Jump to content

Trojan.BHO.H Removal


Recommended Posts

I have ran the Malwarebytes Anti-Malware software and it has detected Trojan.BHO.H. I have selected to remove it and upon reboot and rescan it is still there. Any help would be appreciated for its been causing a lot of issues

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4718

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

9/30/2010 3:03:34 PM

mbam-log-2010-09-30 (15-03-34).txt

Scan type: Quick scan

Objects scanned: 10865

Time elapsed: 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\VALUED~1\AppData\Local\Temp\low\COUPON~1.DLL (Trojan.BHO.H) -> Quarantined and deleted successfully.

I am sorry if I am new to this and if I left out any information that may be needed.

Link to post
Share on other sites

Hi starbuxchic and Welcome to Malwarebytes Forum!

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

---------------------------------------------------------------------------------------------

  1. Download ComboFix from below:
    Combofix download
    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  3. Double click on combofix.exe & follow the prompts.
  4. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    cfRC_screen_1.png
    The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
    With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
    ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
    The Recovery Console was successfully installed.
    cfRC_screen_2.png
    Click on Yes, to continue scanning for malware.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply
    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
    ---------------------------------------------------------------------------------------------
  7. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
    ---------------------------------------------------------------------------------------------

Link to post
Share on other sites

Hi starbuxchic and Welcome to Malwarebytes Forum!

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

---------------------------------------------------------------------------------------------

  1. Download ComboFix from below:
    Combofix download
    * IMPORTANT !!! Place combofix.exe on your Desktop
  2. Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  3. Double click on combofix.exe & follow the prompts.
  4. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    cfRC_screen_1.png
    The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
    With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
    Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
    ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
    The Recovery Console was successfully installed.
    cfRC_screen_2.png
    Click on Yes, to continue scanning for malware.
  5. Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  6. When finished, it shall produce a log for you. Post that log in your next reply
    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
    ---------------------------------------------------------------------------------------------
  7. Ensure your AntiVirus and AntiSpyware applications are re-enabled.
    ---------------------------------------------------------------------------------------------

Kenny94

New here also and have done alot of searching regarding this very same Trojan. I have also noted that it seems each persons or computer situation may be different and instructions may be different. Do I need to create a new topic for my situation or can I post my Malwarebyte log regarding this same trojan here?

Thanks

Kevin

Link to post
Share on other sites

Nice job on posting your CF log starbuxchic.

Looking over your log it seems you don't have any evidence of an anti-virus software.

  • Avira AntiVir Personal - Free anti-virus software for Windows. Detects and removes more than 50000 viruses. Free support.

Perform a full scan with Avira and let it delete everything it is finding.

Then reboot.

After reboot, open your Avira and select "reports".

There doubleclick the report from the Full scan you have done. Click the "Report File" button and copy and paste this report in your next reply.

Link to post
Share on other sites

I ran Avira AntVir Personal and this was the report I was given after a full computer scan.

Avira AntiVir Personal

Report file date: Saturday, October 02, 2010 18:41

Scanning for 2894943 virus strains and unwanted programs.

The program is running as an unrestricted full version.

Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows Vista

Windows version : (Service Pack 2) [6.0.6002]

Boot mode : Normally booted

Username : SYSTEM

Computer name : VALUEDCUSTOM-PC

Version information:

