Login  Malware Removal & HijackThis Logs |
| |
| |
| | Thread Tools |
08-May-2008, 12:22 AM
#1 | |||||
| Solved: Vundo Infection, please help! |
| |
08-May-2008, 02:28 PM
#2 | |||||
| Hi, SewingKoala.  Welcome to TSG.  Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systemsUpgrading Java:
http://filehippo.com/download_java_runtime/ Please download VundoFix.exe to your desktop. Note: In the event you already have Vundofix, this is a new version that I need you to download.
Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
11-May-2008, 12:44 PM
#3 | |||||
| |
11-May-2008, 05:08 PM
#4 | |||||
| Hi, SewingKoala
Code: File::
C:\WINDOWS\BM9b292e02.xml
C:\WINDOWS\fetchuserid.exe
C:\Documents and Settings\User\klextlock.dat
Folder::
C:\WINDOWS\system32\xcsDd01
C:\Temp\berDrv11
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3713cba8-1a77-4efe-9f1b-f201f8d2245b}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"P2kAutostart"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGwVNgH]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlogon]  Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report. Please do an online scan with Kaspersky WebScanner (Use internet Explorer) Click on Accept You will be promted to install an ActiveX component from Kaspersky, Click Yes.
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
12-May-2008, 01:59 AM
#5 | |||||
| |
12-May-2008, 06:08 PM
#6 | |||||
| Hi, SewingKoala Just some housekeeping left.
Code: File:: C:\Documents and Settings\User\My Documents\funny faces.exe Folder:: C:\WINDOWS\system32\vhbnrb Registry:: [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load] Once saved, referring to the picture above, drag CFScript.txt into ComboFix.exe, and post back the resulting report along with a Hijackthis log..
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
12-May-2008, 06:27 PM
#7 | |||||
| |
12-May-2008, 06:47 PM
#8 | |||||
| Hi, SewingKoala. The log looks clear, congratulations.  Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.) To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account. (Windows XP) 1. Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore*. Click Apply, and then click OK.. Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools. Follow these steps to uninstall Combofix and tools used in the removal of malware
The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.
Click Here for some advise from our security Experts. Please use the thread's Tools and mark this thread as "Solved". Best wishes! 
__________________ Sometimes I think I understand everything, then I regain consciousness. If i have helped you, please make a donation to keep the site running. All proceeds go directly to the site!!! Donate Here Unanswered threads for 5 days will no longer be part of my subscriptions. For further help, please send me a Private Message. This applies only to the original thread starter. Everyone else please begin a New Thread. |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 03:28 AM. Copyright © 1996 - 2008 TechGuy, Inc. All rights reserved. Powered by vBulletin, Copyright © 2000 - 2008, Jelsoft Enterprises Ltd. Search Engine Optimization by vBSEO 3.1.0 |  |
