low\iexplorer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\Low\Low\iexplorer.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\iexplorer.exe (Malware.Packer.Gen) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\winamp.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\win.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\debug.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\drweb.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\iexplarer.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\sysedit.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\services.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\gdi32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\avp.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\win32.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\winlogon.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\cmd.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\289039568.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\wininst.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\1123196104.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\svchost.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\login.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\system.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\lsass.exe (Trojan.Downloader) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\avp32.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\1789319677.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\2414507188.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\hexdump.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\3336073389.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\1582210954.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\3915454641.exe (Trojan.Downloader) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\1158774405.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\setup.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\win16.exe (Malware.Packer.Gen) -> Delete on reboot.C:\Users\Owner\AppData\Local\Temp\3087425934.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\2454977489.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\3704170816.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\3819655849.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\3980638140.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\install.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\705038715.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\617444778.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\2009808800.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\2017369258.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\2115095937.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\2194750635.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.C:\Users\Owner\AppData\Local\Temp\smss.exe (Trojan.Agent) -> Delete on reboot.Thanks in advance for any help Link to post Share on other sites More sharing options...
Gammo Posted October 2, 2010 ID:321791 Share Posted October 2, 2010 Hi,Download ComboFix from one of these locations:Link 1Link 2* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them: Click meIf you can't disable them then just continue on.Double click on ComboFix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply. Link to post Share on other sites More sharing options...
sobonito Posted October 3, 2010 Author ID:322576 Share Posted October 3, 2010 hi, sorry for the delay. Here's the ComboFix log ComboFix 10-10-02.02 - Owner 10/03/2010 7:47.1.2 - x86Microsoft Link to post Share on other sites More sharing options...
Gammo Posted October 4, 2010 ID:322976 Share Posted October 4, 2010 Hi,Please download OTM Save it to your desktop. Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)::Processes:Services:Reg[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]"ProxyServer"=-[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"=-:Filesc:\programdata\Updateipconfig /flushdns /c:Commands[purity][resethosts][emptytemp][emptyflash][createrestorepoint][reboot]Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.Click the red Moveit! button.Close OTM and reboot your PC.Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Start Malwarebytes' Anti-MalwareOnce the program has loaded, click the "Update" tab and click the "Check For updates" button.Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'd like us to scan your machine with ESET OnlineScanHold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScanClick the button.For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on to download the ESET Smart Installer. Save it to your desktop.Double click on the icon on your desktop.Check Click the button.Accept any security warnings from your browser.Check Push the Start button.ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.When the scan completes, push Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.Push the button.Push Link to post Share on other sites More sharing options...
