Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Vundo removal


  • Please log in to reply

#1
hatevundo^2

hatevundo^2

    New Member

  • Member
  • Pip
  • 9 posts
I just joined this forum since my computer detected Vundo infection. I have used the basic steps given on this website
in following order.
1. ATF cleaner 2. SysRestore 3. ERUNT and finally Malwarebytes-Antimalware. It appears that this removed about 144 vundo infections although I am doing a recheck right now.

My questions or problems are:
a. Sysrestore Exe didnt not work on my computer, Does this mean I have no system restore point on my PC ?
b. I installed Malware bytes' antimalware but I have currently just disabled my Windows defender ( it was just detecting Vundo but not solving any problem). Will these two conflict each other?
c. I read Vundo infections occur by JAVA platform vulnerabilities, how can I knw which JAVA I have and which edition is the best?
d. Does Malwarebytes in any way conflict with Mcafee which I have installed for now, I know mostly likely not but still.

I plan to install Hijack this and get a log for future references but that will take some time still. I wanted to post this much info asap( I havent worked whole day and been solving this with your help ofcourse)

Thanks a ton for the info you have here guys!

Here is Malwarebytes 1st log
Malwarebytes' Anti-Malware 1.31
Database version: 1475
Windows 5.1.2600 Service Pack 2

12/8/2008 2:44:04 PM
mbam-log-2008-12-08 (14-44-04).txt

Scan type: Quick Scan
Objects scanned: 57481
Time elapsed: 36 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 5
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 133

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\bowafefi.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\lekegafu.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f7b2922b-7347-4019-abb9-ed9597d44248} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f7b2922b-7347-4019-abb9-ed9597d44248} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c22f8de (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm7f11cb42 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fugetiyute (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\lekegafu.dll -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\lekegafu.dll -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\balutize.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ezitulab.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\betutigo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ogituteb.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bowafefi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ifefawob.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dihinure.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\erunihid.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\godamuwe.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ewumadog.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ladowozi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\izowodal.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mewekeyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iyekewem.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nadejota.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\atojedan.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pigezuma.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\amuzegip.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\siyesohi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ihoseyis.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tirijeni.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\inejirit.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\togitaku.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ukatigot.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tudehote.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\etohedut.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zojimazi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\izamijoz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zugeyale.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\elayeguz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zuvibati.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\itabivuz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zuyazeyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iyezayuz.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\lekegafu.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\befukaba.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dalapuri.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fagofehu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fapavifa.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fawadepi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fikokaka.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fuyayeka.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\garibanu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gavevofu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jaduyodu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kokijozu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\migukaho.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\naluwota.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nawaweji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nepasova.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nojepake.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nojitosi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nowotovu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\piralume.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pulovuwi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rerigewa.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\resumume.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ridivewu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rihosege.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rilihida.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\riveyola.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sahokodi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\saneneje.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sigilawo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sutefide.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\teganuki.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tibugizu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wagupese.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wakeniwi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wamasuwu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\weragawo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vatokivu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bebeduyi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dobojobe.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dosegini.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\guzahune.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\habamahu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hajifagu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hamaveho.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\liwomajo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\motufoyo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\payaruhi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pegenemo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sodumami.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tobobodu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\juhabizo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jusovojo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kafiseri.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mubanaki.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bojolene.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yihabijo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yikepove.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yimuhoti.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yolulozi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zajeyema.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zebelivu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zimebopu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zofisuvu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zoyiboha.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zutusere.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\zuzufavu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wohuwamo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wolohuse.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\veginegi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\veloside.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vijopake.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vodimeyu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vojopagu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vomovoyu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vowikewa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hibiyezu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hibutohe.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hinebume.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hodikawa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wutokivu.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kosojebi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kuzokutu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lakuwivo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lapanuga.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ledalesa.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\levuvazi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\loyuhewa.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lumiwoyo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tuririba.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tuyozula.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoyuvuki.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pofekuwe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\digenibi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bepuhovo.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\beyamata.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bihuyuvo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\biniyogi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\biruwuta.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
  • 0

Advertisements


#2
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Hello hatevundo^2

Welcome to G2Go. :)
=====================
Before running a new scan let's clean out the temporary folders.

