Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malwarebytes auto exiting, sites get infetced via FTP


  • Please log in to reply
27 replies to this topic

#16 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 26 August 2010 - 08:15 PM

^^ It's the same computer but since I have done the above instructions, I guess it doesn't apply anymore?

Regarding the Kaspersky Virus Removal Tool, I'll run it now and I'll post the results here immediately after.

Thanks for all the help so far. I really appreciate it.

Edited by darkwind, 26 August 2010 - 08:16 PM.


BC AdBot (Login to Remove)

 


#17 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 26 August 2010 - 08:48 PM

Ok.

I'm going to close that thread. If we need to refer you back there, fresh logs should be posted anyway with a link to this thread of steps taken.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#18 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 27 August 2010 - 12:30 AM

Here's the Kaspersky scan resullt


8/27/2010 9:53:34 AM Detected: Trojan-Downloader.Java.Agent.gf C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:34 AM Detected: Trojan-Downloader.Java.Agent.gf C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:38 AM Detected: Trojan-Downloader.Java.Agent.cg C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:46 AM Deleted: Trojan-Downloader.Java.Agent.cg C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:46 AM Detected: Trojan-Downloader.Java.Agent.ci C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:46 AM Deleted: Trojan-Downloader.Java.Agent.gf C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:47 AM Detected: Trojan-Downloader.Java.Agent.ge C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:47 AM Deleted: Trojan-Downloader.Java.Agent.gf C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/a13d8.class
8/27/2010 9:53:47 AM Detected: Trojan-Downloader.Java.Agent.ge C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:48 AM Deleted: Trojan-Downloader.Java.Agent.ci C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:48 AM Detected: Trojan.Java.Agent.d C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:53:53 AM Deleted: Trojan-Downloader.Java.Agent.ge C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:53 AM Detected: Exploit.Java.Agent.cd C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:53:56 AM Deleted: Exploit.Java.Agent.cd C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache6385102476259948009.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:53:56 AM Deleted: Trojan.Java.Agent.d C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache8088556174814540464.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:53:56 AM Deleted: Trojan-Downloader.Java.Agent.ge C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/a1500b0.class
8/27/2010 9:53:56 AM Detected: Exploit.Java.Agent.cd C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:53:57 AM Deleted: Exploit.Java.Agent.cd C:\Documents and Settings\Renan\Local Settings\Temp\jar_cache3629965466509200811.tmp/zzz/ttt/ad3740b4.class
8/27/2010 9:54:18 AM Detected: Trojan-PSW.Win32.Kates.ma C:\Documents and Settings\Renan\Local Settings\Temp\vsgxvy.tmp
8/27/2010 9:54:32 AM Deleted: Trojan-PSW.Win32.Kates.ma C:\Documents and Settings\Renan\Local Settings\Temp\vsgxvy.tmp
8/27/2010 10:01:52 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\Local Settings\Temporary Internet Files\Content.IE5\JS7DCQH4\link[1].pdf/data0000
8/27/2010 10:01:52 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\Local Settings\Temporary Internet Files\Content.IE5\JS7DCQH4\link[2].pdf/data0000
8/27/2010 10:02:05 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\Local Settings\Temporary Internet Files\Content.IE5\TJ2FXO44\link[1].pdf/data0000
8/27/2010 10:02:16 AM Detected: Exploit.PHP.Agent.h C:\Documents and Settings\Renan\My Documents\pbav6.zip/advertise/images/gifimg.php
8/27/2010 10:05:44 AM Deleted: Exploit.PHP.Agent.h C:\Documents and Settings\Renan\My Documents\pbav6.zip/advertise/images/gifimg.php
8/27/2010 10:05:51 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/avatar/index.html
8/27/2010 10:06:13 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/yshout/js/moo.ajax.js
8/27/2010 10:06:23 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/yshout/js/soundmanager2.js
8/27/2010 10:06:27 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/yshout/js/yshout.js
8/27/2010 10:06:33 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/yshout/docs.html
8/27/2010 10:09:34 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/yshout/settings.js
8/27/2010 10:09:36 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/ssi_examples.shtml
8/27/2010 10:09:40 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/sha1.js
8/27/2010 10:09:53 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/script.js
8/27/2010 10:09:56 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/fader.js
8/27/2010 10:10:41 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/xml_topic.js
8/27/2010 10:10:58 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/spellcheck.js
8/27/2010 10:11:01 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/default/xml_board.js
8/27/2010 10:11:48 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/sha1.js
8/27/2010 10:12:14 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/script.js
