Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
13-Apr-2008, 09:30 AM
#1 | |||||
 Solved: Hijack this log! I got a major infection of adware,malware and spyware a few days ago. I got rid of some of it, but i need help could someone please tell me if there is anything i need to delete from my Hijack this log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:29:41 PM, on 13/04/2008 Platform: Windows XP SP3, v.3244 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.3244) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe C:\Program Files\Ahead\InCD\InCD.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\HP\HP Software Update\HPWuSchd.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\bfeitbcz.exe C:\WINDOWS\system32\regsvr32.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\regsvr32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2CCEA100-B5C1-4A21-B44F-B8BFC58ECF79} - C:\WINDOWS\system32\vtUlMgFX.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [bfeitbcz] C:\WINDOWS\system32\bfeitbcz.exe O4 - HKLM\..\Run: [cvclcved] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cvclcved.dll" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe" O4 - HKLM\..\Run: [ucaaukhb] C:\WINDOWS\system32\ucaaukhb.exe O4 - HKLM\..\Run: [yxgrwhqt] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\yxgrwhqt.dll" O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [4829703a] rundll32.exe "C:\WINDOWS\system32\blakedch.dll",b O4 - HKLM\..\Run: [BM4b1a43a6] Rundll32.exe "C:\WINDOWS\system32\ysyuupil.dll",s O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: aqmkgdbj - C:\WINDOWS\SYSTEM32\aqmkgdbj.dll O20 - Winlogon Notify: __c0041390 - C:\WINDOWS\SYSTEM32\__c0041390.dat O20 - Winlogon Notify: __c00F4A4D - C:\WINDOWS\SYSTEM32\__c00F4A4D.dat O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe -- End of file - 9512 bytes Thanks..Mucknie...  |
| |
15-Apr-2008, 01:13 PM
#4 | ||||||
| Open Notepad and copy and paste the text in the quote box below into it: Quote:
Save the file to you desktop and name it CFScript.txt Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply. Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
Click Exit on the Main menu to close the program. Download (save and select your desktop to save it to) SUPERAntiSpyware Free for Home Users
Please perform a scan with Kaspersky Webscan Online Virus Scanner
Kaspersky does not remove anything but will provide a log of anything it finds. On August 8th, 2006 Kaspersky updated the software used for Free Online Virus Scanner. In order to continue using the online scanner you will need to uninstall the old version (if previously used) from your Add/Remove Programs list and then install the latest version. To do this, follow the steps here and reboot afterwards if your system does not reboot automatically or it will show 'Kaspersky Online Scanner license key was not found!
__________________ Microsoft MVP/Windows - Consumer Security If we have helped you, please consider making a donation to TSG! |
22-Apr-2008, 07:20 AM
#8 | |||||
| Otmoveit log: File/Folder C:\WINDOWS\system32\__c00F4A4D.dat not found. File/Folder C:\WINDOWS\system32\hcdekalb.ini not found. File/Folder C:\WINDOWS\system32\__c0041390.dat not found. File/Folder C:\Documents and Settings\All Users\Application Data\yxgrwhqt.dll not found. File/Folder C:\WINDOWS\system32\__c001ACB4.dat not found. File/Folder C:\Documents and Settings\All Users\Application Data\cvclcved.dll not found. C:\WINDOWS\system32\OPINVJPM moved successfully. OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04212008_150121 SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 04/21/2008 at 04:03 PM Application Version : 4.0.1154 Core Rules Database Version : 3444 Trace Rules Database Version: 1436 Scan type : Complete Scan Total Scan Time : 00:49:16 Memory items scanned : 381 Memory threats detected : 0 Registry items scanned : 5324 Registry threats detected : 0 File items scanned : 31394 File threats detected : 5 Trojan.Unclassified-Packed/Suspicious C:\SYSTEM VOLUME INFORMATION\_RESTORE{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0093785.DLL Trojan.Unclassified/AffiliateBundle C:\SYSTEM VOLUME INFORMATION\_RESTORE{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095012.DLL Adware.Vundo-Variant/E C:\SYSTEM VOLUME INFORMATION\_RESTORE{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095023.DLL Trojan.Unclassified/Multi-Dropper C:\SYSTEM VOLUME INFORMATION\_RESTORE{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095024.EXE Adware.Vundo-Variant/Small-A C:\SYSTEM VOLUME INFORMATION\_RESTORE{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095025.DLL kapersky log: ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Monday, April 21, 2008 9:17:54 PM Operating System: Microsoft Windows XP Professional, Service Pack 3, v.3244 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 22/04/2008 Kaspersky Anti-Virus database records: 720722 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 94159 Number of viruses found: 3 Number of infected objects: 7 Number of suspicious objects: 0 Duration of the scan process: 02:42:58 Infected Object Name / Virus Name / Last Action C:\autorun.inf\lpt3.This folder was created by Flash_Disinfector Object is locked skipped C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Fung\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx/[From "jelly bean" <jzdrag@hotmail.com>][Date Wed, 23 Jan 2008 20:20:34 +1100]/keyfinder.rar/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.g skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx/[From "jelly bean" <jzdrag@hotmail.com>][Date Wed, 23 Jan 2008 20:20:34 +1100]/keyfinder.rar/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx/[From "jelly bean" <jzdrag@hotmail.com>][Date Wed, 23 Jan 2008 20:20:34 +1100]/keyfinder.rar/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx/[From "jelly bean" <jzdrag@hotmail.com>][Date Wed, 23 Jan 2008 20:20:34 +1100]/keyfinder.rar/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx/[From "jelly bean" <jzdrag@hotmail.com>][Date Wed, 23 Jan 2008 20:20:34 +1100]/keyfinder.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Identities\{85CF58BC-D31A-47C8-8C7F-B11A5538F59C}\Microsoft\Outlook Express\Outbox.dbx MailMSOutlook5: infected - 5 skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Fung\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Fung\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Fung\Local Settings\History\History.IE5\MSHist012008042120080422\index.dat Object is locked skipped C:\Documents and Settings\Fung\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Fung\ntuser.dat Object is locked skipped C:\Documents and Settings\Fung\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\Fung\UserData\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP139\A0078295.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP139\A0078304.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP139\A0079154.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP139\A0081232.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP139\A0084209.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP140\A0086230.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP142\A0088222.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095008.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095009.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095010.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095011.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095013.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095014.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095015.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095017.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095018.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095019.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095020.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095021.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095029.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP153\A0095031.dll Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP169\change.log Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP22\A0037930.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP24\A0037936.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP48\A0048184.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP50\A0048489.exe Object is locked skipped C:\System Volume Information\_restore{92156243-A130-4AB9-8B6F-70A500A3EB22}\RP78\A0054017.exe Infected: not-a-virus  ownloader.Win32.VDown.a skippedC:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\drivers\etc\Hosts.bak Object is locked skipped C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. |
22-Apr-2008, 02:32 PM
#9 | ||||||
| The remainder of the infected items are in your Outlook sent. I would suggest you empty that and the deleted items folder. Follow these steps to uninstall Combofix and tools used in the removal of malware
It's a good idea to Flush your System Restore after removing malware: Turn off system restore and then turn it back on: http://support.microsoft.com/kb/310405 Now you should Clean up your PC Here are some additional links for you to check out to help you with your computer security. How did I get infected in the first place. Good free tools and advice on how to tighten your security settings. Security Help Tools
__________________ Microsoft MVP/Windows - Consumer Security If we have helped you, please consider making a donation to TSG! |
