Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot Remove Core.cache.dsk Plz Help


  • This topic is locked This topic is locked
7 replies to this topic

#1 jmolhava

jmolhava

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:55 PM

Posted 04 February 2008 - 03:58 AM

I need my logs checked as I have ran a number of tools to try and rid my computer of a number of spyware issues. The lingering item seems to be core.cache.dsk which is obviously being re-created by something else everytime I delete it and reboot.

Here is my Combo-Fix log followed by HJT:

ComboFix 08-01-30.1 - NBSW 2008-02-04 0:44:28.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.118 [GMT -8:00]
Running from: C:\Documents and Settings\NBSW\Desktop\Combo-Fix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-02-04 00:50 . 2008-02-04 00:50 <DIR> d-------- C:\TEMP\tn3
2008-02-04 00:43 . 2004-08-04 04:00 388,608 --a------ C:\kmd.exe
2008-02-04 00:22 . 2008-02-04 00:22 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-02-02 19:39 . 2008-02-02 19:39 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-02 19:35 . 2007-12-16 18:29 138,512 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-02-02 19:35 . 2007-12-16 18:29 52,496 --a------ C:\WINDOWS\system32\drivers\tmactmon.sys
2008-02-02 19:35 . 2007-12-16 18:29 52,368 --a------ C:\WINDOWS\system32\drivers\tmevtmgr.sys
2008-02-01 13:44 . 2008-02-01 13:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-02-01 13:36 . 2008-02-01 13:37 <DIR> d-------- C:\TIS1605_1015
2008-02-01 13:10 . 2008-02-01 13:13 73,968,736 --a------ C:\TrendMicro_TIS_16.05_1015_x32.exe
2008-02-01 13:08 . 2008-02-01 13:08 <DIR> d-------- C:\CWShredder
2008-02-01 12:37 . 2008-02-02 19:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-01 12:19 . 2004-08-04 04:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-02-01 12:18 . 2004-08-04 04:00 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-02-01 12:16 . 2008-02-01 12:16 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-02-01 12:16 . 2008-02-01 12:16 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-02-01 12:16 . 2008-02-01 12:16 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-02-01 12:16 . 2008-02-01 12:16 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-02-01 12:16 . 2008-02-01 12:16 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-02-01 12:16 . 2008-02-01 12:16 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-02-01 11:22 . 2008-02-02 19:38 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-01 10:18 . 2008-02-02 19:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-01 10:15 . 2008-02-01 12:29 <DIR> d-a------ C:\NOD32
2008-02-01 10:15 . 2006-07-10 16:55 502,368 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-02-01 10:15 . 2006-07-10 16:55 274,432 --a------ C:\WINDOWS\system32\imon.dll
2008-02-01 03:50 . 2008-02-01 03:50 <DIR> d-------- C:\WINDOWS\dell
2008-01-31 19:07 . 2008-01-31 19:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-01-31 19:05 . 2008-01-31 19:05 <DIR> d-------- C:\Program Files\Common Files\supportsoft
2008-01-31 18:14 . 2008-02-03 09:20 101 --a------ C:\WINDOWS\wininit.ini
2008-01-30 12:56 . 2008-01-30 12:56 36,864 --a------ C:\WINDOWS\mrofinu572.exe.tmp
2008-01-28 12:23 . 2008-01-28 14:22 <DIR> d-------- C:\Program Files\Registry Defragmentation
2008-01-26 10:55 . 2008-01-30 11:55 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-26 10:51 . 2008-02-01 12:56 <DIR> d-------- C:\WINDOWS\system32\wnis6
2008-01-26 10:51 . 2008-01-26 10:51 <DIR> d-------- C:\WINDOWS\system32\nip4
2008-01-26 10:51 . 2008-01-26 10:51 <DIR> d-------- C:\WINDOWS\system32\ets1
2008-01-26 10:51 . 2008-01-28 14:23 <DIR> d-------- C:\WINDOWS\system32\comg9
2008-01-26 10:51 . 2008-01-26 10:51 86,016 --a------ C:\WINDOWS\system32\drivers\bridgee.sys
2008-01-11 16:14 . 2008-01-11 16:52 343 --a------ C:\WINDOWS\DcmLtBox.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 08:01 --------- d-----w C:\Program Files\LogMeIn
2008-02-03 03:35 --------- d-----w C:\Program Files\Trend Micro
2008-01-28 20:30 --------- d-----w C:\Program Files\Common Files\Java
2008-01-16 17:16 --------- d-----w C:\Program Files\WaveReader
2008-01-04 23:17 --------- d-----w C:\Documents and Settings\NBSW\Application Data\Printer Info Cache
2008-01-04 23:17 --------- d-----w C:\Documents and Settings\NBSW\Application Data\Image Zone Express
2008-01-04 23:16 --------- d-----w C:\Program Files\Common Files\HP
2007-12-17 02:29 65,936 ----a-w C:\WINDOWS\system32\drivers\tmtdi.sys
2007-12-17 02:29 35,856 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2007-12-17 02:29 333,328 ----a-w C:\WINDOWS\system32\drivers\TM_CFW.sys
2007-12-17 02:29 202,768 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2007-12-17 02:29 1,126,072 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 17:42 1404928]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2007-12-16 18:29 1393928]

