Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

TrojanDownloader.XS, Cryp_Xed-3 and other spyware attack [RESOLVED]

Started by Caymaniac , Mar 16 2008 12:32 PM

  • This topic is locked This topic is locked

#16
Caymaniac
Posted 01 April 2008 - 04:27 PM

Caymaniac

    Member

  • Topic Starter
  • Member
  • PipPip
  • 12 posts
Harry,

Here is the last of the OT Scan It Log. It keeps getting truncated on upload. Also, my Trend Micro Antivirus just said it found and quarantined a Trojan called "cgrpomfg.dll". Hopefully we can fix whatever is eating away at this computer.


C:\Documents and Settings\Cynthia Friedman\My Documents\DSCN0735\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\DSCN0748\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\JosephAnthony252\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\untitled-1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\untitled-1.1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\SchoolYearbook014\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Halloween2006027\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\easterdaycarephotoskids_0004\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Ellie4Months001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Arlie1stswim2008-1004\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\ATT00001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\ATT00129\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\AtthehospitalbeforeKaitlynisborn12-11-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\barelyoutandpoutingalready\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\111107071210170414_63\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Hana1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Heybubba7-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\P1000198\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Photo11\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\Photo_012008_002\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Cynthia Friedman\My Documents\pic16746\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Impressionism - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Landscapes - GalleryPlayer\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Landscapes - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Masterpieces - GalleryPlayer\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Masterpieces - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Nature - GalleryPlayer\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Nature - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Sample Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Travel - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Pictures\Vintage - GalleryPlayer\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\All Users\Documents\My Videos\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia\Local Settings\Application Data\Microsoft\ehome\Image.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia\Local Settings\Application Data\Microsoft\ehome\musicThumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia\My Documents\My Pictures\Norridgewock '05\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia\My Documents\My Pictures\Norridgewock '05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\Local Settings\Application Data\Microsoft\ehome\Image.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\Local Settings\Application Data\Microsoft\ehome\musicThumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\24weeks-6months001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\28weeks001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\a289_002ab\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\ApprehendingAHostageTakerInSpain\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\att000881\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\ATT00264\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\awomenscorned\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\bill4bill2\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Bobandzach\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\c1f622\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\drunkpumpkin\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\DSC00403\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\DSCF00861\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\FriedmanFamilyPhotos008\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Fwd_FW_That'swhyIdon'tdoVideoConferencing\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Halloween2005014\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\hulagirls\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\IBC-Borrachera\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\image001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\image5\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\JosephAnthony4-18-06003\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\JosephAnthony4-24-06013\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Kayak\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Lake house construction 297\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\2005_05_22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\2005_05_28\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\2005_05_29\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Athletic Banquet 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Cruise\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\High School Graduation 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Kodak Pictures\2005-04-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Kodak Pictures\2005-05-31\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Kodak Pictures\2005-06-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Lake House 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Las Vegas\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Nik's sweet sixteen\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Nik's sweet sixteen dinner\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\PROM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Student of the month\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\My Videos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\OWW!\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic00986\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic08723\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic14388\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic18077\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic21562\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic22354\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic24586\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic27529\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic28188\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\pic31185\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Q\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Receptionist\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\RibbonIraq1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Riding_The_Escalader\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Rt_23A_Collapse001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\scan0001\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\text2\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\WhyWomenHave2Hands\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Documents and Settings\Cynthia.DD6NNW61\My Documents\younameditwhat1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\100_1273\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\100_1274\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\2005_05_22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\2005_05_28\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\2005_05_29\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Athletic Banquet 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Cruise\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\High School Graduation 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Kodak Pictures\2005-04-16\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Kodak Pictures\2005-05-31\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Kodak Pictures\2005-06-22\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Lake House 2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Las Vegas\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Nik's sweet sixteen\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Nik's sweet sixteen dinner\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Norridgewock '05\ehthumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Norridgewock '05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\PROM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Student of the month\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Pictures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\My Videos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\Lake house construction 297\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\New Folder\Old desktop files\scan0001\Thumbs.db:encryptable 0 bytes
scan completed successfully
hidden files: 225

< End of report >
[/code]
  • 0

Advertisements

#17
harrythook
Posted 02 April 2008 - 02:54 AM

harrythook

    Trusted Helper

  • Retired Staff
  • 2,618 posts
Ok, that was a lot of work, good job :)

I looked through the log, not much in there, lets do this:
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Run the Superantispyware scan, post the results and a fresh HJT log please.

Harry
  • 0

#18
harrythook
Posted 12 April 2008 - 12:51 PM

harrythook

    Trusted Helper

  • Retired Staff
  • 2,618 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP