Malware Found in ThreatFire Can't Get Rid of It [RESOLVED]

Welcome Guest ( Log In | Register )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis™ Logs Go Here

Malware Found in ThreatFire Can't Get Rid of It [RESOLVED]

Options

VidenTheColdOne View Member Profile	Jun 19 2008, 12:00 AM Post #1
Member Posts: 35 From: New Jersey OS: Windows XP SP3	i recently downloaded threat fire, and have been using it for a bit, it's a very good tool. I did a full scan the other day, and it came up with 4 instances. I click the quarantine option, but it just sits there and says "processing" and will not get rid of the problems. I fear these may be causing my computer harm, and i need to get rid of them. How would you suggest i go about getting rid of these? I have Avast, and it doesn't seem to find them, i also have spyware doctor, and it finds nothing, also ad-aware, and spybot S&D, none of them are finding what TF is. I would include some screenshots, but they don't display the info well. It said there was some kind of Trojan gen. Here are the details: System Scan Detected a threat Triggered on 6/19/2008 at 12:56:53 AM Triggered by I:\programs\Writers Tools-11in1-\WT.rar Triggered by E:\Documents and Settings\Viden\My Documents\My Music\downloads\01498A8C\protected_07_19_2006_20_54_29.asf Triggered by E:\Documents and Settings\Viden\My Documents\My Music\Downloads\023COBE8\protected_08_10_2006_13_35_01.asf Triggered by E:\Documents and Settings\Viden\My Documents\My Music\Downloads\0263886D\protected_08_10_2006_14_18_08.asf Now, i don't know what those files are in the "My Music" folder. I never use that folder, and i don't know why those files are there. Any help would be appreciated. Thanks If you need any more info let me know. Ty

Rorschach112 View Member Profile	Jun 22 2008, 10:11 AM Post #2
GeekU Teacher Posts: 19,258 From: Dublin OS: XP	Hello CLICK HERE to download the HijackThis Installer: Save HJTInstall.exe to your desktop. Double-click on HJTInstall.exe to run the program. By default it will install to C:\Program Files\Trend Micro\HijackThis. Accept the license agreement by clicking the "I Accept" button. Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. Click "Save log" to save the log file and then the log will open in Notepad. Click on "Edit -> Select All" then click on "Edit -> Copy" to copy the entire contents of the log. Come back here to this thread and paste the log in your next reply. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required. Please do an online scan with Kaspersky WebScanner Click on Kaspersky Online Scanner and click Accept You will be prompted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post.

