Hi there,
Thank you for taking my case so quickly. Since yesterday when it infected my computer, I ran the safety live scanner of MS and it removed the viruses for the most part except for the one called Trojan:Dos/Alureon.A which needed a manual removal. Then I ran malwarebytes right after that scan and removal and malwarebytes found a bunch of trojans and it removed those. Then it seemed like it was working fine and I looked in the registry to see if there were any of the tell tale signs of the trojan and found nothing and I was thinking it was okay but .... NO it was not. Malwarebytes just found another 6 infections so we are very much initiating the viruses all over again I guess with each restart or in the restore feature of the computer. See below the malwarebytes scan. So I noticed that there is a deployment of the virus thru the sun java application showing in its log. Then next I am posting the mbr log.
I have also run a hijack this scan and I am going to post it here too, hopefully that is okay to do because I don't like something I see in there. It has to do with a shared task scheduler and that has never been in my hijack this log before. They are noted as 2 item number 22's. Thank you so much for your help with this. gabstercol.
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7189
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
7/18/2011 2:21:14 AM
mbam-log-2011-07-18 (02-21-14).txt
Scan type: Full scan (C:\|D:\|)
Objects scanned: 331198
Time elapsed: 48 minute(s), 9 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 6
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\Gabi\application data\Sun\Java\deployment\cache\6.0\9\77007949-256f6e85 (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Gabi\application data\Sun\Java\deployment\cache\6.0\9\77007949-297e12b0 (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\system volume information\_restore{389b4acf-ea42-4beb-88d1-28fadd819fc1}\RP355\A0056546.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{389b4acf-ea42-4beb-88d1-28fadd819fc1}\RP355\A0056547.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\system volume information\_restore{389b4acf-ea42-4beb-88d1-28fadd819fc1}\RP355\A0056555.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{389b4acf-ea42-4beb-88d1-28fadd819fc1}\RP355\A0056556.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Here is the mbr log.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer,
http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HDT721010SLA360 rev.ST6OA31B -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4
device: opened successfully
user: MBR read successfully
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8B21E31B
user & kernel MBR OK
Mod Edit: HijackThis log removed; not permitted in this forum.
This post has been edited by quietman7: 18 July 2011 - 09:10 AM
Help
This topic is locked
Back to top
button. Then just follow the prompts in the Fix it wizard.
button.
to download the ESET Smart Installer. Save it to your desktop.
icon on your desktop.
button.
and check Remove found threats 
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
button.