sobonito Posted October 5, 2010 Author ID:323269 Share Posted October 5, 2010 I'm attaching what you asked. However when I tried updating MBAM, I get this error code "MBAM_ERROR_UPDATING (12007,0,WinHttpSendRequest)".I also have a log from running OTM. I don't know if you need that but I'll paste that at the end too.Here's the MBAM log:Malwarebytes' Anti-Malware 1.45www.malwarebytes.orgDatabase version: 4028Windows 6.0.6000Internet Explorer 7.0.6000.1685110/4/2010 9:43:44 PMmbam-log-2010-10-04 (21-43-44).txtScan type: Quick scanObjects scanned: 123235Time elapsed: 23 minute(s), 40 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)Here's the ESET scan report:C:\Qoobox\Quarantine\C\Users\Owner\AppData\Local\{EB8B0803-49E7-480D-A4A6-51C5E6B87AE7}\chrome\content\overlay.xul.vir probably a variant of Win32/Agent.NVQFFQI trojan cleaned by deleting - quarantinedC:\Users\Owner\Downloads\Fruity.Loops.Studio.9.Producer.Edition.XXL\flstudio_9.0.exe NSIS/TrojanDownloader.FakeAlert.DK.Gen trojan deleted - quarantinedAnd here's the OTM reportAll processes killedError: Unable to interpret <Processes> in the current context!========== SERVICES/DRIVERS ==================== REGISTRY ==========Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer deleted successfully.Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page deleted successfully.========== FILES ==========c:\programdata\Update folder moved successfully.< ipconfig /flushdns /c >Windows IP ConfigurationSuccessfully flushed the DNS Resolver Cache.C:\Users\Owner\Desktop\cmd.bat deleted successfully.C:\Users\Owner\Desktop\cmd.txt deleted successfully.========== COMMANDS ==========C:\Windows\System32\drivers\etc\Hosts moved successfully.HOSTS file reset successfully[EMPTYTEMP]User: All UsersUser: AppData->Temp folder emptied: 0 bytesUser: Default->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 67 bytesUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 0 bytesUser: Guest->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 20547 bytes->FireFox cache emptied: 96358023 bytes->Flash cache emptied: 3567 bytesUser: Owner->Temp folder emptied: 144150 bytes->Temporary Internet Files folder emptied: 14882855 bytes->Java cache emptied: 24867755 bytes->FireFox cache emptied: 86320511 bytes->Google Chrome cache emptied: 358779037 bytes->Flash cache emptied: 183935 bytesUser: Public->Temp folder emptied: 0 bytes%systemdrive% .tmp files removed: 0 bytes%systemroot% .tmp files removed: 0 bytes%systemroot%\System32 .tmp files removed: 0 bytes%systemroot%\System32\drivers .tmp files removed: 0 bytesWindows Temp folder emptied: 1681918 bytes%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 848845 bytesRecycleBin emptied: 60055680 bytesTotal Files Cleaned = 614.00 mbRestore point Set: OTM Restore PointOTM by OldTimer - Version 3.1.16.1 log created on 10042010_210500Files moved on Reboot...File C:\Windows\temp\JET17B9.tmp not found!C:\Windows\temp\wbxtra_10042010_165115.wbt moved successfully.Registry entries deleted on Reboot... Link to post Share on other sites More sharing options...
Gammo Posted October 5, 2010 ID:323354 Share Posted October 5, 2010 Hi,Please download and run the traceroute utility at this link. It will run a traceroute to our update servers to see if it can find the connection issue, and then it will write it to a log, and open that log in Notepad when it is done. Please either save the log as a Text File and then attach it to a reply, or copy and paste it into a reply, and I will forward it on to our server guy.Note that it may take several minutes to run, and it may look like it is not doing anything for a few minutes. Normally it takes longer when there are errors that it has to log, but it's rare for it to go more than 10 minutes. Link to post Share on other sites More sharing options...
sobonito Posted October 5, 2010 Author ID:323436 Share Posted October 5, 2010 Here's the log. It took all of 5 seconds I think Traceroute Malwarebytes CDN version 1.5 Tue 10/05/2010 12:49:49.10 Phase #1 Tracerouting: data-cdn.mbamupdates.com Unable to resolve target system name data-cdn.mbamupdates.com.DNS Info Server: UnKnownAddress: 213.109.64.148:53============================================================ Phase #2 Tracerouting: llnw.data-cdn.mbamupdates.com Unable to resolve target system name llnw.data-cdn.mbamupdates.com.DNS Info Server: UnKnownAddress: 213.109.64.148:53============================================================ Phase #3 Tracerouting: edge.data-cdn.mbamupdates.com Unable to resolve target system name edge.data-cdn.mbamupdates.com.DNS Info Server: UnKnownAddress: 213.109.64.148:53============================================================ Finished at: 12:49:50.85 Link to post Share on other sites More sharing options...
Gammo Posted October 5, 2010 ID:323451 Share Posted October 5, 2010 Hi,Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done with your internet connection disabled, so you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.It sounds like a case of Zlob/DNSchanger that change the router's DNS settings.1. Very important: First disconnect your computer from the internet.2. Router Reset: Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds).3. Reset the IP/DNS settings of your interent connection:Go to Start -> Control Panel -> Double click on Network Connections.Right click on your default connection (usually Local Area Connection or Wireless Network Connection) and select Properties.Select the General tab.Double click on Internet Protocol (TCP/IP).Under General tab:Select "Obtain an IP address automatically".Select "Obtain DNS server address automatically".[*]Click OK twice to save the settings.[*]Reboot if you had to change any setting.4. Flush the DNS cache:Click the Start logo in the bottom left corner of the screenClick on RunIn the command window copy/paste the following:ipconfig /flushdnsThen hit enter.Exit the command window.5. Reconnect: Once you have followed all the above steps you can reconnect your computer to the internet.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Start Malwarebytes' Anti-MalwareOnce the program has loaded, click the "Update" tab and click the "Check For updates" button.Once the updates were downloaded, click the "Scanner" tab, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Link to post Share on other sites More sharing options...