VidenTheColdOne View Member Profile	Jun 22 2008, 11:55 AM Post #3
Member Posts: 35 From: New Jersey OS: Windows XP SP3	Ok, i got the HijackThis file. I went to the Kaspersky site, and clicked "accept" I waited for like 10 minutes, and nothing happened. I reloaded and tried again, but nothing no activeX thing comes up. Am i doing something wrong? Or is there something wrong with my browser settings? Thanks. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:44:22 PM, on 6/22/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\csrss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\svchost.exe E:\Program Files\Windows Defender\MsMpEng.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\system32\svchost.exe E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\WINDOWS\system32\spoolsv.exe E:\Program Files\Bonjour\mDNSResponder.exe E:\Program Files\Comodo\Firewall\cmdagent.exe E:\Program Files\LogMeIn\x86\RaMaint.exe E:\Program Files\LogMeIn\x86\LogMeIn.exe E:\Program Files\LogMeIn\x86\LMIGuardian.exe E:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe E:\WINDOWS\system32\nvsvc32.exe D:\Programs\PrfldSvc.exe E:\Program Files\Spyware Doctor\pctsAuxs.exe E:\Program Files\Spyware Doctor\pctsSvc.exe E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe E:\Program Files\Spyware Doctor\pctsTray.exe E:\WINDOWS\system32\svchost.exe E:\Program Files\ThreatFire\TFService.exe E:\WINDOWS\system32\wdfmgr.exe E:\Program Files\Viewpoint\Common\ViewpointService.exe E:\WINDOWS\Explorer.EXE E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe E:\WINDOWS\System32\alg.exe E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe E:\Program Files\Windows Defender\MSASCui.exe E:\WINDOWS\RTHDCPL.EXE E:\Program Files\Microsoft IntelliPoint\ipoint.exe E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE E:\Program Files\Comodo\Firewall\CPF.exe E:\WINDOWS\system32\BtUsrBdg.exe E:\WINDOWS\system32\BTSetBootKey.exe e:\Program Files\Microsoft IntelliPoint\dpupdchk.exe E:\Program Files\Ideazon\ZEngine\Zboard.exe E:\Program Files\ThreatFire\TFTray.exe E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE E:\WINDOWS\system32\ctfmon.exe E:\Program Files\Uniblue\SpyEraser\SpyEraser.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe E:\WINDOWS\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - E:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [PHIME2002ASync] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] E:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [IntelliPoint] "e:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [IMJPMIG8.1] "E:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [EPSON Stylus C88 Series] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE /P23 "EPSON Stylus C88 Series" /O5 "LPT1:" /M "Stylus C88" O4 - HKLM\..\Run: [COMODO Firewall Pro] "E:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [BTUSRBDG] BtUsrBdg.exe O4 - HKLM\..\Run: [BTSETBOOTKEY] BTSetBootKey.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ISTray] "E:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [NBKeyScan] "E:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [Zboard] E:\Program Files\Ideazon\ZEngine\Zboard.exe O4 - HKLM\..\Run: [ThreatFire] E:\Program Files\ThreatFire\TFTray.exe O4 - HKLM\..\Run: [EPSON Stylus C88 Series (Copy 1)] E:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE /P32 "EPSON Stylus C88 Series (Copy 1)" /O6 "USB001" /M "Stylus C88" O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Steam] "e:\progra~1\valve\steam\steam.exe" -silent O4 - HKCU\..\Run: [Uniblue SpyEraser] "E:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - E:\WINDOWS\system32\shdocvw.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - E:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://game1.pogo.com O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1206990587437 O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/support/includes/cabs/si.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://gameadvisor.futuremark.com/global/msc3121.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FCCC5573-1720-4710-BE2C-FE210F2EE059}: NameServer = 208.67.222.222,208.67.220.220 O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - E:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - E:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - E:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - E:\Program Files\LogMeIn\x86\RaMaint.exe O23 - Service: LogMeIn - LogMeIn, Inc. - E:\Program Files\LogMeIn\x86\LogMeIn.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - E:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - E:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe O23 - Service: Private Folder Service (prfldsvc) - Unknown owner - D:\Programs\PrfldSvc.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - E:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - E:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - E:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: ThreatFire - PC Tools - E:\Program Files\ThreatFire\TFService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - E:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 11259 bytes

Rorschach112 View Member Profile	Jun 22 2008, 01:34 PM Post #4
GeekU Teacher Posts: 19,258 From: Dublin OS: XP	Do this Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. If your anti-virus or firewall complains, please allow this script to run as it is not malicious. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply. Click here to use the F-Secure Online Scanner Then click the Start Scanning button below. You should get a notification (bar on top) to install the activeX. Click on it and select to install the ActiveX. Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan. In case you are having problems with installing the ActiveX/starting the scan, please read here. Click the Full System Scan button. It will start to download scanner components and databases. This can take a while. The main scan will start. Once the scan finished scanning, click the Automatic cleaning (recommended) button It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure. The cleaning can take a while, so please be patient. Then click the Show report button and copy and paste what's present under results in your next reply.

Rorschach112 View Member Profile	Jun 22 2008, 02:38 PM Post #6
GeekU Teacher Posts: 19,258 From: Dublin OS: XP	Do this after it Please download the OTMoveIt2 by OldTimer. Save it to your desktop. Please double-click OTMoveIt2.exe to run it. Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE [kill explorer] HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a8b6ae5-f80f-11db-b2d9-001921747f61} purity EmptyTemp [start explorer] Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste. Click the red Moveit! button. A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply. Close OTMoveIt2 If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