8/27/2010 10:12:17 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/fader.js
8/27/2010 10:12:30 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/xml_topic.js
8/27/2010 10:12:44 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/spellcheck.js
8/27/2010 10:12:47 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/Themes/pbav6/xml_board.js
8/27/2010 10:14:46 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/forum/mymod/animatedcollapse.js
8/27/2010 10:15:33 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/logo/index.html
8/27/2010 10:15:43 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/scripts/select.js
8/27/2010 10:15:46 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/scripts/carousel.js
8/27/2010 10:15:52 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/scripts/ajaxtabs.js
8/27/2010 10:15:55 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/scripts/tabcontent.js
8/27/2010 10:16:01 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/twitter/jquery-1.3.1.min.js
8/27/2010 10:16:05 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/twitter/jquery.juitter.js
8/27/2010 10:16:08 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\pbav6.zip/twitter/system.js
8/27/2010 10:19:15 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\countdown.js
8/27/2010 10:21:43 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\autosave.dev.js
8/27/2010 10:21:44 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\autosave.js
8/27/2010 10:21:53 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\colorpicker.dev.js
8/27/2010 10:21:53 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\colorpicker.js
8/27/2010 10:21:55 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\comment-reply.dev.js
8/27/2010 10:21:55 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\comment-reply.js
8/27/2010 10:21:55 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\hoverIntent.dev.js
8/27/2010 10:21:56 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\hoverIntent.js
8/27/2010 10:21:56 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\json2.dev.js
8/27/2010 10:21:57 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\json2.js
8/27/2010 10:21:58 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\prototype.js
8/27/2010 10:21:59 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\quicktags.dev.js
8/27/2010 10:22:02 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\quicktags.js
8/27/2010 10:22:02 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\swfobject.js
8/27/2010 10:22:03 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\tw-sack.dev.js
8/27/2010 10:22:03 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\tw-sack.js
8/27/2010 10:22:03 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\wp-ajax-response.dev.js
8/27/2010 10:22:04 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\wp-ajax-response.js
8/27/2010 10:22:04 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\wp-lists.dev.js
8/27/2010 10:22:05 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wordpress\wp-includes\js\wp-lists.js
8/27/2010 10:26:36 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-content\themes\WPMagnumBlue\script.js
8/27/2010 10:29:48 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\autosave.dev.js
8/27/2010 10:29:48 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\autosave.js
8/27/2010 10:29:49 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\colorpicker.dev.js
8/27/2010 10:29:54 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\colorpicker.js
8/27/2010 10:29:56 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\comment-reply.js
8/27/2010 10:29:56 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\comment-reply.dev.js
8/27/2010 10:29:57 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\hoverIntent.dev.js
8/27/2010 10:29:57 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\hoverIntent.js
8/27/2010 10:29:57 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\json2.dev.js
8/27/2010 10:29:58 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\json2.js
8/27/2010 10:30:00 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\quicktags.dev.js
8/27/2010 10:30:00 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\prototype.js
8/27/2010 10:30:00 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\quicktags.js
8/27/2010 10:30:02 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\swfobject.js
8/27/2010 10:30:02 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tw-sack.dev.js
8/27/2010 10:30:04 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tw-sack.js
8/27/2010 10:30:04 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\wp-ajax-response.dev.js
8/27/2010 10:30:04 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\wp-ajax-response.js
8/27/2010 10:30:05 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\wp-lists.dev.js
8/27/2010 10:30:06 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\wp-lists.js
8/27/2010 10:30:06 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\codepress\codepress.js
8/27/2010 10:30:14 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\crop\cropper.js
8/27/2010 10:30:16 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\imgareaselect\jquery.imgareaselect.dev.js
8/27/2010 10:30:16 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\imgareaselect\jquery.imgareaselect.js
8/27/2010 10:30:17 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jcrop\jquery.Jcrop.js
