Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I-Worm/Brontok.X


  • Please log in to reply
9 replies to this topic

#1 arrivederci

arrivederci

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:30 PM

Posted 25 August 2010 - 05:49 PM

Hi!

I found this forum after searching about I-Worm/Brontok.X infection.

I got this virus in a very "funny" way. I went to develop a few photos with a usb key. I then used it again on my computer and.. zas! The photoshop computer infected my key...

My avg detected the threads, I run Malware bytes, but I am not sure if I got rid of the worm.

How can I be competely sure?

Thanks!

Edited by Orange Blossom, 25 August 2010 - 05:57 PM.
Move to AII as no logs posted and prep. guide not followed. ~ OB


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 PM

Posted 26 August 2010 - 07:47 AM

My avg detected the threads

You mean threat. Did AVG take any action to remove it?
Did Malwarebytes find remove anything?
Is your machine exhibiting any signs of infection?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 arrivederci

arrivederci
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:30 PM

Posted 26 August 2010 - 12:45 PM

Hi!

AVG moved it the virus vault, then I run it and seemed fine.

I run Malware bytes as well and found 3 infected files (but I am not sure they are false positive):

C:\Program Files\Spyware Removal Toolkit\RkHitApi.dll (Rogue.SpywareCease) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Removal Toolkit\spkdll.dll (Rogue.SpywareCease) -> Quarantined and deleted successfully.
C:\Windows\System32\drivers\RKHit.sys (Rogue.Spywarecease) -> Quarantined and deleted successfully.

At the moment I do not see any sign of infection, but after AVG detected it, I am not sure.

Thanks!

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 PM

Posted 26 August 2010 - 01:03 PM

ThreatExpert's awareness of the file "rkhit.sys"
MBAM's description of Rogue.SpywareCease

Rescan again with Malwarebytes Anti-Malware (Full Scan) in normal mode and check all items found for removal. Don't forgot to check for database definition updates through the program's interface (preferable method) before scanning and to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.


Please download and scan with SUPERAntiSpyware Free
-- If you already use SUPERAntispyware, make sure you are using the most current version as it is frequently updated.
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • Follow these instructions: How to use SUPERAntiSpyware to scan and remove malware from your computer Guide.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.
-- If you have a problem downloading, installing or getting SAS to run, try downloading and using the SUPERAntiSpyware Portable Scanner (listed under Popular Links) instead. Save the randomly named file (i.e. SAS_1710895.COM) to a usb drive or CD and transfer to the infected computer. Then double-click on it to launch and scan. The file is randomly named to help keep malware from blocking the scanner.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 arrivederci

arrivederci
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:30 PM

Posted 28 August 2010 - 06:34 AM

Hello again,

thanks for the reply. Please find here Malware Bytes log (it is in Spanish..., but no threats detected):

vMalwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Versión de la Base de Datos: 4493

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18943

28/08/2010 13:17:35
mbam-log-2010-08-28 (13-17-35).txt

Tipos de Análisis: Análisis Completo (C:\|)
Objetos examinados: 320314
Tiempo transcurrido: 1 hora(s), 18 minuto(s), 6 segundo(s)

Procesos en Memoria Infectados: 0
Módulos de Memoria Infectados: 0
Claves del Registro Infectadas: 0
Valores del Registro Infectados: 0
Elementos de Datos del Registro Infectados: 0
Carpetas Infectadas: 0
Archivos Infectados: 0

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos de Memoria Infectados:
(No se han detectado elementos maliciosos)

Claves del Registro Infectadas:
(No se han detectado elementos maliciosos)

Valores del Registro Infectados:
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Infectados:
(No se han detectado elementos maliciosos)

Carpetas Infectadas:
(No se han detectado elementos maliciosos)

Archivos Infectados:
(No se han detectado elementos maliciosos)

-------------------------------------------------------

SupeAvira log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/28/2010 at 00:30 AM

Application Version : 4.42.1000

Core Rules Database Version : 5418
Trace Rules Database Version: 3230

Scan type : Complete Scan
Total Scan Time : 00:40:16

Memory items scanned : 718
Memory threats detected : 0
Registry items scanned : 9294
Registry threats detected : 0
File items scanned : 31698
File threats detected : 229

