Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

C:\windows2\privacy_danger\index.htm


  • Please log in to reply
4 replies to this topic

#1 iamrenn

iamrenn

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 15 April 2008 - 11:38 PM

When I got home yesterday my computer was possessed by something... I started running everything I had or could find at it including spybot s&d, lavasoft adware and avg antivirus. After battling it for three hours I finally got avg to run through as well as the others. Now the computer is similar to normal, except for most noticably the desktop. the red screen is no longer there but something remains owned by privacy_danger\index.htm Also there seems to be files attempting to run, which are being stopped by spybot s&d.

I hope that my self help attempts have not made matters worse

Thank you for your help
Renn

Edited by quietman7, 16 April 2008 - 08:35 AM.


BC AdBot (Login to Remove)

 


#2 iamrenn

iamrenn
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 16 April 2008 - 08:25 AM

I ran malwarebytes and a lot seems to have been removed from my system. the wallpaper is gone.

here is the log

Malwarebytes' Anti-Malware 1.11
Database version: 635

Scan type: Full Scan (C:\|)
Objects scanned: 232243
Time elapsed: 1 hour(s), 56 minute(s), 33 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 12
Registry Values Infected: 7
Registry Data Items Infected: 2
Folders Infected: 19
Files Infected: 50

Memory Processes Infected:
C:\Documents and Settings\All Users.WINDOWS2\Application Data\dajixonc\vexibwrs.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS2\system32\awtqoLeD.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06f6148a-8e85-4cb4-a059-cf3dedd98322} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{06f6148a-8e85-4cb4-a059-cf3dedd98322} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\mwc (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qtvglped.bdwa (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\qtvglped.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\RZbBVmpRTp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c14e6230-757d-4246-81ce-b34e2940c722} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\zip (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\CDCheck (Trojan.Clicker) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\antiviirus (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\omlbpkaw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\pmsoarbf (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows2\system32\awtqoled -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows2\system32\awtqoled -> Delete on reboot.

Folders Infected:
C:\WINDOWS2\Installer\{de07206a-82af-4817-8073-34b9da71741b} (Trojan.Alphabet) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sara\Application Data\Sammsoft (Rogue.Advanced.Registry.Optimizer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322 (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\BrowserSearch (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Configurator (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Dating (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ErrorSearch (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Credit_Score (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Music (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Layouts (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Manager (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Reference (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\RelatedSearch (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Ringtones (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Toolbar (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarLogo (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarSearch (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\TravelSearch (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Weather (Adware.Starware) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS2\system32\awtqoLeD.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS2\system32\DeLoqtwa.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS2\system32\DeLoqtwa.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS2\Application Data\dajixonc\vexibwrs.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Local Settings\Temp\GLKA6.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
C:\Documents and Settings\Family\Local Settings\Temp\EXPLOR~1.EXE.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sara\Local Settings\Temp\CleanSchedule.exe (Advanced.Registry.Optimizer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP360\A0142032.exe (Adware.Comet) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP361\A0142048.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP361\A0142058.EXE (Adware.MyWeb.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP361\A0142064.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP361\A0142069.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP387\A0156190.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP387\A0156191.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{6B35C837-F5B5-475A-8A23-CB3BB7949ACE}\RP387\A0156194.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\BrowserSearch\BrowserSearch.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\BrowserSearch\BrowserSearch.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Configurator\Configurator.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Configurator\Configurator.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Dating\DatingOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Dating\DatingOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ErrorSearch\ErrorSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ErrorSearch\ErrorSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Credit_Score\Free_Credit_ScoreOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Credit_Score\Free_Credit_ScoreOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Music\Free_MusicOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Free_Music\Free_MusicOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Layouts\ToolbarLayout.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Layouts\ToolbarLayout.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Manager\ManagerOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Manager\ManagerOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Reference\ReferenceOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Reference\ReferenceOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\RelatedSearch\RelatedSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\RelatedSearch\RelatedSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Ringtones\RingtonesOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Ringtones\RingtonesOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Toolbar\TBProductsOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Toolbar\TBProductsOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarLogo\ToolbarLogoOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarLogo\ToolbarLogoOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarSearch\ToolbarSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\ToolbarSearch\ToolbarSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\TravelSearch\TravelSearchOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\TravelSearch\TravelSearchOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Weather\AlertArchive.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Weather\WeatherOptions.xml (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dallin\Application Data\Starware322\Weather\WeatherOptions.xml.backup (Adware.Starware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Family\Desktop\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\WINDOWS2\Explorer.EXE.Z-missing.txt (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

Thanks for everything
Renn

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:59 AM

Posted 16 April 2008 - 08:36 AM

I removed your hijackthis log as they are not permitted in this forum. If you still need to post it, I will direct you on how to do that.

Please print out and follow the instructions for using SDFix in BC's self-help tutorial "How to use SDFix".
-- When using this tool, you must use the Administrator's account or an account with "Administrative rights"
-- Disconnect from the Internet and temporarily disable your anti-virus and any anti-malware real time protection before performing a scan.

When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt. Please copy and paste the contents of Report.txt in your next reply. Be sure to renable you anti-virus and and other security programs before connecting to the Internet.

Please print out and follow the instructions for using "Vundofix". -- If using Windows Vista be sure to Run As Administrator.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the 'Fix Vundo' button.
  • After running VundoFix, a text file named vundofix.txt will automatically be saved to the root of the system drive, usually at C:\vundofix.txt.
  • Please copy & paste the contents of that text file into your next reply.
Also let me know how your computer is running and if there are any more signs of infection.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 iamrenn

iamrenn
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:04:59 AM

Posted 16 April 2008 - 08:43 AM

just did another scan and it appears to have been fully successful.

This is a great forum!

Renn

#5 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:04:59 AM

Posted 16 April 2008 - 08:47 AM

That's fine. However, I still recommend you perform the steps I advised above. MBAM may not have removed everything related to your infection. No program can detect everything.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users