Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Msn Virus


  • Please log in to reply
2 replies to this topic

#1 Kiour_gr

Kiour_gr

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:55 AM

Posted 07 March 2008 - 08:43 PM

Hello i got yesterday the virus i run spybot and avast and removed some file just want to now if it is all gone. please help me. thank you

ComboFix 08-03-06.4 - Dimitris 2008-03-08 1:29:17.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1614 [GMT -5:00]
Running from: C:\Documents and Settings\Dimitris\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-02-08 to 2008-03-08 )))))))))))))))))))))))))))))))
.

2008-03-07 00:37 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-07 00:37 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-06 20:01 . 2008-03-06 20:01 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-06 20:01 . 2007-12-04 08:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-03-06 20:01 . 2004-01-09 05:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-03-06 20:01 . 2007-12-04 07:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-03-06 20:01 . 2007-12-04 09:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-03-06 20:01 . 2007-12-04 09:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-03-06 20:01 . 2007-12-04 09:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-03-06 20:01 . 2007-12-04 09:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-03-06 20:01 . 2007-12-04 09:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-03-06 18:12 . 2008-03-06 18:12 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-06 18:12 . 2008-03-06 18:46 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-03-06 17:31 . 2008-03-06 18:18 0 --a------ C:\asijde.exe
2008-02-21 20:07 . 2008-02-21 20:07 <DIR> d-------- C:\Documents and Settings\Rosana\Application Data\Media Player Classic
2008-02-15 17:06 . 2004-11-28 21:09 679,936 --a------ C:\WINDOWS\xvidcore.dll
2008-02-11 00:53 . 2008-02-11 00:53 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe Systems
2008-02-11 00:49 . 2008-02-11 00:49 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-02-09 02:25 . 2008-02-09 02:25 <DIR> d-------- C:\Documents and Settings\Dimitris\Application Data\Apple Computer
2008-02-08 19:10 . 2008-02-08 19:10 <DIR> d-------- C:\Documents and Settings\Dimitris\Application Data\GeoVid
2008-02-08 19:08 . 2008-02-08 19:08 <DIR> d-------- C:\Program Files\VisiFly
2008-02-08 19:08 . 2008-02-08 19:08 <DIR> d-------- C:\Program Files\Common Files\GeoVid
2008-02-08 19:08 . 2008-02-08 19:08 <DIR> d-------- C:\Documents and Settings\Dimitris\Application Data\VisiFly
2008-02-08 19:08 . 2004-08-18 15:00 1,712,128 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-02-08 19:08 . 2003-03-19 08:19 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
2008-02-08 19:08 . 2003-03-19 08:12 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll
2008-02-08 19:08 . 2003-03-19 06:05 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2008-02-08 19:08 . 2007-06-28 18:55 77,824 --a------ C:\WINDOWS\system32\xvid.ax
2008-02-08 19:08 . 2005-06-07 15:11 60,416 --a------ C:\WINDOWS\system32\dsetup.dll
2008-02-08 18:46 . 2008-02-08 20:03 <DIR> d-------- C:\Program Files\Fraps
2008-02-08 18:34 . 2008-02-08 20:20 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-01 21:53 --------- d-----w C:\Program Files\MSN Messenger
2008-10-01 21:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-10-01 21:29 --------- d-----w C:\Program Files\Windows Live
2008-03-07 08:05 --------- d-----w C:\Documents and Settings\Dimitris\Application Data\Azureus
2008-03-07 04:08 --------- d-----w C:\Program Files\Warcraft III
2008-02-13 19:36 --------- d-----w C:\Documents and Settings\Rosana\Application Data\Winamp
2008-02-11 20:19 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-11 05:49 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-07 02:04 139,264 ----a-w C:\WINDOWS\War3Unin.exe
2008-02-05 00:47 --------- d-----w C:\Program Files\PowerISO
2008-02-03 05:05 --------- d-----w C:\Program Files\QuickTime
2008-02-03 05:05 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-02-02 22:46 --------- d-----w C:\Program Files\DivX
2008-01-19 04:31 --------- d-----w C:\Documents and Settings\Dimitris\Application Data\Ahead
2008-01-14 12:52 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
2006-03-20 20:37 5,689,344 ----a-w C:\Program Files\mplayerc.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 13:26 484904]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 18:56 15360]
"msnmsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54 5674352]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 08:34 868352]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2006-07-13 07:12 729088]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 07:44 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 07:44 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-05-04 10:59 161328]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\Setup.exe -auto

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\Setup.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-09 22:59:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 01:30:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-08 1:31:10
.
2008-03-07 05:45:22 --- E O F ---

Attached Files



BC AdBot (Login to Remove)

 


#2 Kiour_gr

Kiour_gr
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:55 AM

Posted 11 March 2008 - 04:00 AM

can anyone help?

#3 Grinler

Grinler

    Lawrence Abrams


  • Admin
  • 43,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:USA
  • Local time:04:55 AM

Posted 26 March 2008 - 01:59 PM

I apologize for the very long delay. We have a huge backlog of HijackThis Logs to handle and it has been taking us greater time than normal to get caught up. If you are still having a problem, and want us to analyze your information, please post a brand new hijackthis log. If we do not hear back from you within a couple of days we will need to close your topic.

When posting your logs please post them directly into the reply. Do not attach them.

Also make sure you have already followed the steps outlined below:

Preparation Guide For Use Before Posting A Hijackthis Log

Thank you for your patience.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users