Download ATF Cleaner to your Desktop.
  • Double-click ATF-Cleaner.exe to run the program.
  • Click Select All found at the bottom of the list.
  • Click the Empty Selected button.
If you use Firefox browser, do this also:
  • Click Firefox at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE : If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser, do this also:
  • Click Opera at the top and choose Select All from the list.
  • Close ALL Internet browsers (very important).
  • Click the Empty Selected button.
  • NOTE : If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
===========================================
Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.
  • Close ALL OTHER PROGRAMS.
  • Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
  • Under Additional Scans click the checkboxes in front of the following items to select them:

    • File - Lop check
      File - Purity Scan

      Under Basic scans:
      Rootkit Search -Yes
  • Do not change any other settings.
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Use the Add Reply button and Attach the information back here. I will review it when it comes in.
  • 0

#3
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Heylo Kahdah,
Thanks for your reply. I tried the OTScanIt2 as you mentioned, but the scan kept on getting hanged in first few seconds. I finally ran it for more than an hour (although it was showing "not responding" in task manager all the time) and killed it.
It still generated the log which I am attaching as you mentioned.
My McAfee found another infection generic.dx as I started running the OTScanItexe and I am concerned it is because of the something related to OTScanIt. OTScanit was also running a file called "catchme" and that makes me worried. .
Is the catchme some malicious file which came along ?? I am attaching its log too.., ok it does not allow me to attach so copy pasting..

ATTACHED OTSCANIT2 TXT FILE,
CATCHME LOG IS PASTED BELOW


catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-09 10:53:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden files ...

IPC error: 2 The system cannot find the file specified.
C:\Documents and Settings\Administrator\Desktop\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\Favorites\Bandwidth Quotas to Improve Network Performance.url:favicon 2366 bytes
C:\Documents and Settings\Administrator\Favorites\MRSEC Shared Equipment Sign-Up Calendars.url:favicon 2366 bytes
C:\Documents and Settings\Administrator\Favorites\MSN.com.url:favicon 3638 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\E4252-E4160 Class\E4160\2004\slides\scan-files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\E4252-E4160 Class\E4252-All files\Spreading Movie\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\E4252-E4160 Class\E6252\Space\parag\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\E4252-E4160 Class\E6252\Space\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Namita\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Courses\solid waste-termpaper\Diagrams\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Courses\solid waste-termpaper\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Cytec wrok\Expt_contact-angle\Photos_contact-angle_Electro\Pentlandite pics\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Cytec wrok\Expt_contact-angle\Photos_contact-angle_Electro\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\IAB Meetings\IABmay04\BSA-structures\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\IAB Meetings\IABmay04\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\kumar_paper\kumar_images\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Cytec project\articles\polarized\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Ni experiments\microscope photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Silicone-Experiments\emulsion\microscope photos\2-17-05\25surt-25D5-50W\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Silicone-Experiments\emulsion\microscope photos\2-17-05\5surt-40D5-60W\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Silicone-Experiments\emulsion\microscope photos\3-11-05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\MyExperiments\Silicone-Experiments\emulsion\photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\photos\Boston\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\photos\coney island\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\photos\New York\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\photos\people\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Revised manuscript - Sarkar\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Somil\Weekly reports\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From dell 910\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From desktop - 6-17-08\PSP\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\From desktop - 6-17-08\Utsav\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\100NIKON\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\7-02-07 somil\100NIKON\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\7-02-07 somil\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\Chak De\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\Haste Haste\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\HIndi\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\Ronnie\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\U2\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\My Music\whassuppppp\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Parag-imp\new\Shooter\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\4160 -2007 spring\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Abhi\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\chandra\chandra\data_new\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\chandra\chandra\pic_net\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\chandra\chandra\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\Buy_com order #25164548_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\Originals\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\PHOTOS\2005_1124\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\PHOTOS\hostel day\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\PHOTOS\UTSAV\100_FUJI\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Deepak\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\E4160 spring 2005 folder\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\E4252-CVN and PDF docs\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Namita\Cationic-DNA\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Namita\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\50 cent\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Cubmail Inbox\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Desktop\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Extra\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\IAB Meetings\IAB may 2007\overview chaos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\IAB Meetings\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\ISAC\UTSAV 2007\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Lab\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\NIH proposal - R21 revision june 2004\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Paper drafts\silicone paper\Revision\Forms to fill after acceptance\jcis_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\Elkay work_2005\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\Acoustic data\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\12-01-07 CEPSR\8\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\12-01-07 CEPSR\B\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\12-01-07 CEPSR\D\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\12-01-07 CEPSR\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\4-15-05\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\8-23-07 BC\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\AFM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\APr-2006\NEW\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\APr-2006\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\AFM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\Cryo TEM\LK L70 2080\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\Optical microscopy\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\RAMAN\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\1-18-08\Treated\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\1-18-08\Untreated\GWdionn files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\1-18-08\Untreated\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-16-07\Gwdioon files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-16-07\New Folder\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-16-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-17-07\Gwddion\4-30\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-17-07\Gwddion\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-17-07\Legend removed file\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\11-17-07\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\2-1-08 ori-1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\3-08\3D- Images 7-08-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\3-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\Untreated\GWdioon\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\SEM\Untreated\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\TRI DATA\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\turbidity data\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\FTIR - ATR\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\MAtrix Dec 2006\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\Elkay\model\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\FIPR\report send\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\FIPR\SEM\3-10-08\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\FIPR\SEM\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\PROJECTS\FIPR\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Proposal\Papers\Silicone class project\Patents\Patent-8\[email protected] document view_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Proposal\Papers\Silicone class project\Patents\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Proposal\Papers\Silicone class project\Patents\US_NEW\United States Patent 5,593,611_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Proposal\Papers\Silicone class project\Silicone: Dow corning.pdf 67415 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Proposal\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Somil\10min\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Somil\20min\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Somil\2days\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\temporary\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Parag\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Prof\Prof-dia_6-8-04\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Puspendu\songs\Coldplay\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Puspendu\songs\My Music\Hari Prasad Chaurasia\Music of the Rivers, Vol. 1\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Puspendu\songs\My Music\Sample Music\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Puspendu\songs\My Music\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\SOMA\SOMA\NanoScience to Technology_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\SOMA\SOMA\Nanoscience_files\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Personal\Personal\Somil\Nickel\Ni experiments\microscope photos\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Pict\Thumbs.db:encryptable 0 bytes
C:\Documents and Settings\Administrator\My Documents\Things from desktop- feb 2008\Thumbs.db:encryptable 0 bytes

Attached Files


  • 0

#4
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts

My McAfee found another infection generic.dx as I started running the OTScanItexe and I am concerned it is because of the something related to OTScanIt. OTScanit was also running a file called "catchme" and that makes me worried. .
Is the catchme some malicious file which came along ?? I am attaching its log too.., ok it does not allow me to attach so copy pasting..

Your Mcafee will catch legitimate tools over actual infections to me that is useless.
ALso I am not getting you to run malicious software I am having you remove it.
The catchme is a rootkit scanner which reveals the hidden files on your system.
That you do have.
I am trying to clean your computer not infect it.
Please do not worry you will notice differences in a bit.
====================================
1. Please download The Avenger2 by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All..."
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\system32\dmexoboj.exe
C:\WINDOWS\system32\kybocfzl.exe

Regisrty values to replace with dummy:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, open the avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .
  • 0

#5
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Heylo.. Sorry for the misunderstanding by my post. I didnt mean to say you or anyone on this forum would direct me to something wrong, I just thought it was a scan gone wrong because the file I downloaded itself had been struck by virus :) . Its just with so many things happening on this comp lately am keeping track of every detail I come across..
I am starting the above mentioned fix now and post the results here (this is my work comp so I am usually able to do it at start of day).

A question on second thoughts : Is it ok if I install a new antivirus and a firewall on my comp? I was going to delete McAfee sooner (and your post above also tells me you are not great fan of McAfee!) and follow the recommendations on this forum. But since you are working on this problem, shall I just wait till we are done?

Edited by hatevundo^2, 10 December 2008 - 09:41 AM.

  • 0

#6
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hi
Below are both the logs generated. Thanks for the help and again sorry for miscommunication.
Do let me know how it looks..

Update: It was just pointed out to me that the word "registry" was misspelled. I don't know if I should be running it again with correct spelling.. So will wait for you reply..


Avenger log

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\dmexoboj.exe" deleted successfully.
File "C:\WINDOWS\system32\kybocfzl.exe" deleted successfully.

Error: file "Regisrty values to replace with dummy:" not found!
Deletion of file "Regisrty values to replace with dummy:" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not open file "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs"
Deletion of file "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Completed script processing.

*******************

Finished! Terminate.


HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:24:54 AM, on 12/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
C:\WINDOWS\system32\pe21cfr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbia.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [fugetiyute] Rundll32.exe "C:\WINDOWS\system32\lasozodi.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [fugetiyute] Rundll32.exe "C:\WINDOWS\system32\lasozodi.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe (User 'Default user')
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akama...ex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.co...sreqlab_ind.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1174579009953
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.ooxtv.com/stream.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\jusovojo.dll C:\WINDOWS\system32\kokijozu.dll ,C:\WINDOWS\system32\tijojepe.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Materials Studio Gateway (18888) (MaterialsStudioGateway(18888)) - Apache Software Foundation - C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PE21CFR - PerkinElmer - C:\WINDOWS\system32\pe21cfr.exe

--
End of file - 8599 bytes

Edited by hatevundo^2, 10 December 2008 - 01:18 PM.

  • 0

#7
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
No worries about the communications and also don't worry about the misspelling it was my oversight.
===================
Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • 0

#8
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hello Kahdah,
Here is the combofix log file..
Let me know how it looks!

ComboFix 08-12-11.01 - Administrator 2008-12-11 15:53:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.210 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\system32\ifasoyuk.ini
c:\windows\system32\ineyeyop.ini
c:\windows\system32\jolehedi.dll
c:\windows\system32\nodajuse.dll

----- BITS: Possible infected sites -----

hxxp://77.74.48.105
.
((((((((((((((((((((((((( Files Created from 2008-11-11 to 2008-12-11 )))))))))))))))))))))))))))))))
.

