gebyw.dll problem!

I have Avira anti-virus and it detected a gebyw.dll file, but nothing helps, clicking quarantine or delete has no effect, it doesn't disappear. The problem actually started after installing the new version of Avira antivirus (from the real site that directed me to download.com, so not a bogus)

If I open the task manager it shows svchost.exe constantly popping up and disappearing a second later, driving my comp insane. Also some file called oGfoeElv keeps popping up under applications, strangely it has a half life logo, but I can't any file named like this. My comp is at 99% usage and I can't do anyhting :S


Could any1 help me? What should I do??

EDIT: Also a picture of the detection:

Edited by Aafrika, 22 July 2009 - 02:52 PM.

Hello Aafrika and to BleepingComputer!

Let's see if we can zap this bugger

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

IMPORTANT!!! - when you save the file, rename it to something random, such as bubbles.exe This must be done before beginning the download!

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

~Blade

In your next reply, please include the following:
Malwarebytes log

I can't save the file with a different name :/

I just have that d-l window that leaves me no option to change the name of the file, is that crucially important or can I d-l the file and then rename it before installation?

You can try renaming the file before installation. If you can't get it to install we can alter the settings in your web browser to allow you to change the name before downloading. Thinking ahead, what web browser are you using?

Problem seems to be solved, comp is working smoothly as ever, the svchost.exe thing doesn't pop-up anymore and comp is at nice 1-10% usage. Thank you very much Blade !!!

But here's the log, just to be sure:


Malwarebytes' Anti-Malware 1.39
Database version: 2498
Windows 5.1.2600 Service Pack 3

25.07.2009 15:36:50
mbam-log-2009-07-25 (15-36-50).txt

Scan type: Quick Scan
Objects scanned: 93916
Time elapsed: 9 minute(s), 38 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 36
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 8

Memory Processes Infected:
C:\windows:svchost.exe (Rootkit.ADS) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca8b2ea8-d1e5-4748-884b-10904518fd7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\gebyw (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ca8b2ea8-d1e5-4748-884b-10904518fd7f} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cf46bfb3-2acc-441b-b82b-36b9562c7ff1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5adf3862-9e2e-4ad3-86f7-4510e6550cd0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2eeb4fa-b6d6-41b9-9cfa-aba87f862bcb} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7545d8c8-f53c-4e2f-8fa0-d248ef4a6e61} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{cf46bfb3-2acc-441b-b82b-36b9562c7ff1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8a61098d-612b-4ef2-943d-64e920684061} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e596df5f-4239-4d40-8367-ebadf0165917} (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4e7bd74f-2b8d-469e-dcf7-f96da086b434} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{09f1adac-76d8-4d0f-99a5-5c907dadb988} (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5adf3862-9e2e-4ad3-86f7-4510e6550cd0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e12bff69-38a7-406e-a8ef-2738107a7831} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e19b133d-184e-4bba-8a70-38489c9dd31b} (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cf46bfb3-2acc-441b-b82b-36b9562c7ff1} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\new.net (Adware.NewDotNet) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DomainService (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DomainService (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Screensavers.com (Adware.Comet) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\NetPumper (Adware.NetPumper) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe (Rootkit.ADS) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\NewDotNet (Adware.NewDotNet) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\gebyw.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\ustart.exe (Adware.Agent) -> Quarantined and deleted successfully.
c:\program files\mozilla firefox\plugins\NPMyWebS.dll (Adware.MyWeb) -> Quarantined and deleted successfully.
c:\program files\newdotnet\readme.html (Adware.NewDotNet) -> Quarantined and deleted successfully.
c:\program files\newdotnet\uninstall.exe (Adware.NewDotNet) -> Quarantined and deleted successfully.
C:\windows:svchost.exe (Rootkit.ADS) -> Delete on reboot.
c:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.


One more thing - should I keep the malware bytes for future, or delete it?

Malwarebytes is an excellent anti-malware program. I recommend that you update and scan with it weekly to take care of any malware that slips past your antivirus/firewall.

I don't see anything in the log that I'm worried about, but I would like to do one more scan to make sure we got everything. Please note that this scan will take considerably longer than the Malwarebytes scan to run.

Please download ATF Cleaner by Atribune & save it to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main "Select Files to Delete" choose: Select All.
• Click the Empty Selected button.
• If you use Firefox browser click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• If you use Opera browser click Opera at the top and choose: Select All
• Click the Empty Selected button.
  If you would like to keep your saved passwords, please click No at the prompt.
• Click Exit on the Main menu to close the program.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

***************************************************

Please download and scan with SUPERAntiSpyware Free

• Double-click SUPERAntiSypware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If it will not start, go to Start > All Prgrams > SUPERAntiSpyware and click on Alternate Start.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here. Double-click on the hyperlink for Download Installer and save SASDEFINITIONS.EXE to your desktop. Then double-click on SASDEFINITIONS.EXE to install the definitions.)
• In the Main Menu, click the Preferences... button.
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (uncheck all others):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen and exit the program.
• Do not run a scan just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with SUPERAntiSpyware as follows:

• Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes" and reboot normally.
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

~Blade


In your next reply, please include the following:
SUPERAntiSpyware Log

Okay, I did both of those things. The ATF cleaner rid me of like 950Mb of useless stuff :D

But I don't have a log for SUPERantispyware, nothing where there would supposed to be a log and I didn't find anything that would remind a log file either from it's folder.


It did find a bunch of stuff though, I think it was some 60 items or so, but it got rid of all of those. Dunno thugh about the log.. should I do it again? Or should things be OK if it got rid of the stuff?



By the way, some things got a little messed up though. My browser doesn't load the high-def look of Gmail anymore, can't see the main-page picture on Pirate Bay (:angelface: I know im a bit of a pirate, going through rehab atm :D ) also I don't have any background for forums anymore, this one included. Everything else is fine and looks like it should: correct colors, fonts, tabs and everything, just no background what-so-ever, it's completely white.
Might be issues with some other pages aswell, but those 3 are just the ones I noticed straight away. Any idea what might have gone wrong or how could I get the background back and things back to normal? Something cookies-related perhaps?

Edited by Aafrika, 25 July 2009 - 11:38 AM.

I'd really like to see that log, so let's try and find it. When you ran SAS, did you run it from the Admin account or from your normal user account?

The malware could have overwritten some stuff in your browser that's causing issues. . . try uninstalling and reinstalling your browser (assuming you aren't using IE. If you are. . . let me know and I'll have to get back to you on that.) You can also try resetting your browser settings to default. It also may be a cookie issue as you suggested. If this is the case you'll have to find the settings within the websites and adjust them there.

~Blade

I actually ran the SAS scan as administrator, not as my usual profile.. dunno why, but I did. How do I get the files?

As to my browser problem - reinstalling firefox didn't help one bit, still as messed up as before. How do I set my browser setting back to deafult? I couldn't figure it out..
I also looked into the cookies thing, it seems to be working fine, cookies are allowed from site's settings, browser settings and even the general internet settings of windows. I found nothing out of place under page info.. It's really annoying me that websites are messed up.. found some more sites that don't work propery for me.. they all look like this:



EDIT: I just discovered that in one forum, when I change the forum skin to something else it all works perfectly, I just can't load the original skin I used to use, also when opening some simillar forums which I've never been to they work perfectly, it's only sites I used to visit quite frequently that are messed.

Edited by Aafrika, 25 July 2009 - 05:06 PM.

To retrieve the log you will need to log back into Safe Mode under the Administrator account. You should be able to obtain the log now. Copy the log to a flash drive, and then reboot into normal Windows. Then copy and paste the log text in your next reply.

That should work.


