Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

very infected


  • Please log in to reply
8 replies to this topic

#1 StacieB

StacieB

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:45 PM

Posted 05 August 2009 - 05:05 PM

HI - I am trying to help a friend with a very infected computer. They had avast as their antivirus program but somehow got infected with a virus that would bring up an "antivirus system pro alert," a "Windows security alert," a "Spyware Alert," and a then pop-up porn sites. These constantly pop-up - leaving them virtually unable to do anything on their computer. I think Avast would freeze up the system, my guess due to all the viruses, and they couldn't do a thing. I went into safe mode and deleted Avast so I could negotiate here. I also downloaded and ran MalwareBytes - it removed 12 items but the problem still exists. I've used you guys enough to be fairly familiar with the process here - can you instruct me what to do next to clean this computer? - Thanks Gary - PS in the meantime I might trying downloading Ad Aware and running that.

Edited by StacieB, 05 August 2009 - 05:08 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:45 AM

Posted 05 August 2009 - 08:57 PM

Hello and welcome. Please post that MBAM log.
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.

Next run ATF and SAS:
Note.. SAS doesn't open the registry hives for other user accounts on the system, so scans should be done in each user account if you use more than one.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 StacieB

StacieB
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:45 PM

Posted 06 August 2009 - 02:08 PM

thanks for the response - here is the log file:

Malwarebytes' Anti-Malware 1.30
Database version: 1306
Windows 5.1.2600 Service Pack 3

8/5/2009 2:29:19 PM
mbam-log-2009-08-05 (14-29-19).txt

Scan type: Quick Scan
Objects scanned: 63955
Time elapsed: 12 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 5
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LSA Shellu (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (http://www.google.com/) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\MySearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Owner\Start Menu\Programs\BitDownload\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Documents (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Owner\result.txt (Malware.Trace) -> Quarantined and deleted successfully.

#4 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:45 AM

Posted 06 August 2009 - 02:32 PM

You're welcome! I see that you need to update the MBAM

Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 StacieB

StacieB
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:45 PM

Posted 06 August 2009 - 03:53 PM

I might have done this a little backwards - i.e. I ran SAS first in regular mode (missed the part of not running it until in safe mode) but then went back and ran ATF in safe mode - this is the log from the first run of SAS:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/06/2009 at 01:17 PM

Application Version : 4.27.1000

Core Rules Database Version : 4042
Trace Rules Database Version: 1982

Scan type : Complete Scan
Total Scan Time : 00:58:02

Memory items scanned : 453
Memory threats detected : 0
Registry items scanned : 5647
Registry threats detected : 47
File items scanned : 37000
File threats detected : 154

Trojan.Agent/Gen-FakeSpy[Broad]
[system tool] C:\PROGRAM FILES\LMEYPS\PEDOSYSGUARD.EXE
C:\PROGRAM FILES\LMEYPS\PEDOSYSGUARD.EXE
[system tool] C:\PROGRAM FILES\LMEYPS\PEDOSYSGUARD.EXE

Trojan.Vundo-Variant/NextGen
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F64619FF-E19F-4016-BF9C-147CFF821B46}
HKCR\CLSID\{F64619FF-E19F-4016-BF9C-147CFF821B46}
HKCR\CLSID\{F64619FF-E19F-4016-BF9C-147CFF821B46}
HKCR\CLSID\{F64619FF-E19F-4016-BF9C-147CFF821B46}\InProcServer32
HKCR\CLSID\{F64619FF-E19F-4016-BF9C-147CFF821B46}\InProcServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\IEHELPER.DLL

Trojan.Agent/Gen-RogueDropper
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F64619FF-E19F-4016-BF9C-147CFF821B46}

Adware.Tracking Cookie
C:\Documents and Settings\Owner\Cookies\owner@advertising[3].txt
C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[6].txt
C:\Documents and Settings\Owner\Cookies\owner@pfizer.122.2o7[1].txt
C:\Documents and Settings\Owner\Cookies\owner@questionmarket[5].txt
C:\Documents and Settings\Owner\Cookies\owner@lsftmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@porno[1].txt
C:\Documents and Settings\Owner\Cookies\owner@apmebf[3].txt
C:\Documents and Settings\Owner\Cookies\owner@richmedia.yahoo[2].txt
C:\Documents and Settings\Owner\Cookies\owner@questionmarket[1].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[3].txt
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt
C:\Documents and Settings\Owner\Cookies\owner@adinterax[3].txt
C:\Documents and Settings\Owner\Cookies\owner@adrevolver[3].txt
C:\Documents and Settings\Owner\Cookies\owner@mediaplex[6].txt
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[2].txt
.precisionclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jmc33jix.default\cookies.txt ]
.precisionclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jmc33jix.default\cookies.txt ]
.precisionclick.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jmc33jix.default\cookies.txt ]
.adknowledge.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jmc33jix.default\cookies.txt ]
.adknowledge.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\jmc33jix.default\cookies.txt ]
C:\Documents and Settings\Administrator\Cookies\administrator@ad.cs102175[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.3d-sexgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.trutv[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.cnn[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.ipc[2].txt
C:\Documents and Settings\Owner\Cookies\owner@adultadworld[3].txt
C:\Documents and Settings\Owner\Cookies\owner@adultadworld[2].txt
C:\Documents and Settings\Owner\Cookies\owner@adultadworld[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.gamesbannernet[3].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.gamesbannernet[1].txt
C:\Documents and Settings\Owner\Cookies\owner@advertstream[1].txt
C:\Documents and Settings\Owner\Cookies\owner@clicksor[2].txt
C:\Documents and Settings\Owner\Cookies\owner@fishadultgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[1].txt
C:\Documents and Settings\Owner\Cookies\owner@media6degrees[2].txt
C:\Documents and Settings\Owner\Cookies\owner@lawcrawler.findlaw[1].txt
C:\Documents and Settings\Owner\Cookies\owner@yieldmanager[2].txt
C:\Documents and Settings\Owner\Cookies\owner@xxxnetgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@banners2.battleon[2].txt
C:\Documents and Settings\Owner\Cookies\owner@youporn[2].txt
C:\Documents and Settings\Owner\Cookies\owner@library.findlaw[1].txt
C:\Documents and Settings\Owner\Cookies\owner@banners.battleon[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.adap[1].txt
C:\Documents and Settings\Owner\Cookies\owner@stats.paypal[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adultxxxgamer[2].txt
C:\Documents and Settings\Owner\Cookies\owner@directtrack[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.linktrack66[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.socialtrack[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.tltrack[1].txt
C:\Documents and Settings\Owner\Cookies\owner@socialmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.burstbeacon[2].txt
C:\Documents and Settings\Owner\Cookies\owner@a1.interclick[4].txt
C:\Documents and Settings\Owner\Cookies\owner@a1.interclick[1].txt
C:\Documents and Settings\Owner\Cookies\owner@bluestreak[1].txt
C:\Documents and Settings\Owner\Cookies\owner@caselaw.lp.findlaw[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.narutoxxx[1].txt
C:\Documents and Settings\Owner\Cookies\owner@hentaicounter[3].txt
C:\Documents and Settings\Owner\Cookies\owner@onlineadultgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@onlineadultgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.2adultflashgames[3].txt
C:\Documents and Settings\Owner\Cookies\owner@www.2adultflashgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.2adultflashgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.xxxgamer[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.lucidmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@hentaicounter[1].txt
C:\Documents and Settings\Owner\Cookies\owner@interclick[3].txt
C:\Documents and Settings\Owner\Cookies\owner@interclick[2].txt
C:\Documents and Settings\Owner\Cookies\owner@interclick[1].txt
C:\Documents and Settings\Owner\Cookies\owner@adinterax[2].txt
C:\Documents and Settings\Owner\Cookies\owner@toplist[4].txt
C:\Documents and Settings\Owner\Cookies\owner@www.xxxgamer[4].txt
C:\Documents and Settings\Owner\Cookies\owner@www.xxxgamer[3].txt
C:\Documents and Settings\Owner\Cookies\owner@toplist[1].txt
C:\Documents and Settings\Owner\Cookies\owner@toplist[5].txt
C:\Documents and Settings\Owner\Cookies\owner@pussysexgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.adultxxxgamer[1].txt
C:\Documents and Settings\Owner\Cookies\owner@narutoxxx[2].txt
C:\Documents and Settings\Owner\Cookies\owner@toplist[2].txt
C:\Documents and Settings\Owner\Cookies\owner@toplist[6].txt
C:\Documents and Settings\Owner\Cookies\owner@adultswim[2].txt
C:\Documents and Settings\Owner\Cookies\owner@azjmp[2].txt
C:\Documents and Settings\Owner\Cookies\owner@mobileentertainment.directtrack[1].txt
C:\Documents and Settings\Owner\Cookies\owner@affiliates.thrixxx[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.adultswim[2].txt
C:\Documents and Settings\Owner\Cookies\owner@imrworldwide[2].txt
C:\Documents and Settings\Owner\Cookies\owner@mysexgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@collective-media[1].txt
C:\Documents and Settings\Owner\Cookies\owner@3d-sexgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@myroitracking[1].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[6].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[5].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[3].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames[4].txt
C:\Documents and Settings\Owner\Cookies\owner@lsftmedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@fishxxxgames[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ad2.doublepimp[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ad2.doublepimp[2].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.ad4game[2].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[1].txt
C:\Documents and Settings\Owner\Cookies\owner@lp.findlaw[1].txt
C:\Documents and Settings\Owner\Cookies\owner@stats.routesgame[1].txt
C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar[6].txt
C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar[5].txt
C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar[2].txt
C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar[1].txt
C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar[4].txt
C:\Documents and Settings\Owner\Cookies\owner@specificmedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.findlaw[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.fishadultgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ad2.doublepimp[3].txt
C:\Documents and Settings\Owner\Cookies\owner@nextag[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.flashgames247[2].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.burstnet[1].txt
C:\Documents and Settings\Owner\Cookies\owner@at.atwola[2].txt
C:\Documents and Settings\Owner\Cookies\owner@xiti[1].txt
C:\Documents and Settings\Owner\Cookies\owner@richmedia.yahoo[1].txt
C:\Documents and Settings\Owner\Cookies\owner@invitemedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@richmedia.yahoo[3].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[4].txt
C:\Documents and Settings\Owner\Cookies\owner@revsci[2].txt
C:\Documents and Settings\Owner\Cookies\owner@at.atwola[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads-dev.youporn[2].txt
C:\Documents and Settings\Owner\Cookies\owner@richmedia.yahoo[4].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.associatedcontent[2].txt
C:\Documents and Settings\Owner\Cookies\owner@burstnet[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.amihorny[1].txt
C:\Documents and Settings\Owner\Cookies\owner@media.mtvnservices[2].txt
C:\Documents and Settings\Owner\Cookies\owner@findlaw[2].txt
C:\Documents and Settings\Owner\Cookies\owner@www.fishxxxgames[1].txt
C:\Documents and Settings\Owner\Cookies\owner@amihorny[2].txt
C:\Documents and Settings\Owner\Cookies\owner@lfstmedia[2].txt
C:\Documents and Settings\Owner\Cookies\owner@content.yieldmanager[2].txt
C:\Documents and Settings\Owner\Cookies\owner@burstbeacon[2].txt
C:\Documents and Settings\Owner\Cookies\owner@eas.apm.emediate[1].txt
C:\Documents and Settings\Owner\Cookies\owner@www.flashgamesforadults[1].txt
C:\Documents and Settings\Owner\Cookies\owner@naked[1].txt
C:\Documents and Settings\Owner\Cookies\owner@ads.nexon[1].txt
C:\Documents and Settings\Owner\Cookies\owner@atwola[1].txt
C:\Documents and Settings\Owner\Cookies\owner@a1.interclick[2].txt

Adware.SysGuard/FakeAlert
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#system tool [ C:\Program Files\lmeyps\pedosysguard.exe ]
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\Software\Microsoft\Windows\CurrentVersion\Run#system tool [ C:\Program Files\lmeyps\pedosysguard.exe ]

Rogue.Agent/Gen
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#aazalirt
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#skaaanret
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#jungertab
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#zibaglertz
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#iddqdops
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#ronitfst
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#tobmygers
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#jikglond
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#tobykke
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#klopnidret
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#jiklagka
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#salrtybek
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#seeukluba
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#jrjakdsd
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#krkdkdkee
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#dkewiizkjdks
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#dkekkrkska
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#rkaskssd
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#kuruhccdsdd
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#krujmmwlrra
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#kkwknrbsggeg
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#ktknamwerr
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#iqmcnoeqz
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#ienotas
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#krkmahejdk
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#otpeppggq
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#krtawefg
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#oranerkka
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#kitiiwhaas
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#otowjdseww
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#otnnbektre
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#oropbbsee
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#irprokwks
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#ooorjaas
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#id
HKU\S-1-5-21-2743610188-2393148400-3107888651-1003\SOFTWARE\AVSCAN#ready

Trojan.Agent/Gen-IExplore[Fake]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0067233.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0071404.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0071418.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0071427.DLL

Trojan.Agent/Gen
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0071420.EXE
C:\WINDOWS\SYSSVC.EXE
C:\WINDOWS\Prefetch\SYSSVC.EXE-284E4C4F.pf

Trojan.Agent/Gen-ProxyRedirect[SearchItPro]
C:\SYSTEM VOLUME INFORMATION\_RESTORE{B06C75F0-9FCC-4D32-A4A4-58CDE7C44A50}\RP286\A0071424.DLL

#6 StacieB

StacieB
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:45 PM

Posted 06 August 2009 - 04:06 PM

here is the new malwarebytes log:

Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 3

8/6/2009 2:04:49 PM
mbam-log-2009-08-06 (14-04-49).txt

Scan type: Quick Scan
Objects scanned: 114940
Time elapsed: 9 minute(s), 17 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:45 AM

Posted 06 August 2009 - 04:14 PM

Well this was actually good.. how is it running now?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 StacieB

StacieB
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:11:45 PM

Posted 07 August 2009 - 11:07 PM

things seem to be running fine - we deleted avast - What do you recommend for virus, antispyware/malware protection from here? thanks

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,331 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:02:45 AM

Posted 08 August 2009 - 08:40 AM

OK looks goood.. Well I like Avira,have the paid version of MBAM and use SAS as an on demand scanner.
Look here .. http://www.bleepingcomputer.com/forums/topic3616.html

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users