BUILD.DAT : 10.0.0.567 32097 Bytes 4/19/2010 15:07:00

AVSCAN.EXE : 10.0.3.0 433832 Bytes 4/1/2010 17:37:38

AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2010 17:57:04

LUKE.DLL : 10.0.2.3 104296 Bytes 3/7/2010 23:33:04

LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49

VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36

VBASE001.VDF : 7.10.1.0 1372672 Bytes 11/19/2009 00:27:49

VBASE002.VDF : 7.10.3.1 3143680 Bytes 1/20/2010 22:37:42

VBASE003.VDF : 7.10.3.75 996864 Bytes 1/26/2010 21:37:42

VBASE004.VDF : 7.10.4.203 1579008 Bytes 3/5/2010 16:29:03

VBASE005.VDF : 7.10.6.82 2494464 Bytes 4/15/2010 22:25:14

VBASE006.VDF : 7.10.7.218 2294784 Bytes 6/2/2010 22:25:35

VBASE007.VDF : 7.10.9.165 4840960 Bytes 7/23/2010 22:25:57

VBASE008.VDF : 7.10.11.133 3454464 Bytes 9/13/2010 22:26:14

VBASE009.VDF : 7.10.11.134 2048 Bytes 9/13/2010 22:26:14

VBASE010.VDF : 7.10.11.135 2048 Bytes 9/13/2010 22:26:14

VBASE011.VDF : 7.10.11.136 2048 Bytes 9/13/2010 22:26:15

VBASE012.VDF : 7.10.11.137 2048 Bytes 9/13/2010 22:26:15

VBASE013.VDF : 7.10.11.165 172032 Bytes 9/15/2010 22:26:16

VBASE014.VDF : 7.10.11.202 144384 Bytes 9/18/2010 22:26:18

VBASE015.VDF : 7.10.11.231 129024 Bytes 9/21/2010 22:26:19

VBASE016.VDF : 7.10.12.4 126464 Bytes 9/23/2010 22:26:20

VBASE017.VDF : 7.10.12.38 146944 Bytes 9/27/2010 22:26:20

VBASE018.VDF : 7.10.12.64 133120 Bytes 9/29/2010 22:26:21

VBASE019.VDF : 7.10.12.99 134144 Bytes 10/1/2010 22:26:22

VBASE020.VDF : 7.10.12.100 2048 Bytes 10/1/2010 22:26:22

VBASE021.VDF : 7.10.12.101 2048 Bytes 10/1/2010 22:26:22

VBASE022.VDF : 7.10.12.102 2048 Bytes 10/1/2010 22:26:22

VBASE023.VDF : 7.10.12.103 2048 Bytes 10/1/2010 22:26:22

VBASE024.VDF : 7.10.12.104 2048 Bytes 10/1/2010 22:26:23

VBASE025.VDF : 7.10.12.105 2048 Bytes 10/1/2010 22:26:23

VBASE026.VDF : 7.10.12.106 2048 Bytes 10/1/2010 22:26:23

VBASE027.VDF : 7.10.12.107 2048 Bytes 10/1/2010 22:26:23

VBASE028.VDF : 7.10.12.108 2048 Bytes 10/1/2010 22:26:24

VBASE029.VDF : 7.10.12.109 2048 Bytes 10/1/2010 22:26:24

VBASE030.VDF : 7.10.12.110 2048 Bytes 10/1/2010 22:26:24

VBASE031.VDF : 7.10.12.111 2048 Bytes 10/1/2010 22:26:24

Engineversion : 8.2.4.72

AEVDF.DLL : 8.1.2.1 106868 Bytes 10/2/2010 22:26:44

AESCRIPT.DLL : 8.1.3.45 1368443 Bytes 10/2/2010 22:26:44

AESCN.DLL : 8.1.6.1 127347 Bytes 10/2/2010 22:26:42

AESBX.DLL : 8.1.3.1 254324 Bytes 10/2/2010 22:26:45

AERDL.DLL : 8.1.9.2 635252 Bytes 10/2/2010 22:26:42

AEPACK.DLL : 8.2.3.7 471413 Bytes 10/2/2010 22:26:40

AEOFFICE.DLL : 8.1.1.8 201081 Bytes 10/2/2010 22:26:39

AEHEUR.DLL : 8.1.2.30 2941303 Bytes 10/2/2010 22:26:38

AEHELP.DLL : 8.1.13.4 242038 Bytes 10/2/2010 22:26:28

AEGEN.DLL : 8.1.3.23 401779 Bytes 10/2/2010 22:26:28

AEEMU.DLL : 8.1.2.0 393588 Bytes 10/2/2010 22:26:27

AECORE.DLL : 8.1.17.0 196982 Bytes 10/2/2010 22:26:26

AEBB.DLL : 8.1.1.0 53618 Bytes 10/2/2010 22:26:26

AVWINLL.DLL : 10.0.0.0 19304 Bytes 1/14/2010 17:03:38

AVPREF.DLL : 10.0.0.0 44904 Bytes 1/14/2010 17:03:35

AVREP.DLL : 10.0.0.8 62209 Bytes 2/18/2010 21:47:40

AVREG.DLL : 10.0.3.0 53096 Bytes 4/1/2010 17:35:46

AVSCPLR.DLL : 10.0.3.0 83816 Bytes 4/1/2010 17:39:51