~Blade

Okay, got it. But it doesn't seem to be actually as clean as I thought in the first place. Avira keeps finding new stuff now and then, I think there is still something in the computer that's still sending in some of those no-good viruses.



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/25/2009 at 07:18 PM

Application Version : 4.26.1006

Core Rules Database Version : 3952
Trace Rules Database Version: 1894

Scan type : Complete Scan
Total Scan Time : 00:36:51

Memory items scanned : 221
Memory threats detected : 0
Registry items scanned : 6062
Registry threats detected : 14
File items scanned : 100256
File threats detected : 83

MyQuickSearch Toolbar
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82315A18-6CFB-44a7-BDFD-90E36537C252}

Trojan.NewDotNet
HKU\.DEFAULT\Software\New.net
HKU\S-1-5-18\Software\New.net
HKLM\Software\New.net
HKLM\Software\New.net#NextUpgradeHi
HKLM\Software\New.net#NextUpgradeLo
HKLM\Software\New.net#Retries
HKLM\Software\New.net#Activity
HKLM\Software\New.net#InstalledPath
HKLM\Software\New.net#InstalledVersion
HKLM\Software\New.net#Tag
HKLM\Software\New.net#Prt
HKLM\Software\New.net#Source
HKLM\Software\New.net#FirstTime
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990023.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990024.EXE

Adware.Tracking Cookie
C:\Documents and Settings\Peeter\Cookies\peeter@atdmt[2].txt

Trojan.Downloader-Gen/DDC
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990030.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990025.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990026.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990027.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990028.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990029.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990048.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990031.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990032.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990033.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990034.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990035.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990036.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990037.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990038.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990039.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990040.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990041.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990042.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990043.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990044.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990045.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990046.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990047.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990066.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990049.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990050.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990051.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990052.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990053.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990054.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990055.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990056.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990057.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990058.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990059.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990060.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990061.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990062.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990063.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990064.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990065.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990084.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990067.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990068.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990069.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990070.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990071.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990072.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990073.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990074.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990075.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990076.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990077.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990078.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990079.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990080.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990081.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990082.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990083.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990085.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990086.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990087.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990088.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990089.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990090.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990091.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990092.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990093.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990094.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990095.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990096.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990097.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990098.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990099.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990100.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B0EEE2C7-9DF0-4224-BB5D-04BC39D9AA46}\RP1397\A1990101.EXE

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\WYBEG.BAK1
C:\WINDOWS\SYSTEM32\WYBEG.BAK2
C:\WINDOWS\SYSTEM32\WYBEG.INI

BUMP

Haven't got a reply, are things OK or is there still something to worry about?

Got rid of the firefox problem tho, just made a new firefox profile.

Not sure what happened to Blade, sometimes when we have a lot of threads open, one slips off the bottom of the page?

Always bump when you haven't had a reply in a day or two.

Run MBAM again, but be sure and update it first

My apologies for vanishing on you Aafrika; it's been rough for me here in the real world over the past couple days and in the whirlwind of everything going on I overlooked your reply. It was not intentional, and again I'm very sorry. As DaChew said, if someone is helping you and you don't hear from them within a day or two of your reply you should try bumping your topic.

Glad to hear you resolved your Firefox issues. You should proceed with DaChew's instructions to update and run MBAM again. You had a lot of junk on your machine, we should make sure we got everything. We will also need to purge System Restore, but we'll save that for once we've got you all cleaned up.

~Blade

Edited by Blade Zephon, 29 July 2009 - 10:23 PM.

Sorry for not replying, I was away organizing a festival

Here's the scan log though, didn't find any infections. Can we say case closed or is there still something more to do?

Malwarebytes' Anti-Malware 1.40
Database version: 2560
Windows 5.1.2600 Service Pack 3

4.08.2009 22:29:03
mbam-log-2009-08-04 (22-29-03).txt

Scan type: Quick Scan
Objects scanned: 106560
Time elapsed: 4 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)