Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With A Spambot From Cnn Top 10 Email


  • This topic is locked This topic is locked
5 replies to this topic

#1 seestation

seestation

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:13 AM

Posted 13 August 2008 - 09:25 PM

Thanks in advance for any assistance!

Here is what happened. The boss opened a piece of crap email - CNN Top 10 - and proceeded to click through and download some trojan or bot dropper. Ever since we have been listed on all the spam lists you can think of.

What have I done: Installed all Windows Updates. Updated, Scanned, & deleted all items found with Ad-Aware, Spybot, and Malwarebytes. Ran online virus scans with Housecall and Kaspersky. Ran virus scan with up to date Mcafee Virus Scan Enterprise 8.5. Emptied all temp files and temp Internet files + cookies.

Hopefully I have finally (after 3 days of fighting) gotten this cleaned, but I was hoping for another opinion. I noticed one unnamed BHO in the HJT scan, but I have not deleted it yet. I thought I would wait to hear a second opinion.

Mcafee VS listed infections before I cleaned all of this as: FakeAlert-AG(Trojan), FakeAlert-AB(Trojan), W32/Nuwar.sys(Virus)

This is the log form Malwarebytes Anti-Malware and I deleted all the objects found before I did the Housecall scan and then the HJT scan:

Malwarebytes' Anti-Malware 1.24
Database version: 1051
Windows 5.1.2600 Service Pack 3

7:27:07 PM 8/13/2008
mbam-log-8-13-2008 (19-27-07).txt

Scan type: Quick Scan
Objects scanned: 54990
Time elapsed: 24 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcnotj0e5eg (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\rhcnotj0e5eg (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\rhcnotj0e5eg\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.


This is my HJT log after running all scans:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:06:39 PM, on 8/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pamdist.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Pam Distributing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O8 - Extra context menu item: &Search - ?p=ZNxmk572YYUS
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab
O16 - DPF: {3EF806D2-55C8-4D04-B3DA-D2A7C170CCF2} (CMSLite Control) - http://dvrlink.net/webdvr/webdvr3.7.27MU.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1158264528306
O16 - DPF: {6e32070a-766d-4ee6-879c-dc1fa91d2fc3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1218652461175
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL/jdk/6u...ows-i586-jc.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\Software\..\Telephony: DomainName = pamdist.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{65CCB1BF-D82F-47D1-8558-CF85D3C219E6}: NameServer = 10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{82D77A37-3A16-4C25-A803-5AA852A109A3}: NameServer = 10.1.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = pamdist.local
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 10400 bytes


Does it look clean???

BC AdBot (Login to Remove)

 


#2 seestation

seestation
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:13 AM

Posted 14 August 2008 - 08:05 AM

-Bump-

I got 25 people and their families counting on me to clean this up so our business can get back on track and we can begin sending email again. Please!!!

I also thought of one other thing. Spamhaus or CBL (one of the spamlists) identified the infection as RUSTOCK - there is very little information about this spambot and I could find nothing about how to remove it. Kernel level, so am I better off just wiping this machine, flash the bios (just in case right?)and reloading OS & apps? That is my last resort. I just know someone on here will look at my logs and be able to tell if it's clean or I should do something else.

Thanks in advance!

#3 seestation

seestation
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:13 AM

Posted 14 August 2008 - 09:33 AM

It's back (or never was gone). Here are the results from my Mcafee scan last night:

8/13/2008 9:30:19 PM Engine version =5200.2160
8/13/2008 9:30:19 PM AntiVirus DAT version =5360.0000
8/13/2008 9:30:19 PM Number of detection signatures in EXTRA.DAT =None
8/13/2008 9:30:19 PM Names of detection signatures in EXTRA.DAT =None
8/13/2008 9:30:08 PM Scan Started PAM-004\SYSTEM Scan All Fixed Disks
8/13/2008 10:47:50 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0000462.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0004077.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp9\a0000229.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp9\a0000229.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP9\A0000229.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP9\A0000229.sys W32/Nuwar.sys(Virus)
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Scan Summary
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes scanned : 35
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes detected : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors scanned : 6
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors detected: 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files scanned : 222097
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files with detections: 3
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM File detections : 12
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files deleted : 3
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files not scanned : 27
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Run time : 3:49:11
8/14/2008 1:19:19 AM Scan Complete PAM-004\SYSTEM Scan All Fixed Disks
:thumbsup:

#4 seestation

seestation
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:03:13 AM

Posted 14 August 2008 - 12:00 PM

Thanks in advance for any assistance!

Here is what happened. The boss opened a piece of crap email - CNN Top 10 - and proceeded to click through and download some trojan or bot dropper. Ever since we have been listed on all the spam lists you can think of.

What have I done: Installed all Windows Updates. Updated, Scanned, & deleted all items found with Ad-Aware, Spybot, and Malwarebytes. Ran online virus scans with Housecall and Kaspersky. Ran virus scan with up to date Mcafee Virus Scan Enterprise 8.5. Emptied all temp files and temp Internet files + cookies.