AVARKT.DLL : 10.0.0.14 227176 Bytes 4/1/2010 17:22:13

AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 1/26/2010 14:53:30

SQLITE3.DLL : 3.6.19.0 355688 Bytes 1/28/2010 17:57:58

AVSMTP.DLL : 10.0.0.17 63848 Bytes 3/16/2010 20:38:56

NETNT.DLL : 10.0.0.0 11624 Bytes 2/19/2010 19:41:00

RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 18:10:20

RCTEXT.DLL : 10.0.53.0 97128 Bytes 4/9/2010 19:14:29

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:, D:,

Process scan........................: on

Extended process scan...............: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: Saturday, October 02, 2010 18:41

Starting search for hidden objects.

c:\program files\java\jre6\bin\ssvagent.exe

c:\Program Files\Java\jre6\bin\ssvagent.exe

[NOTE] The process is not visible.

The scan of running processes will be started

Scan process 'SearchFilterHost.exe' - '32' Module(s) have been scanned

Scan process 'SearchProtocolHost.exe' - '51' Module(s) have been scanned

Scan process 'FlashUtil10c.exe' - '30' Module(s) have been scanned

Scan process 'SCServer.exe' - '35' Module(s) have been scanned

Scan process 'iexplore.exe' - '127' Module(s) have been scanned

Scan process 'iexplore.exe' - '82' Module(s) have been scanned

Scan process 'taskeng.exe' - '24' Module(s) have been scanned

Scan process 'sdclt.exe' - '41' Module(s) have been scanned

Scan process 'taskeng.exe' - '25' Module(s) have been scanned

Scan process 'TrustedInstaller.exe' - '56' Module(s) have been scanned

Scan process 'sprtsvc.exe' - '68' Module(s) have been scanned

Scan process 'svchost.exe' - '30' Module(s) have been scanned

Scan process 'vssvc.exe' - '49' Module(s) have been scanned

Scan process 'wmplayer.exe' - '113' Module(s) have been scanned

Scan process 'avscan.exe' - '81' Module(s) have been scanned

Scan process 'avscan.exe' - '29' Module(s) have been scanned

Scan process 'avcenter.exe' - '65' Module(s) have been scanned

Scan process 'taskeng.exe' - '49' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '33' Module(s) have been scanned

Scan process 'unsecapp.exe' - '28' Module(s) have been scanned

Scan process 'wmpnetwk.exe' - '71' Module(s) have been scanned

Scan process 'mobsync.exe' - '35' Module(s) have been scanned

Scan process 'alg.exe' - '34' Module(s) have been scanned

Scan process 'igfxsrvc.exe' - '25' Module(s) have been scanned

Scan process 'WLIDSvcM.exe' - '16' Module(s) have been scanned

Scan process 'WUDFHost.exe' - '33' Module(s) have been scanned

Scan process 'xaudio.exe' - '14' Module(s) have been scanned

Scan process 'avshadow.exe' - '33' Module(s) have been scanned

Scan process 'SearchIndexer.exe' - '63' Module(s) have been scanned

Scan process 'WLIDSVC.EXE' - '52' Module(s) have been scanned

Scan process 'svchost.exe' - '7' Module(s) have been scanned

Scan process 'svchost.exe' - '49' Module(s) have been scanned

Scan process 'SeaPort.exe' - '57' Module(s) have been scanned

Scan process 'svchost.exe' - '42' Module(s) have been scanned

Scan process 'iWinTrusted.exe' - '19' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '33' Module(s) have been scanned

Scan process 'avguard.exe' - '65' Module(s) have been scanned

Scan process 'AERTSrv.exe' - '5' Module(s) have been scanned

Scan process 'DLG.exe' - '22' Module(s) have been scanned

Scan process 'wmpnscfg.exe' - '29' Module(s) have been scanned

Scan process 'sidebar.exe' - '53' Module(s) have been scanned

Scan process 'avgnt.exe' - '49' Module(s) have been scanned

Scan process 'DivXUpdate.exe' - '69' Module(s) have been scanned

Scan process 'igfxpers.exe' - '20' Module(s) have been scanned

Scan process 'hkcmd.exe' - '23' Module(s) have been scanned

Scan process 'mswinext.exe' - '74' Module(s) have been scanned

Scan process 'jusched.exe' - '22' Module(s) have been scanned

Scan process 'sprtcmd.exe' - '105' Module(s) have been scanned

Scan process 'RtHDVCpl.exe' - '47' Module(s) have been scanned

Scan process 'svchost.exe' - '58' Module(s) have been scanned

Scan process 'Explorer.EXE' - '143' Module(s) have been scanned

Scan process 'Dwm.exe' - '31' Module(s) have been scanned

Scan process 'sched.exe' - '56' Module(s) have been scanned

Scan process 'taskeng.exe' - '79' Module(s) have been scanned

Scan process 'DellDock.exe' - '84' Module(s) have been scanned

Scan process 'spoolsv.exe' - '84' Module(s) have been scanned

Scan process 'svchost.exe' - '95' Module(s) have been scanned

Scan process 'DockLogin.exe' - '28' Module(s) have been scanned

Scan process 'svchost.exe' - '83' Module(s) have been scanned

Scan process 'SLsvc.exe' - '23' Module(s) have been scanned

Scan process 'svchost.exe' - '37' Module(s) have been scanned

Scan process 'svchost.exe' - '157' Module(s) have been scanned

Scan process 'svchost.exe' - '112' Module(s) have been scanned

Scan process 'svchost.exe' - '70' Module(s) have been scanned

Scan process 'svchost.exe' - '38' Module(s) have been scanned

Scan process 'svchost.exe' - '40' Module(s) have been scanned

Scan process 'lsm.exe' - '22' Module(s) have been scanned

Scan process 'lsass.exe' - '60' Module(s) have been scanned

Scan process 'services.exe' - '33' Module(s) have been scanned

Scan process 'winlogon.exe' - '30' Module(s) have been scanned

Scan process 'csrss.exe' - '14' Module(s) have been scanned

Scan process 'wininit.exe' - '26' Module(s) have been scanned

Scan process 'csrss.exe' - '14' Module(s) have been scanned

Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

Master boot sector HD3

[iNFO] No virus was found!

Master boot sector HD4

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Boot sector 'D:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '1650' files ).

Starting the file scan:

Begin scan in 'C:\' <OS>

C:\Users\Valued Customer\AppData\Local\Mozilla\Firefox\Profiles\m3c768y0.default\Cache\328A399Ad01

[DETECTION] Contains recognition pattern of the HTML/Crypted.Gen HTML script virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3a9c5000-58ccc6a7

[0] Archive type: ZIP

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

--> vmain.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\1c54f7d3-76dc5fb2

[DETECTION] Contains recognition pattern of the JAVA/Clagent.BO Java virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-65105aa0

[0] Archive type: ZIP

[DETECTION] Contains recognition pattern of the JAVA/Agent.AH Java virus

--> ________vload.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.AH Java virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\12a49b83-700d7840

[0] Archive type: ZIP

[DETECTION] Contains recognition pattern of the JAVA/Agent.G Java virus

--> myf/y/AppletX.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.G Java virus