2008-12-10 12:09 . 2008-12-10 12:09 5,336,000 --a------ c:\program files\winamp5541_lite_all.exe
2008-12-10 11:33 . 2008-12-10 11:33 21,806,256 --a------ c:\program files\AdbeRdr813_en_US.exe
2008-12-10 10:23 . 2008-12-10 10:23 <DIR> d-------- c:\program files\Trend Micro
2008-12-08 16:13 . 2008-11-10 03:39 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-08 14:51 . 2008-12-08 14:51 268 --ah----- C:\sqmdata08.sqm
2008-12-08 14:51 . 2008-12-08 14:51 244 --ah----- C:\sqmnoopt08.sqm
2008-12-08 14:01 . 2008-12-08 14:01 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes
2008-12-08 14:00 . 2008-12-08 14:01 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-08 14:00 . 2008-12-08 14:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-08 14:00 . 2008-12-03 19:58 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-08 14:00 . 2008-12-03 19:58 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-08 13:53 . 2008-12-08 13:53 <DIR> d-------- c:\program files\ERUNT
2008-12-08 13:22 . 2008-12-08 13:22 268 --ah----- C:\sqmdata07.sqm
2008-12-08 13:22 . 2008-12-08 13:22 244 --ah----- C:\sqmnoopt07.sqm
2008-12-08 12:38 . 2008-12-08 12:38 268 --ah----- C:\sqmdata06.sqm
2008-12-08 12:38 . 2008-12-08 12:38 244 --ah----- C:\sqmnoopt06.sqm
2008-12-08 11:57 . 2008-12-08 11:57 268 --ah----- C:\sqmdata05.sqm
2008-12-08 11:57 . 2008-12-08 11:57 244 --ah----- C:\sqmnoopt05.sqm
2008-12-08 11:31 . 2008-12-08 11:31 268 --ah----- C:\sqmdata04.sqm
2008-12-08 11:31 . 2008-12-08 11:31 244 --ah----- C:\sqmnoopt04.sqm
2008-12-08 10:35 . 2008-12-08 10:35 268 --ah----- C:\sqmdata03.sqm
2008-12-08 10:35 . 2008-12-08 10:35 244 --ah----- C:\sqmnoopt03.sqm
2008-12-08 10:03 . 2008-12-08 10:03 268 --ah----- C:\sqmdata02.sqm
2008-12-08 10:03 . 2008-12-08 10:03 244 --ah----- C:\sqmnoopt02.sqm
2008-12-05 18:16 . 2008-12-05 18:16 268 --ah----- C:\sqmdata01.sqm
2008-12-05 18:16 . 2008-12-05 18:16 244 --ah----- C:\sqmnoopt01.sqm
2008-12-02 13:12 . 2008-12-02 13:12 0 --a------ c:\windows\system32\ewumadog.tmp
2008-12-01 19:55 . 2008-11-10 05:43 410,984 --a------ c:\windows\system32\deploytk.dll
2008-11-25 13:32 . 2008-11-25 13:32 <DIR> d-------- C:\VundoFix Backups
2008-11-22 21:51 . 2003-04-07 00:05 155,648 --a------ c:\windows\system32\igfxres.dll
2008-11-22 21:42 . 2008-11-22 21:42 <DIR> d-------- c:\program files\SystemRequirementsLab
2008-11-21 15:31 . 2008-11-21 15:31 <DIR> d-------- c:\program files\Lexmark_HostCD
2008-11-21 15:31 . 2005-01-07 10:36 323,584 --a------ c:\windows\system32\lexlog.dll
2008-11-21 15:31 . 2008-11-21 15:31 1,964 --a------ c:\windows\system32\LexFiles.ulf
2008-11-21 15:31 . 2008-11-21 15:31 779 --a------ c:\windows\system32\LexFiles.usr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-10 17:31 --------- d-----w c:\program files\Winamp
2008-12-10 17:14 --------- d-----w c:\program files\Common Files\Real
2008-12-10 17:01 --------- d-----w c:\program files\QuickTime
2008-12-10 16:49 --------- d-----w c:\program files\Common Files\Adobe
2008-12-08 21:12 --------- d-----w c:\program files\Java
2008-10-24 21:20 --------- d-----w c:\program files\Omnic
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 14:50 --------- d-----w c:\program files\Windows Live
2008-10-20 14:48 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-10-20 14:46 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-09-22 16:19 22,453,544 ----a-w c:\program files\SkypeSetup.exe
2008-04-11 19:11 6,739,301 ----a-w c:\program files\gtk-2.10.11-win32-1.exe
2007-12-26 15:29 3,328,542 ----a-w c:\program files\SopCast.zip
2007-09-18 19:15 2,889,848 ----a-w c:\program files\TvantsSetup.EXE
2007-07-26 20:18 1,713,609 ----a-w c:\program files\gigatribe_setup240.exe
2007-07-18 17:53 6,221,304 ----a-w c:\program files\winamp535_full_emusic-7plus.exe
2007-07-18 16:57 10,701,711 ----a-w c:\program files\CricketStreamZ.zip
2007-05-30 19:21 588,144 ----a-w c:\program files\RealPlayer10-5GOLD_rs.exe
2007-05-24 14:18 2,163,912 ----a-w c:\program files\DivXWebPlayerInstaller.exe
2007-05-02 03:13 848,896 ----a-w c:\program files\Netflix_Movie_Viewer_Installer.msi
2007-05-01 17:32 2,239,936 ----a-w c:\program files\nl_209_lite.exe
2007-04-28 18:46 3,376,597 ----a-w c:\program files\FFDSHOW.exe
2007-04-28 18:44 6,753,504 ----a-w c:\program files\winamp534_full_emusic-7plus.exe
2007-04-10 00:38 9,453,630 ----a-w c:\program files\vlc-0.8.6a-win32.exe
2007-04-10 00:33 25,755,448 ----a-w c:\program files\wmp11-windowsxp-x86-enu.exe
2007-03-22 18:12 21,822,168 ----a-w c:\program files\AdbeRdr80_en_US.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-07 114688]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
GigaTribe.lnk - c:\program files\GigaTribe\gigatribe.exe [2007-07-26 1077248]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.X264"= x264vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\TVAnts\\Tvants.exe"=
"c:\\Program Files\\Accelrys\\Materials Studio 4.1\\Gateway\\apache\\bin\\Apache.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GigaTribe\\gigatribe.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\SopCast\\SopCast.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\SopCast\\sopvod.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Windows Defender\\MSASCui.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcods.exe"=
"c:\\Program Files\\McAfee\\MSC\\mcuimgr.exe"=
"c:\\WINDOWS\\system32\\WgaTray.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 MaterialsStudioGateway(18888);Materials Studio Gateway (18888);"c:\progra~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe" -k runservice [2006-06-28 20571]
R2 PE21CFR;PE21CFR;c:\windows\system32\pe21cfr.exe [2004-08-25 131072]
R2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" [2006-11-03 13592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0bd33567-ff03-11db-b3cb-000cf1ea3bb7}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{863d2844-f982-11db-b3c8-000cf1ea3bb7}]
\Shell\AutoRun\command - E:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd921a61-87fc-11dc-b3de-000cf1ea3bb7}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2008-11-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-12-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-12-11 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 17:20]
.
- - - - ORPHANS REMOVED - - - -