sobonito Posted October 5, 2010 Author ID:323478 Share Posted October 5, 2010 well I reset my router and flushed my DNS right before you posted your reply b/c I saw that in other topics. Right after I did that I could tell a difference. My MBAM easily updated so here's my log:Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4052Windows 6.0.6000Internet Explorer 7.0.6000.1685110/5/2010 2:16:45 PMmbam-log-2010-10-05 (14-16-45).txtScan type: Quick scanObjects scanned: 138256Time elapsed: 10 minute(s), 16 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Gammo Posted October 5, 2010 ID:323483 Share Posted October 5, 2010 Hi,Your logs appear to be clean now. There is only a bit of cleanup that we will deal with in this post, as well as prevention from future infections. Remove Combofix now that we're done with it.Please press the Windows Key and R on your keyboard. This will bring up the Run... command.Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")Please follow the prompts to uninstall Combofix.You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Download OTC to your desktop and run itA list of tool components used in the Cleanup of malware will be downloaded.If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.Click Yes to begin the Cleanup process and remove these components, including this application.You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep a backup of your important filesNow, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Make proper use of your anti-virus and firewallYou should keep your anti-virus and firewall guard enabled at all times, don't shut them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your anti-virus program is a good idea to make sure nothing has slipped through your protection. Once every two weeks works well for many people. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.Keep in mind that anti-virus programs are far from perfect. They don't protect you against every piece of malware that's out there, so don't trust them blindly. If an anti-virus reports a file as 'clean' then it's doesn't necessarily has to mean it is.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Keep all your software updatedIt is important to keep up on system updates from Microsoft by regularly checking their website at: http://windowsupdate.microsoft.com/, as these patch critical security vulnerabilities and help to keep you safe.It's also important to keep programs up to date so that malware doesn't exploit any old security flaws. FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated. Java and Adobe Reader are two of the main security vulnerabilities. You can find the latest version of Java here, you will want the Java SE Runtime Environment (JRE) one. You can find the latest version of Adobe Reader here.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use a safer web browserInternet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a couple good free alternatives: Firefox and Opera. Both are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial here which will help you to make IE much safer.If you decide to use the Firefox browser, the McAfee SiteAdvisor add-on will nicely help to enhance your security. This add-on tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Some other security programsIt is wise these days to have a few security programs installed and running on your machine except from just an anti-virus and a firewall. I will list some of them.A good anti-spyware program installed on your pc is very important to help remove any spyware that may have gotten on your computer. I highly recommend Malwarebytes' Anti-Malware.SpywareBlaster to help prevent spyware from installing in the first place.MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. This prevents your computer from connecting to those sites in the future.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Be carefulHaving security programs installed is very helpful to you, but none of them have the gift of human thought. The best way to make sure you don't get infected is to exercise common sense. Be careful of what websites you visit - if a site looks suspicious, trust your instincts and get out of there. Be careful of what attachments you open in emails and files you download from websites - check them over carefully to make sure that you know what you're getting.Using peer-to-peer programs (eg: LimeWire, BitTorrent, uTorrent, Kazaa) or downloading cracks and keygens is something else to avoid. These are the most common way to get infected. Malware writers use these programs to spread infections as it is the easiest way for them. The majority of infections we see in the Malware Removal forum are due to people using p2p programs to download cracks/keygens/warez. These are not only illegal, but will always contain some form of malware. You have no way of verifying that the things you download are legitimate or that they don't contain malware. Even with an up to date anti-virus and firewall, some of these things will still infect you. It is highly recommend that you uninstall all peer-to-peer programs. It just isn't worth it.Other common ways of getting infected are dis-reputable sites forcing you to download and install a codec. Or viruses using Instant Messaging programs (Windows Live Messenger, MSN Messenger, AIM) to send a file claiming it to be "photos" from a friend, only for it to turn out to be a virus.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Slow computer?If your computer begins to slow down in the future for no particular reason, your first step should not be to come to the malware forum. As your computer ages and is used, it's parts wear, files and programs accumulate, and its performance can decrease. To restore your computer's performance to its best possible level, follow the steps in this page written by malware expert Miekiemoes.~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~I'll leave this thread open for a couple days in case you come across any lingering problems that need fixing, then I'll close it up. If you need it reopened for any reason just shoot me a PM. It's been a pleasure working with you, now best of luck!Cheers,Gammo Link to post Share on other sites More sharing options...
Maurice Naggar Posted October 30, 2010 ID:336855 Share Posted October 30, 2010 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts