Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Vundo + Neroshowtime.files7.dat + Other?


  • This topic is locked This topic is locked
2 replies to this topic

#1 scott121

scott121

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:19 AM

Posted 09 March 2008 - 06:08 PM

Hello All.

I may or may not have a virus. At one point I certainly had Vundo, but I don't know that it is gone and/or something else is infecting my system. This is a brand new computer. Only in use for approx 1 wk. Following are logs, etc that I've run based on reading recommendations to others.

Kaspersky Log:

KASPERSKY ONLINE SCANNER REPORT
Sunday, March 09, 2008 2:26:43 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 9/03/2008
Kaspersky Anti-Virus database records: 619608

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 20880
Number of viruses found 0
Number of infected objects 0
Number of suspicious objects 0
Duration of the scan process 00:05:54

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008030920080310\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\UserData\index.dat Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{C2CE8AAB-9E76-4EBB-A2A7-0AC666E428F5}\RP58\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.


Hijack This (HJT) Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:10:38 PM, on 3/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SXMJW12R\HiJackThis[1].exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u...can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1204780386687
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.quickbooks.com/c10/v21.101/qboax10.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 6147 bytes


From the Symantic Remove Vundo Tool the following info is shown in the Report:

Trojan Vundo Successfully Removed

The number of scanned files : 21058
The number of deleted files: 0
The number of viral processes terminated: 1
The number of viral processes suspended: 1
The number of viral threads terminated: 0
The number of registry entries fixed: 0


This is the same report I have been getting for 2-3 days after multiple times running.

I have a suspicious .dat file that I can't delete

NeroShowTime.Files7.dat

I have removed Nero using add/remove programs, but I can't get rid of this .dat file and it seems to create more by the minute in various locations with the same NeroShowTime.Files7 extension. The newer ones I can delete, but the main one which is in Documents and Settings\LocalService\Cookies I can not delete. I am told that it is being used. I tried going in as a with a "new" admin login, but then I can't find LocalService folder (I have allowed access to hidden files and folders).

Here is the log after running Index.dat Suite:

@echo off
:: This file will delete all index.dat files listed below. The Cookies, Temporary Internet Files, History, Temp folders, Recent Documents folder, swap file and any additional files or folders, will be cleared as per your Settings.
::
:: Please note, use of this file is AT YOUR OWN RISK, Ur I.T. Mate Group will NOT be held liable for any problems caused due to the use of this file or any part of the Index.dat Suite software
::
:: File Created: Sunday, March 09, 2008 4:04:54 PM
::
:: This file is located at [ C:\idsuite_run.bat ]
echo Copy [ C:\Documents and Settings\LocalService\Cookies\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\LocalService\Cookies\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\11604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\LocalService\Cookies\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\LocalService\Cookies\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\21604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\31604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\Application Data\Microsoft\Office\Recent\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\Application Data\Microsoft\Office\Recent\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\41604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Application Data\Microsoft\Office\Recent\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\Application Data\Microsoft\Office\Recent\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\Cookies\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\Cookies\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\51604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Cookies\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\Cookies\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\61604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008030920080310\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008030920080310\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\71604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008030920080310\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008030920080310\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\81604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Copy [ C:\Documents and Settings\Owner\UserData\index.dat ] to [ C:\Program Files\Index.dat Suite\idbackup\3-9-2008 ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
copy "C:\Documents and Settings\Owner\UserData\index.dat" "C:\Program Files\Index.dat Suite\idbackup\3-9-2008\91604_index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\UserData\index.dat ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
del "C:\Documents and Settings\Owner\UserData\index.dat" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Cookies ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\Documents and Settings\Owner\"
rd /s /q "C:\Documents and Settings\Owner\Cookies" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Local Settings\History ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\Documents and Settings\Owner\Local Settings\"
rd /s /q "C:\Documents and Settings\Owner\Local Settings\History" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\WINDOWS\Temp\ ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\WINDOWS\Temp\"
rd /s /q "C:\WINDOWS\Temp\" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\DOCUME~1\Owner\LOCALS~1\Temp\ ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\DOCUME~1\Owner\LOCALS~1\Temp\"
rd /s /q "C:\DOCUME~1\Owner\LOCALS~1\Temp\" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\Documents and Settings\Owner\Local Settings\"
rd /s /q "C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Delete [ C:\Documents and Settings\Owner\Recent ] >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
cd "C:\Documents and Settings\Owner\"
rd /s /q "C:\Documents and Settings\Owner\Recent" >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
echo Trying to exit ... >> "C:\Program Files\Index.dat Suite\Logs\debug.log"
exit


Does anyone have any suggestions?

Am I infected or am I being overly concerned.

Any help will be sincerly appreciated.

Thank you.

BC AdBot (Login to Remove)

 


m

#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:19 AM

Posted 28 March 2008 - 05:48 AM

Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you. :thumbsup:

I don't see any sign of an active infection in your logs, but if you are having problems go ahead and post a new hijackthis log and we'll take a look.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:08:19 AM

Posted 20 April 2008 - 09:16 AM

As there has been no response, this thread will now be closed.

If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you.
Include the address of this thread in your request.
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users