Mcafee VS listed infections before I cleaned all of this as: FakeAlert-AG(Trojan), FakeAlert-AB(Trojan), W32/Nuwar.sys(Virus)

This is the log form Malwarebytes Anti-Malware and I deleted all the objects found before I did the Housecall scan and then the HJT scan:

Malwarebytes' Anti-Malware 1.24
Database version: 1051
Windows 5.1.2600 Service Pack 3

7:27:07 PM 8/13/2008
mbam-log-8-13-2008 (19-27-07).txt

Scan type: Quick Scan
Objects scanned: 54990
Time elapsed: 24 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{2eff3cf7-99c1-4c29-bc2b-68e057e22340} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{a6573479-9075-4a65-98a6-19fd29cf7374} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcnotj0e5eg (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\rhcnotj0e5eg (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\rhcnotj0e5eg\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhcnotj0e5eg\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.


This is my HJT log after running all scans:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:06:39 PM, on 8/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.pamdist.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Pam Distributing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7db2d5a0-7241-4e79-b68d-6309f01c5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O8 - Extra context menu item: &Search - ?p=ZNxmk572YYUS
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {fb5f1910-f110-11d2-bb9e-00c04f795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsol...scueControl.cab
O16 - DPF: {3EF806D2-55C8-4D04-B3DA-D2A7C170CCF2} (CMSLite Control) - http://dvrlink.net/webdvr/webdvr3.7.27MU.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1158264528306
O16 - DPF: {6e32070a-766d-4ee6-879c-dc1fa91d2fc3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1218652461175
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD44/JSCDL/jdk/6u...ows-i586-jc.cab
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\Software\..\Telephony: DomainName = pamdist.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{65CCB1BF-D82F-47D1-8558-CF85D3C219E6}: NameServer = 10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{82D77A37-3A16-4C25-A803-5AA852A109A3}: NameServer = 10.1.1.1
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = pamdist.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = pamdist.local
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 10400 bytes

That was at 10pm last night. This morning my Mcafee scan results are as follows:
8/13/2008 9:30:19 PM Engine version =5200.2160
8/13/2008 9:30:19 PM AntiVirus DAT version =5360.0000
8/13/2008 9:30:19 PM Number of detection signatures in EXTRA.DAT =None
8/13/2008 9:30:19 PM Names of detection signatures in EXTRA.DAT =None
8/13/2008 9:30:08 PM Scan Started PAM-004\SYSTEM Scan All Fixed Disks
8/13/2008 10:47:50 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0000462.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:47:50 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0000462.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp10\a0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0004077.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:53:41 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP10\A0004077.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp9\a0000229.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Cleaned SYSTEM c:\system volume information\_restore{d97c79de-5bcc-4b04-9a09-ec91b2a9e52d}\rp9\a0000229.sys W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM C:\SYSTEM VOLUME INFORMATION\_RESTORE{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP9\A0000229.SYS W32/Nuwar.sys(Virus)
8/13/2008 10:55:17 PM Deleted SYSTEM c:\System Volume Information\_restore{D97C79DE-5BCC-4B04-9A09-EC91B2A9E52D}\RP9\A0000229.sys W32/Nuwar.sys(Virus)
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Scan Summary
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes scanned : 35
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes detected : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Processes cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors scanned : 6
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors detected: 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Boot sectors cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files scanned : 222097
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files with detections: 3
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM File detections : 12
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files cleaned : 0
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files deleted : 3
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Files not scanned : 27
8/14/2008 1:19:19 AM Scan Summary PAM-004\SYSTEM Run time : 3:49:11
8/14/2008 1:19:19 AM Scan Complete PAM-004\SYSTEM Scan All Fixed Disks


Spamhaus or CDL (I can't remember) said that we were infected with RUSTOCK.

Help? Please?

Edited by Orange Blossom, 14 August 2008 - 10:35 PM.
Merged topics. ~ OB


#5 Shaba

Shaba

    Koutsi


  • Members
  • 7,872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:13 AM

Posted 25 August 2008 - 04:12 AM

Hello and welcome to BC

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. We aim to provide the valuable service known to come from BC to every member we can, but sometimes it takes just a little longer to get to every request for help.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Upon completing the steps below a staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

Thanks and again sorry for the delay.

Please see here for instructions
how to install HijackThis and make a logfile. Save it into convenient location and include it to your next reply, please.

Next
Please do a scan with Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Please post back with HijackThis log and Kaspersky report.

Regards
Microsoft MVP Consumer Security
Posted Image

Posted Image

#6 Shaba

Shaba

    Koutsi


  • Members
  • 7,872 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:10:13 AM

Posted 30 August 2008 - 04:30 AM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
Microsoft MVP Consumer Security
Posted Image

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users