8/27/2010 10:30:17 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jcrop\jquery.Jcrop.dev.js
8/27/2010 10:30:18 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.color.dev.js
8/27/2010 10:30:18 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\interface.js
8/27/2010 10:30:19 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.color.js
8/27/2010 10:30:21 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.form.dev.js
8/27/2010 10:30:21 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.hotkeys.dev.js
8/27/2010 10:30:22 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.form.js
8/27/2010 10:30:23 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.hotkeys.js
8/27/2010 10:30:23 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.schedule.js
8/27/2010 10:30:23 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.js
8/27/2010 10:30:24 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.table-hotkeys.dev.js
8/27/2010 10:30:25 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\jquery.table-hotkeys.js
8/27/2010 10:30:25 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\suggest.dev.js
8/27/2010 10:30:26 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\suggest.js
8/27/2010 10:30:26 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.core.js
8/27/2010 10:30:27 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.dialog.js
8/27/2010 10:30:28 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.draggable.js
8/27/2010 10:30:28 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.droppable.js
8/27/2010 10:30:28 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.resizable.js
8/27/2010 10:30:29 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.selectable.js
8/27/2010 10:30:30 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.sortable.js
8/27/2010 10:30:30 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\jquery\ui.tabs.js
8/27/2010 10:30:31 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\builder.js
8/27/2010 10:30:32 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\controls.js
8/27/2010 10:30:32 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\dragdrop.js
8/27/2010 10:30:32 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\effects.js
8/27/2010 10:30:34 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\scriptaculous.js
8/27/2010 10:30:34 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\prototype.js
8/27/2010 10:30:35 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\slider.js
8/27/2010 10:30:37 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\sound.js
8/27/2010 10:30:37 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\unittest.js
8/27/2010 10:30:37 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\scriptaculous\wp-scriptaculous.js
8/27/2010 10:30:38 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\swfupload\handlers.dev.js
8/27/2010 10:30:38 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\swfupload\handlers.js
8/27/2010 10:30:39 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\swfupload\swfupload-all.js
8/27/2010 10:30:39 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\swfupload\swfupload.js
8/27/2010 10:30:42 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\thickbox\thickbox.js
8/27/2010 10:30:42 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tinymce\blank.htm
8/27/2010 10:30:43 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tinymce\tiny_mce_popup.js
8/27/2010 10:30:44 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tinymce\tiny_mce.js
8/27/2010 10:30:44 AM Detected: HEUR:Trojan.Script.Generic C:\Documents and Settings\Renan\My Documents\Downloads\Compressed\backup-superaffiliate.com-8-13-2010\public_html\wp-includes.old\js\tinymce\wp-tinymce.js
8/27/2010 11:22:11 AM Detected: http://www.viruslist.com/en/advisories/39934 C:\Program Files\Adobe\PhotoshopCS4Portable\App\Photoshop\Photoshop.exe
8/27/2010 11:26:11 AM Detected: http://www.viruslist.com/en/advisories/39272 C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.dll
8/27/2010 12:08:31 PM Detected: http://www.viruslist.com/en/advisories/41014 C:\Program Files\Google\Chrome\Application\5.0.375.126\nacl64.dll
8/27/2010 12:08:39 PM Detected: http://www.viruslist.com/en/advisories/41014 C:\Program Files\Google\Chrome\Application\5.0.375.126\chrome.dll
8/27/2010 12:09:17 PM Detected: http://www.viruslist.com/en/advisories/39446 C:\Program Files\Internet Download Manager\IDMan.exe
8/27/2010 12:21:44 PM Detected: http://www.viruslist.com/en/advisories/40534 C:\Program Files\Winamp\winamp.exe
8/27/2010 12:55:57 PM Detected: Exploit.SWF.Agent.dl C:\WINDOWS\Temp\5871bb8b-c40e-41a0-8ed0-178ff15c9cc9.tmp/Swf2Swc
8/27/2010 12:57:31 PM Deleted: Exploit.SWF.Agent.dl C:\WINDOWS\Temp\5871bb8b-c40e-41a0-8ed0-178ff15c9cc9.tmp
8/27/2010 12:58:52 PM Detected: http://www.viruslist.com/en/advisories/40206 E:\wamp2\bin\apache\Apache2.2.11\bin\httpd.exe
8/27/2010 12:59:17 PM Detected: http://www.viruslist.com/en/advisories/40729 C:\Program Files\QuickTime\QuickTimePlayer.exe
8/27/2010 1:00:27 PM Detected: http://www.viruslist.com/en/advisories/40534 C:\Program Files\Winamp\winamp.exe
8/27/2010 1:07:31 PM Detected: http://www.viruslist.com/en/advisories/39446 C:\Program Files\Internet Download Manager\IDMan.exe
8/27/2010 1:11:08 PM Detected: http://www.viruslist.com/en/advisories/40206 E:\wamp2\bin\apache\Apache2.2.11\bin\httpd.exe