Adware.Tracking Cookie
.richmedia.yahoo.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.yahooflickr.112.2o7.net [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
exchange.intermedia.net [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
exchange.intermedia.net [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
roundcube.intermedia.net [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.atdmt.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.imrworldwide.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.bs.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.serving-sys.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.statcounter.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
.content.yieldmanager.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
ad.yieldmanager.com [ C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
banners.securedataimages.com [ C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7UL9U7MX ]
broadcast.piximedia.fr [ C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7UL9U7MX ]
s0.2mdn.net [ C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7UL9U7MX ]
secure-it.imrworldwide.com [ C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7UL9U7MX ]
serving-sys.com [ C:\Users\*****\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\7UL9U7MX ]
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@smartadserver[1].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@publicidad[2].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@advertising[2].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@ad.yieldmanager[1].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@tradedoubler[1].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@006.free-counters.co[1].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@adinterax[2].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@atdmt[1].txt
C:\Users\*****\AppData\Roaming\Microsoft\Windows\Cookies\Low\*****@content.yieldmanager[3].txt
.doubleclick.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.imrworldwide.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.prisacom.112.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
roundcube.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.apmebf.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.statcounter.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
stats.arvis.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www.realcounter.eu [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s5.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.chitika.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.kontera.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.kontera.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.kontera.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.yahooflickr.112.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
zbox.zanox.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.paypal.112.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.stats.paypal.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
roundcube.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
roundcube.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
006.free-counters.co.uk [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.avgtechnologies.112.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.statcounter.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.edmaster.adbureau.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.richmedia.yahoo.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.sdabocconi.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.sdabocconi.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.sdabocconi.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.sdabocconi.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.jazztelespaa.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.jazztelespaa.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.jazztelespaa.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.jazztelespaa.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
ad.zanox.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
adserver.adnuntia.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
d2.advertserve.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.mediametrics.mpsa.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
pstats.graphite.eu [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.statcounter.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
eas.apm.emediate.eu [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
ad.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s4.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s9.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.oberon.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s2.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s4.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.adinterax.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.adinterax.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s6.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
adserver.hostingperte.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s1.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s2.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www.cmmediavalle.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www.cmmediavalle.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
adv.arubamediamarketing.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.xiti.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
hc2.humanclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
hc2.humanclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s4.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s3.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.publis.adbureau.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.lasexta.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.lasexta.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
stats.splinder.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
easy-web-stats.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.bravenet.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.sixapart.adbureau.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.media6degrees.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.at.atwola.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
api.skyscanner.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
api.skyscanner.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
api.skyscanner.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.simyo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.simyo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.simyo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.simyo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.eyewonder.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
adserver.vinogusto.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ads.pointroll.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
ad.adserver01.de [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.zanox.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www.ad-track.de [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s3.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.yieldmanager.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s3.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
es.sitestat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
fr.sitestat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
fr.sitestat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
fr.sitestat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www5.addfreestats.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ehg-bestwestern.hitbox.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ehg-bestwestern.hitbox.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.hertz.122.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.interclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.traveladvertising.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.traveladvertising.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.interclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.interclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
fr.sitestat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.himedia.individuad.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s05.flagcounter.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.cepsamundial.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.cepsamundial.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.cepsamundial.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.cepsamundial.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.clickcase.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.clickcase.it [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.stepstone.112.2o7.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.adcentriconline.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
server.lon.liveperson.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
server.lon.liveperson.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s14.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.ero-advertising.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
s9.shinystat.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.dmtracker.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.electronicarts.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.electronicarts.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.electronicarts.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.electronicarts.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
hc2.humanclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
hc2.humanclick.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.raccgrupo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.raccgrupo.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.atrapaloes.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.atrapaloes.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.atrapaloes.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.atrapaloes.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.collective-media.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.collective-media.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.invitemedia.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.at.atwola.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.radiomaliboomboom.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.radiomaliboomboom.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.radiomaliboomboom.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.radiomaliboomboom.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.bs.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.serving-sys.com [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
www.intermedia.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.collective-media.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.collective-media.net [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.orangees.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.orangees.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.orangees.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]
.orangees.solution.weborama.fr [ C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\qv4jxkbw.default\cookies.sqlite ]


-----------------------------------

Thanks!

