Login 
 Search | |
| |
18-Nov-2007, 02:01 AM
#1 | |||||
| Virus won't go away |
| |
18-Nov-2007, 12:22 PM
#5 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
19-Nov-2007, 04:33 PM
#7 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
21-Nov-2007, 01:39 AM
#8 | |||||
| SDFix: Version 1.115 Run by Administrator on Wed 11/21/2007 at 11:24 AM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\system32\ckl009.dat - Deleted Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-21 11:29:34 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\standardprofile\authorizedapplications\list] "D:\\Softwares\\Limewire\\LimeWire.exe"="D:\\Softwares\\Limewire\\LimeWire. exe:*:Enabled:LimeWire" "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent" "C:\\WINDOWS\\System32\\WinUpdater.exe"="C:\\WINDOWS\\System32\\WinUpdater. exe:*  isabled:WinUpdater"[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameter s\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: Wed 13 Jun 2007 568,832 ..SHR --- "C:\WINDOWS\system32\WinUpdater.exe" Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe" Wed 4 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe" Sun 24 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak" Sun 11 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fe95c915e785c18bf9cc0792fb5a73df\ BIT1.tmp" Sun 24 Dec 2006 20 A..H. --- "C:\Documents and Settings\King of Kings\My Documents\My Music\License Backup\drmv1lic.bak" Sun 24 Dec 2006 4,348 ...H. --- "C:\Documents and Settings\King of Kings\My Documents\My Music\License Backup\drmv1key.bak" Sat 28 Oct 2006 312 A.SH. --- "C:\Documents and Settings\King of Kings\My Documents\My Music\License Backup\drmv2key.bak" Sat 25 Aug 2007 20 A..H. --- "C:\Documents and Settings\King of Kings\Application Data\Real\rhapsody\wmlicbackup\drmv1lic.bak" Sun 24 Dec 2006 4,348 ...H. --- "C:\Documents and Settings\King of Kings\Application Data\Real\rhapsody\wmlicbackup\drmv1key.bak" Sat 25 Aug 2007 1,536 A..H. --- "C:\Documents and Settings\King of Kings\Application Data\Real\rhapsody\wmlicbackup\drmv2lic.bak" Sat 28 Oct 2006 312 ...H. --- "C:\Documents and Settings\King of Kings\Application Data\Real\rhapsody\wmlicbackup\drmv2key.bak" Finished! |
22-Nov-2007, 05:44 AM
#13 | |||||
|
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
23-Nov-2007, 10:49 AM
#15 | |||||
| Open Notepad and copy and paste the text in the code box below into it: Code: File:: C:\WINDOWS\system32\WinUpdater.exe Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Updater"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "Windows Updater"=- Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.  This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply together with a new HijackThis log. and then * Run Kaspersky online virus scan Kaspersky Online Scanner. After the updates have downloaded, click on the "Scan Settings" button. Choose the "Extended database" for the scan. Under "Please select a target to scan", click "My Computer". When the scan is finished, Save the results from the scan! Note: You have to use Internet Explorer to do the online scan. Post a new HiJackThis log along with the results from Kaspersky scan Note: Kavscan is a scanner only & won't fix anything but will normally find the most infected files so it's report gives us a good place to work from You must use IE for the scan to work
__________________ Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 11:02 AM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile