Well DaChew I'm not doing to good here with some of this. I screwed up on the Flash_Disinfector by forgetting to turn of norton and when it started norton stopped it and then froze so i restarted and turned off norton then redownloaded flash but it wont open again and I can't tell if it ever did anything or not also no matter what I do now I can't get the updates to show up on Malwarebytes to try and put them anywhere so I went ahead and ran the malwarebytes thing again anyway and heres the log, but pc instead of restarting just shut down.so when I manually started it again I couldn't tell if it finished deleting the files or not. wow what a mess and everytime I have to restart or shut down I feel like its going to be the last time before this thing dies on me.I'm doomed!......... Malwarebytes' Anti-Malware 1.34
Database version: 1793
Windows 5.1.2600 Service Pack 1
3/9/2009 12:09:16 PM
mbam-log-2009-03-09 (12-09-16).txt
Scan type: Quick Scan
Objects scanned: 70071
Time elapsed: 4 minute(s), 24 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 11
Registry Values Infected: 5
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 14
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\vuhiriye.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\urhuoa.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\zibibozi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\__c00D4100.dat (Trojan.Agent) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ce45aa94-6d11-406a-9686-ed3adc42ae87} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ce45aa94-6d11-406a-9686-ed3adc42ae87} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d356894b-b8c4-4e0b-8fbe-38946f12b98b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d356894b-b8c4-4e0b-8fbe-38946f12b98b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00d4100 (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\949f93be (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\niwedohiwo (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm97aca022 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zibibozi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\zibibozi.dll -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\urhuoa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\jaduguyu.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uyugudaj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vuhiriye.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\eyirihuv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wamonewe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ewenomaw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\zibibozi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\galaduja.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Local Settings\Temp\_A00F1833EC.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\__c00D4100.dat (Trojan.Vundo) -> Delete on reboot.
C:\lsass.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tolataga.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Edited by BirdofPrey, 09 March 2009 - 12:38 PM.