#19 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 27 August 2010 - 05:30 AM

Can you complete a scan with Malwarebytes now?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#20 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 27 August 2010 - 06:07 AM

Yes, It's not closing anymore.

#21 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 27 August 2010 - 06:19 AM

Ok then, finish the scan and post the log for my review.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#22 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 27 August 2010 - 06:57 AM

Here's the log, looks like it found nothing.


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

8/27/2010 7:56:01 PM
mbam-log-2010-08-27 (19-56-01).txt

Scan type: Full scan (C:\|)
Objects scanned: 223182
Time elapsed: 47 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#23 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 27 August 2010 - 07:05 AM

How is your computer running now? Are there any more signs of infection, strange audio ads, security alerts or browser redirects?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#24 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 27 August 2010 - 07:12 AM

I had none of those.

The things I noticed were, my MBAM and IDM wasn't starting/runnng, Aobe Acrobat reader doesn't work anymore and my sites gets infected with malware when I used FTP.

Not sure if this solves it all issues, although MBAM didn;t find anything.

#25 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 27 August 2010 - 07:17 AM

Try uninstalling, then re-installing your IDM and Adobe Acrobat reader. There are serious security issues with older versions of Adobe Reader which can increase the risk of system infection so make sure you are installing the most current version (v9.3.4).

Edited by quietman7, 27 August 2010 - 07:18 AM.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#26 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 27 August 2010 - 07:48 AM

OK,

I will try that. Thanks.

Do you think what we did above solved the FTP issue? I'm still kinda skeptical to use it although it's really one of my most used programs.

#27 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:24 PM

Posted 27 August 2010 - 02:02 PM

Do you think what we did above solved the FTP issue?

There's no way for me to tell from my end.

There are no guarantees or shortcuts when it comes to malware removal and the use of specialized fix tools, especially when dealing with backdoor Trojans, Botnets, IRCBots or rootkit components that can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Infections will vary and some will cause more harm to your system then others as a result of it having the ability to download more malicious files. Thus, sometimes it takes several efforts with different, the same or more powerful tools to do the job. Even then, with some types of malware infections, the task can be arduous.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#28 darkwind

darkwind
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:01:24 AM

Posted 28 August 2010 - 06:58 AM

ok.

Thanks for all the help. I really appreciate it. I will try reinstall those applications and try the FTP.

Thanks again.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users