C:\Documents and Settings\NBSW\Start Menu\Programs\Startup\
HPZinw12.exe [2004-09-29 12:08:08 61440]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
LMIinit.dll 2007-11-15 18:46 87352 C:\WINDOWS\system32\LMIinit.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=C:\WINDOWS\pss\Acrobat Assistant.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^NBSW^Start Menu^Programs^Startup^HPZinw12.exe]
path=C:\Documents and Settings\NBSW\Start Menu\Programs\Startup\HPZinw12.exe
backup=C:\WINDOWS\pss\HPZinw12.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^NBSW^Start Menu^Programs^Startup^HPZipm12.exe]
backup=C:\WINDOWS\pss\HPZipm12.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\7c6af795]
C:\WINDOWS\system32\lvbfllko.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2005-05-31 19:05 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 04:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--a------ 2005-02-23 14:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2006-02-19 01:41 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn GUI]
--a------ 2007-09-12 09:20 63048 C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 08:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu572.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2004-10-14 17:42 1404928 C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2003-11-19 15:48 32881 C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2006-11-03 17:20 866584 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"nod32krn"=2 (0x2)

R1 bridgee;bridgee;C:\WINDOWS\system32\drivers\bridgee.sys [2008-01-26 10:51]
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2007-09-12 09:21]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 09:20]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 03:32:58 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 00:50:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Documents and Settings\NBSW\Start Menu\Programs\Startup\HPZinw12.exe
.
**************************************************************************
.
Completion time: 2008-02-04 0:52:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-04 08:52:21
ComboFix2.txt 2008-02-04 08:21:52
ComboFix3.txt 2008-02-04 08:19:29
ComboFix4.txt 2008-02-04 08:13:36
.
2008-02-03 18:14:59 --- E O F ---


***HJT***
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:57:35 AM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\NBSW\Start Menu\Programs\Startup\HPZinw12.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: HPZinw12.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://remotecontrol.trendmicro.com/sdccom...oad/tgctlcm.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1174516592171
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/RACtrl.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 4984 bytes

THANKS!!!

BC AdBot (Login to Remove)

 


m

#2 Blender

Blender

    I will eat your Malware


  • Malware Response Team
  • 2,363 posts
  • OFFLINE
  •  
  • Location:Ontario
  • Local time:12:55 AM

Posted 12 February 2008 - 03:12 AM

Hi and welcome,

Sorry for delay. If you still need help please post a fresh hijackthis log here and let me know if core.cache.dsk is still hanging around.

thanks :thumbsup:
I'll have an order of massive trojan attack please with a side order of rootkit and virus dip.
Pre-course order of fresh spyware salad please with a side order of polymorphic dressing.
And to drink...a nice tall glass of adware!

For dessert; can I have a bowl of the freshest worms you have please?.

Never Give Up!

If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware Posted Image

#3 jmolhava

jmolhava
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:55 PM

Posted 12 February 2008 - 11:16 AM

Thank you for the reply. I have already fininshed dealing with this one. The culprit fraudulent driver file was 'bridgee' (not to be confused with 'bridge'). Once I deleted that, the core.cache.dsk never returned.

BUT - I want to say THANK YOU VERY MUCH to people like you and the other 'Malware Removal Experts' on this site and others like it. By reading through a number of posts I was able to figure out how to identify the source of my problem and eliminate it.

#4 Blender

Blender

    I will eat your Malware


  • Malware Response Team
  • 2,363 posts
  • OFFLINE
  •  
  • Location:Ontario
  • Local time:12:55 AM

Posted 13 February 2008 - 04:22 AM

Hi,

Good to hear you got it ok.

The last log shows other malware still present (at time of log) and a few highly suspect items.

Bad:
C:\TEMP\tn3 <-- folder
C:\Program Files\Dot1XCfg <-- folder
C:\WINDOWS\mrofinu572.exe.tmp <-- file

Suspect:

C:\WINDOWS\system32\wnis6
C:\WINDOWS\system32\nip4
C:\Program Files\Registry Defragmentation
C:\WINDOWS\system32\ets1
C:\WINDOWS\system32\comg9

Anything in the above folders?

Few programs need updating too and a bit of registry cleanup of leftovers.

Let me know if you want to double check with fresh logs.

thanks :thumbsup:
I'll have an order of massive trojan attack please with a side order of rootkit and virus dip.
Pre-course order of fresh spyware salad please with a side order of polymorphic dressing.
And to drink...a nice tall glass of adware!

For dessert; can I have a bowl of the freshest worms you have please?.

Never Give Up!

If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware Posted Image

#5 jmolhava

jmolhava
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:55 PM

Posted 13 February 2008 - 01:53 PM

Hi,
I was able to remove those as well. They were detected in subsequent scans by the various tools I was using.

THanks

#6 Blender

Blender

    I will eat your Malware


  • Malware Response Team
  • 2,363 posts
  • OFFLINE
  •  
  • Location:Ontario
  • Local time:12:55 AM

Posted 14 February 2008 - 07:31 AM

Hi,

Good to hear. :thumbsup:

Everything else working OK?

Here is some great information to help you stay clean and safe online:
http://users.telenet.be/bluepatchy/miekiem...prevention.html
http://www.bleepingcomputer.com/forums/topict2520.html

Blender
I'll have an order of massive trojan attack please with a side order of rootkit and virus dip.
Pre-course order of fresh spyware salad please with a side order of polymorphic dressing.
And to drink...a nice tall glass of adware!

For dessert; can I have a bowl of the freshest worms you have please?.

Never Give Up!

If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware Posted Image

#7 jmolhava

jmolhava
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:09:55 PM

Posted 14 February 2008 - 11:41 AM

Yes, everything is working great now.

Thanks for the follow up.

#8 Blender

Blender

    I will eat your Malware


  • Malware Response Team
  • 2,363 posts
  • OFFLINE
  •  
  • Location:Ontario
  • Local time:12:55 AM

Posted 14 February 2008 - 09:23 PM

Good to hear. :blink:

Take care & surf safe!

I'll close topic. If you need it re-opened please PM myself or a moderator with a link to your topic.

thanks :thumbsup:

Blender
I'll have an order of massive trojan attack please with a side order of rootkit and virus dip.
Pre-course order of fresh spyware salad please with a side order of polymorphic dressing.
And to drink...a nice tall glass of adware!

For dessert; can I have a bowl of the freshest worms you have please?.

Never Give Up!

If you are happy with the service I provided, please consider making a donation to help me continue the fight against Malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users