VidenTheColdOne View Member Profile	Jun 22 2008, 04:54 PM Post #7
Member Posts: 35 From: New Jersey OS: Windows XP SP3	Scanning Report Sunday, June 22, 2008 16:33:06 - 17:57:42 Computer name: RAHL Scanning type: Scan system for malware, rootkits Target: D:\ E:\ I:\ Result: 23 malware found RemoteAdmin.Win32.RemotelyAnywhere (spyware) * System Trojan.Win32.Qhost.hi (virus) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{14DB0F6C-C02F-4A6F-AADB-D7F80D40B9DA} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{1A4B68F9-5178-4BA3-BAD6-581695D94934} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{26F42C9C-D2E2-4DA2-A80E-E3595E7F6412} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{32F20B07-B798-4ACE-B3A4-48AC42C3E14F} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{3386E7A2-3657-482A-8007-FE54B06E0392} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{3A6B455F-52BB-4E33-A445-FDF78C9ACCD9} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{49EF25DE-937F-4F8B-941A-3C4EA7E4979B} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{6AD65CF6-B3D4-48CC-90E0-647F74025C01} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{72673BDD-0BB3-4B80-BA29-D7623BFD6CBF} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{84B8DB1E-3B60-4C46-AD07-0E846483DC7A} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{A8BD0F00-90A6-4C35-ADEB-8CE4A333C97A} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{B17AC662-78DE-44EA-A77C-F74DEFBEB455} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{CD1702FB-472A-45C1-BA36-F760AB6C25C3} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{D05B91D3-EF53-4985-BC13-CE3B1EC05D0E} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{D25EED6C-7266-4186-975F-0A1EB2675BFA} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{D53DC93C-1D6C-45CA-8FED-3EE11729D1B3} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{F42F2F0D-94EE-42A1-A783-CDBAB89A14CE} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{F5868550-BC99-4200-BBAC-4BC645A0CAE8} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{F757F071-3448-4B78-8159-AE17D082AF6B} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{FB3CD2D5-D885-429F-B55C-2305DFBBD3BB} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{FDB5B8E5-9AC4-4164-B6C1-0B812281EC2E} (Renamed & Submitted) * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{FEE38886-3DFE-44DB-A61F-B6750D23B6EB} (Renamed & Submitted) Statistics Scanned: * Files: 60608 * System: 5286 * Not scanned: 8 Actions: * Disinfected: 0 * Renamed: 22 * Deleted: 0 * None: 1 * Submitted: 22 Files not scanned: * E:\HIBERFIL.SYS * E:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS * E:\WINDOWS\SYSTEM32\CONFIG\DEFAULT * E:\WINDOWS\SYSTEM32\CONFIG\SAM * E:\WINDOWS\SYSTEM32\CONFIG\SECURITY * E:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE * E:\WINDOWS\SYSTEM32\CONFIG\SYSTEM * E:\DOCUMENTS AND SETTINGS\VIDEN\LOCAL SETTINGS\APPLICATION DATA\MICROSOFT\WINDOWS DEFENDER\FILETRACKER\{ECC893CE-3BAE-4C9B-93EB-A73D3391BD87} Options Scanning engines: * F-Secure USS: 2.30.0 * F-Secure Blacklight: 1.0.68 * F-Secure Hydra: 2.8.8110, 2008-06-20 * F-Secure Pegasus: 1.20.0, 2008-04-14 * F-Secure AVP: 7.0.171, 2008-06-20 Scanning options: * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR * Use Advanced heuristics

VidenTheColdOne View Member Profile	Jun 22 2008, 05:46 PM Post #8
Member Posts: 35 From: New Jersey OS: Windows XP SP3	so, can u see what might have been wrong yet? Explorer killed successfully < HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a8b6ae5-f80f-11db-b2d9-001921747f61} > Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a8b6ae5-f80f-11db-b2d9-001921747f61}\\ deleted successfully. < purity > < EmptyTemp > File delete failed. E:\DOCUME~1\Viden\LOCALS~1\Temp\JET783.tmp scheduled to be deleted on reboot. File delete failed. E:\DOCUME~1\Viden\LOCALS~1\Temp\~DF9B83.tmp scheduled to be deleted on reboot. File delete failed. E:\WINDOWS\temp\Perflib_Perfdata_73c.dat scheduled to be deleted on reboot. File delete failed. E:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. Temp folders emptied. IE temp folders emptied. Explorer started successfully OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06222008_185708 Unable to kill explorer.exe OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06222008_185705 Files moved on Reboot... File E:\DOCUME~1\Viden\LOCALS~1\Temp\JET783.tmp not found! E:\DOCUME~1\Viden\LOCALS~1\Temp\~DF9B83.tmp moved successfully. File E:\WINDOWS\temp\Perflib_Perfdata_73c.dat not found! File move failed. E:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot.

Rorschach112

Jun 23 2008, 05:37 AM

Post #9

GeekU Teacher
Group Icon

Posts: 19,258
From: Dublin
OS: XP

Just a little malware

Your logs are clean

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

Make sure you have an Internet Connection.
Double-click OTMoveIt2.exe to run it.
Click on the CleanUp! button
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.