Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

spy/mal/grayware - gone or not?


  • Please log in to reply
3 replies to this topic

#1 ornery

ornery

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:32 PM

Posted 19 October 2008 - 10:33 PM

Computer has been overtaken with popups, fake virus programs, spyware, and more. Over the past 3 weeks have downloaded (and paid for) 2 different spyware programs (intelinet and xoftspy). Still overrun - and for the past 3 days none of my security programs would work (froze midstream) - even the online trend scan through my isp.

today I restored my computer to 6 weeks ago

updated my 'old' virus program (avg and windows defender)

ran each program (seperate times) and found (and deleted/cleaned) the following: tmp3.tmp, tmp4.tmp, tmp7.tmp, adware_faxterxp, adware_virtumundo, adw_mywebsearch, troj_bhos1, troj_java.at

Downloaded the java JRE6 update 6 - deleted my old java, and then installed the new

downloaded & installed trend micro hijack this

ran 'disk cleanup' and deleted all cookies & temp folders/files

ran onine trend scan through isp - clean

ran avg security program - clean

ran windows defender - clean

ran trend micro hijack this...no idea what it means, but read a post about what to do BEFORE submitting a file - am terrified to follow the steps I saw listed...more programs? how many does it take? And it looked like the post I was reading might be outdated. With the above information, could someone please tell me what to do?



Thanks - Lori

BC AdBot (Login to Remove)

 


#2 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:32 PM

Posted 19 October 2008 - 10:34 PM

Run this scan:

Please download Malwarebytes Anti-Malware and save it to your desktop.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
  • On the Scanner tab:
    • Make sure the "Perform Quick Scan" option is selected.
    • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
  • Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#3 ornery

ornery
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:32 PM

Posted 19 October 2008 - 11:47 PM

Followed your instructions...OUCH. Checked all and removed - no trouble there. Will restart as soon as I post this reply...am I cured now? Thanks - Lori


Malwarebytes' Anti-Malware 1.29
Database version: 1295
Windows 5.1.2600 Service Pack 2

10/19/2008 9:41:53 PM
mbam-log-2008-10-19 (21-41-53).txt

Scan type: Quick Scan
Objects scanned: 65357
Time elapsed: 15 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 44
Registry Values Infected: 9
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 37

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90c1f0cf-37ce-4f3a-b2b9-ddfe09b8589a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{90c1f0cf-37ce-4f3a-b2b9-ddfe09b8589a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5284ec7-1447-4d32-b129-b10523063b23} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnlm (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5284ec7-1447-4d32-b129-b10523063b23} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{B7C9058D-0F9C-32C0-83B6-740DFD8A6726} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ba0bacb5-fc95-451e-94d2-4959ab0949d2} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f2bada0d-fd61-45ef-a994-64a073fd6613} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ba0bacb5-fc95-451e-94d2-4959ab0949d2} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\aldd (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MS Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\virusprotect 3.9.exe 3.9 (Rogue.VirusProtect) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\virusprotect 3.9 (Rogue.VirusProtect) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Online Add-on (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Custom Tools (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE Safety Features (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Information Center (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MultiMedia Software (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Windows Safety Alert (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoPl.chl (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f2bada0d-fd61-45ef-a994-64a073fd6613} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f2bada0d-fd61-45ef-a994-64a073fd6613} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{91316323-2ad5-4794-9589-52a2eaa60a68} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b00e3398 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\VirusProtect 3.9 (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\Lang (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\Logs (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\Quarantine (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\Helper (Adware.BHO) -> Quarantined and deleted successfully.
C:\Program Files\WinSpyKiller (Rogue.WinSpyKiller) -> Quarantined and deleted successfully.
C:\Program Files\Video Add-on (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\sysutils (Rogue.XLG) -> Quarantined and deleted successfully.
C:\WINDOWS\sysutils\sounds (Rogue.XLG) -> Quarantined and deleted successfully.
C:\Program Files\TS2009 (Rogue.TotalSecure) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Start Menu\Programs\VirusProtect 3.9 (Rogue.VirusProtect) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\gfgplqos.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmnlm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\msvcp71.dll (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\msvcr71.dll (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\uninst.exe (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\VirusProtect 3.9\Lang\English.ini (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Program Files\WinSpyKiller\Uninstall.exe (Rogue.WinSpyKiller) -> Quarantined and deleted successfully.
C:\Program Files\WinSpyKiller\WinSpyKiller.lic (Rogue.WinSpyKiller) -> Quarantined and deleted successfully.
C:\Program Files\Video Add-on\ot.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Program Files\Video Add-on\ts.ico (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\WINDOWS\sysutils\sounds\01.mp3 (Rogue.XLG) -> Quarantined and deleted successfully.
C:\WINDOWS\sysutils\sounds\02.mp3 (Rogue.XLG) -> Quarantined and deleted successfully.
C:\WINDOWS\sysutils\sounds\03.mp3 (Rogue.XLG) -> Quarantined and deleted successfully.
C:\Program Files\TS2009\totalsecure.s1 (Rogue.TotalSecure) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081005211435593.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081007065633984.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081007205632187.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081008031155578.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081008065232390.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081008211047437.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081011173021343.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081012104920625.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Software Licensors\Antispyware PRO XP\LOG\20081014184004687.log (Rogue.AntiSpywareProXP) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Start Menu\Programs\VirusProtect 3.9\Uninstall VirusProtect 3.9.lnk (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Start Menu\Programs\VirusProtect 3.9\VirusProtect 3.9 Website.lnk (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Start Menu\Programs\VirusProtect 3.9\VirusProtect 3.9.lnk (Rogue.VirusProtect) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\rs.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\k.txt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Favorites\VIP Casino.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Start Menu\VIP Casino.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\My Documents\My Music\My Music.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\My Documents\My Videos\My Video.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\My Documents\My Documents.url (Trojan.Zlob) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Favorites\Antivirus Scan.url (Rogue.Link) -> Quarantined and deleted successfully.

#4 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,577 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:32 PM

Posted 20 October 2008 - 12:08 AM

After you reboot run the Full Scan and post the new log.
The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users