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 PM

Posted 28 August 2010 - 06:52 AM

Please download TFC (Temp File Cleaner) by Old Timer and save it to your desktop.
alternate download link
  • Save any unsaved work. TFC will close ALL open programs including your browser!
  • Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
  • Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
  • TFC will clear out all temp folders for all user accounts (temp, IE temp, Java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder.
  • Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.
Note: It is normal for the computer to be slow to boot after running TFC cleaner the first time.


Please download Norman Malware Cleaner and save to your desktop.
alternate download link
  • Be sure to read all the information Norman provides on the same page.
  • Double-click on Norman_Malware_Cleaner.exe to start the program.
  • Read the End User License Agreement and click the Accept button to open the scanning window.
  • Click Start Scan to begin.
  • In some cases Norman Malware Cleaner may require that you restart the computer to completely remove an infection. If prompted, reboot and run the tool again to ensure that all infections are removed.
  • After the scan has finished, a log file a log file named NFix_date_time (i.e. NFix_2009-06-22_07-08-56.log) will be created on your desktop with the results.
  • Copy and paste the contents of that file in your next reply.
Note: For usb flash drives and/or other removable drives to scan, use the Add button to browse to the drives location, click on the drive to highlight and choose Ok.


Please perform a scan with Eset Online Anti-virus Scanner.
  • This scan requires Internet Explorer to work. If using a different browser, you will be given the option to download and use the ESET Smart Installer.
  • Vista/Windows 7 users need to run Internet Explorer as Administrator. To do this, right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run As Administrator from the context menu.
  • Click the green Posted Image button.
  • Read the End User License Agreement and check the box:
  • Check Posted Image.
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Check Remove found threats and Scan potentially unwanted applications. (If given the option, choose "Quarantine" instead of delete.)
  • Click the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer.
  • If offered the option to get information or buy software at any point, just close the window.
  • The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop as ESETScan.txt.
  • Push the Posted Image button, then Finish.
  • Copy and paste the contents of ESETScan.txt in your next reply.
Note: A log.txt file will also be created and automatically saved in the C:\Program Files\EsetOnlineScanner\ folder.
If you did not save the ESETScan log, click Posted Image > Run..., then type or copy and paste everything in the code box below into the Open dialogue box:

C:\Program Files\ESET\EsetOnlineScanner\log.txt
  • Click Ok and the scan results will open in Notepad.
  • Copy and paste the contents of log.txt in your next reply.
-- Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 arrivederci

arrivederci
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:30 PM

Posted 29 August 2010 - 06:12 PM

Hi!

Please find here Norman Malware:

Norman Malware Cleaner
Version 1.6.2
Copyright © 1990 - 2009, Norman ASA. Built 2010/08/28 02:15:28

Norman Scanner Engine Version: 6.05.11
Nvcbin.def Version: 6.05.00, Date: 2010/08/28 02:15:28, Variants: 6571062

Scan started: 28/08/2010 23:55:53

Running pre-scan cleanup routine:
Operating System: Microsoft Windows Vista 6.0.6002 Service Pack 2
Logged on user: ******\*****

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\Windows\system32\userinit.exe" -> "C:\Windows\System32\userinit.exe,"
Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = "avgrsstx.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll" -> ""

Scanning bootsectors...

Number of sectors found: 0
Number of sectors scanned: 0
Number of sectors not scanned: 0
Number of infections found: 0
Number of infections removed: 0
Total scanning time: 0s


Scanning running processes and process memory...

Number of processes/threads found: 6450
Number of processes/threads scanned: 6450
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 0
Total scanning time: 3m 10s


Scanning file system...

Scanning: prescan

Scanning: C:\*.*

C:\ACER\Preload\Autorun\APP\Nero 8 Essentials\Installation\Data\02FFA518.cab/xfontsC8992C2F.7z/fonts/Type1/.fonts-config-timestamp (Error whilst scanning file: I/O Error (0x00220005))

C:\Program Files\Nero\Nero8\Nero BackItUp\BackItUp_ImageTool\xfonts.7z/fonts/Type1/.fonts-config-timestamp (Error whilst scanning file: I/O Error (0x00220005))

C:\System Volume Information\{04c957ea-b08f-11df-82e7-a36c5e41bec6}{3808876b-c176-4e48-b7ae-04046e6cc752} (Error opening file: Access denied)

C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752} (Error opening file: Access denied)

C:\System Volume Information\{a86ecc25-af09-11df-bace-9ae180e470ad}{3808876b-c176-4e48-b7ae-04046e6cc752} (Error opening file: Access denied)

C:\System Volume Information\{fcf8ad7a-afd3-11df-92de-d84696c5d7c4}{3808876b-c176-4e48-b7ae-04046e6cc752} (Error opening file: Access denied)

C:\Users\*****\Desktop\Vecchio\Roms\Dingoo.A320.Complete.Pack.v1.41.nov.2009\neogeo-games\Ninja Master’s - Hao Ninpo Jo.mvs (Error opening file: Not found)

Scanning: postscan


Running post-scan cleanup routine:
Set TCP/IP autotuning to "normal" (or it was already "normal")

Number of files found: 372270
Number of archives unpacked: 4055
Number of files scanned: 372214
Number of files not scanned: 56
Number of files skipped due to exclude list: 0
Number of infected files found: 0
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 1h 50m 25s

--------------------------------------

Eset Online:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=234c4f3eeb81344c8d1c4e1bcb3c6360
# end=stopped
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-29 10:04:49
# local_time=2010-08-29 12:04:49 (+0100, Hora de verano romance)
# country="Spain"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1024 16777215 100 0 18185504 18185504 0 0
# compatibility_mode=1280 16777215 100 0 297235 297235 0 0
# compatibility_mode=5892 16776574 100 100 17256037 120605630 0 0
# compatibility_mode=8192 67108863 100 0 121 121 0 0
# scanned=123561
# found=1
# cleaned=1
# scan_time=3387
C:\Users\*****\Downloads\SpywareRemovalToolkit_Setup.exe Win32/Adware.SpywareCease application (deleted - quarantined) 00000000000000000000000000000000 C
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=234c4f3eeb81344c8d1c4e1bcb3c6360
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-08-29 11:03:05
# local_time=2010-08-30 01:03:05 (+0100, Hora de verano romance)
# country="Spain"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1024 16777215 100 0 18230252 18230252 0 0
# compatibility_mode=1280 16777215 100 0 341983 341983 0 0
# compatibility_mode=5892 16776574 100 100 17300785 120650378 0 0
# compatibility_mode=8192 67108863 100 0 44869 44869 0 0
# scanned=197876
# found=0
# cleaned=0
# scan_time=5335

-----------------------------------------

Thank you!

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 PM

Posted 29 August 2010 - 08:55 PM

How is your computer running now?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 arrivederci

arrivederci
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:11:30 PM

Posted 30 August 2010 - 03:11 AM

Hi,

it looks fine, I hope Brontok is not there anymore!

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:30 PM

Posted 30 August 2010 - 07:46 AM

URL=http://en.wikipedia.org/wiki/Brontok]BRONTOK[/URL] (aka Rontokbro) is an older type of malware (worm) that arrives as an email attachment. When executed, it modifies the registry and adds an entry to start itself each time Windows boots up. The worm has been seen with several variants since it first appeared. Common signs of the infection include:
  • Presence of the worm related file in the system folder.
  • Modifications to file viewing settings.
  • Removal of Folder Option on Windows Explorer.
  • Instability of computer system.
  • Complaints about Brontok from security tools.
  • Inability to open Task Manager or command line.
Various security vendors created specific tools to assist with disinfection.If you receive any more alerts try one of the above.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users