--> myf/y/LoaderX.class

[DETECTION] Contains recognition pattern of the JAVA/OpenStream.AE Java virus

--> myf/y/PayloadX.class

[DETECTION] Contains recognition pattern of the JAVA/OpenStream.AD Java virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\170f8765-753b4ff7

[0] Archive type: ZIP

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

--> vmain.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\31e857f8-4afb743a

[0] Archive type: ZIP

[DETECTION] Contains recognition pattern of the JAVA/Agent.S Java virus

--> dev/s/AdgredY.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.S Java virus

--> dev/s/DyesyasZ.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.R Java virus

--> dev/s/LoaderX.class

[DETECTION] Contains recognition pattern of the JAVA/Agent.M.1 Java virus

Begin scan in 'D:\' <RECOVERY>

Beginning disinfection:

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\31e857f8-4afb743a

[DETECTION] Contains recognition pattern of the JAVA/Agent.M.1 Java virus

[NOTE] The file was moved to the quarantine directory under the name '497c747c.qua'.

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\170f8765-753b4ff7

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

[NOTE] The file was moved to the quarantine directory under the name '50305bd1.qua'.

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\12a49b83-700d7840

[DETECTION] Contains recognition pattern of the JAVA/OpenStream.AD Java virus

[NOTE] The file was moved to the quarantine directory under the name '03b0013c.qua'.

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\160ba957-65105aa0

[DETECTION] Contains recognition pattern of the JAVA/Agent.AH Java virus

[NOTE] The file was moved to the quarantine directory under the name '64584efa.qua'.

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\1c54f7d3-76dc5fb2

[DETECTION] Contains recognition pattern of the JAVA/Clagent.BO Java virus

[NOTE] The file was moved to the quarantine directory under the name '21d76211.qua'.

C:\Users\Valued Customer\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\3a9c5000-58ccc6a7

[DETECTION] Contains recognition pattern of the JAVA/Agent.AL.3 Java virus

[NOTE] The file was moved to the quarantine directory under the name '5ef0507e.qua'.

C:\Users\Valued Customer\AppData\Local\Mozilla\Firefox\Profiles\m3c768y0.default\Cache\328A399Ad01

[DETECTION] Contains recognition pattern of the HTML/Crypted.Gen HTML script virus

[NOTE] The file was moved to the quarantine directory under the name '12777dea.qua'.

End of the scan: Saturday, October 02, 2010 20:39

Used time: 1:55:51 Hour(s)

The scan has been done completely.

27768 Scanned directories

528790 Files were scanned

11 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

7 Files were moved to quarantine

0 Files were renamed

0 Files cannot be scanned

528779 Files not concerned

2594 Archives were scanned

0 Warnings

7 Notes

554485 Objects were scanned with rootkit scan

1 Hidden objects were found

Link to post
Share on other sites

Update Run Malwarebytes

  • Launch Malwarebytes' Anti-Malware
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Link to post
Share on other sites

After the Quick Scan this is the log I recieved.

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4734

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

10/2/2010 9:58:14 PM

mbam-log-2010-10-02 (21-58-14).txt

Scan type: Quick scan

Objects scanned: 140955

Time elapsed: 5 minute(s), 44 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Your Computer is Clean

CLEAN-1.jpg

Some final items:

Follow these steps to uninstall Combofix and tools used in the removal of malware

  • Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
  • Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the x and /)
    CF_Uninstall-1.jpg
  • Please follow the prompts to uninstall Combofix.
  • You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Here are some additional links for you to check out to help you with your computer security.

Browsers

Just because your computer came loaded with Internet Explorer doesn't mean that you have to use it, there are other free alternatives, FIREFOX and OPERA, both are free to use and are more secure than IE.

If you are using firefox you can stay more secure by adding NoScript and WOT (Web Of Trust)

NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT (Web Of Trust) has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

Additional Security Measures

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

SpywareBlaster- SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

Cookienator- Scans your PC for tracking cookies in multiple browsers as well as in Adobe Flash.

Secunia software inspector & update checker

Visit My Blog for Malware and Spyware Tips

6567E80CC55576485246E130E48A9FA8.png

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.