Notify-NavLogon - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.columbia.edu/
uInternet Settings,ProxyOverride = <local>
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm

c:\windows\Downloaded Program Files\sysreqlab_ind.dll - O16 -: {5727FF4C-EF4E-4d96-A96C-03AD91910448}
hxxp://www.srtest.com/srl_bin/sysreqlab_ind.cab
c:\windows\Downloaded Program Files\sysreqlab.osd

c:\windows\Downloaded Program Files\stream.ocx - O16 -: {A903E5AB-C67E-40FB-94F1-E1305982F6E0}
hxxp://www.ooxtv.com/stream.ocx
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\5wm4z2w1.default\
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF - plugin: c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-11 16:03:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\program files\McAfee\VirusScan\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-12-11 16:08:49 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-12-11 21:08:12

Pre-Run: 6,557,859,840 bytes free
Post-Run: 6,498,164,736 bytes free

212 --- E O F --- 2008-12-08 18:10:52
  • 0

#9
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Please open up Notepad and copy all of the items in the code box below.
Change the "Save As Type" to "All Files". Save it as fixthis.reg on your Desktop.
REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd921a61-87fc-11dc-b3de-000cf1ea3bb7}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0bd33567-ff03-11db-b3cb-000cf1ea3bb7}]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{863d2844-f982-11db-b3c8-000cf1ea3bb7}]
Now double-click fixthis.reg.
A window will come up asking if you want to let it merge with the registry.
Click yes.
=============
Double Click MalwareBytes ANtimalware to Run the application.
  • Go to the Update Tab and choose check for updates.
  • If an update is found, it will download and install the latest version.
  • Once the update has loaded, go to the scanner tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.
  • 0

#10
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hey Kahdah
Here is the report log.. It didnt show any infections atleast in the summary.

Malwarebytes' Anti-Malware 1.31
Database version: 1492
Windows 5.1.2600 Service Pack 2

12/12/2008 10:25:21 AM
mbam-log-2008-12-12 (10-25-21).txt

Scan type: Quick Scan
Objects scanned: 58301
Time elapsed: 10 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#11
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Very good let's see a new Hijackthis log and let me know how things are running?
  • 0

#12
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hey,
Here is the new HijackThis log. Do let me know how it looks..

I am not seeing any pop up trouble right now, but my firefox uses too much resources ( I keep on checking in task manager) and FF is generally slow. Beyond that its all right..
Maybe I need to free up some disk space, clean desktop and all such things..
Am still worried how did Vundo came to my comp in first place, I didnt go to any site that I haven't been to before (whatever questionable/unquestionable sites I frequent its been so for 3 yrs on this comp!!)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:57:15 PM, on 12/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
C:\WINDOWS\system32\pe21cfr.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbia.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe (User 'Default user')
O4 - Startup: GigaTribe.lnk = C:\Program Files\GigaTribe\gigatribe.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://a1540.g.akama...ex/qtplugin.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.co...sreqlab_ind.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1174579009953
O16 - DPF: {A903E5AB-C67E-40FB-94F1-E1305982F6E0} (KooPlayer Control) - http://www.ooxtv.com/stream.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Materials Studio Gateway (18888) (MaterialsStudioGateway(18888)) - Apache Software Foundation - C:\PROGRA~1\Accelrys\MATERI~1.1\Gateway\apache\bin\Apache.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PE21CFR - PerkinElmer - C:\WINDOWS\system32\pe21cfr.exe

--
End of file - 8054 bytes
  • 0

#13
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Your log is clean of any malware and infections can come from any site Myspace,Facebook etc..
Leave it for a day or so and let me know if you have any more issues.
Just post here and we will wrap it up.
  • 0

#14
hatevundo^2

hatevundo^2

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hey kahdah
I was not at work for a day.. just came in.. As I said, it looks better. No pop ups or stuff. Lil on slower side but I havent had chance to clean it up.

Thanks a lot for your help.. And for others, these guys are good!!
  • 0

#15
kahdah

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Do the following then let me know about the performance:
===================
Cleanup:

Please download OT CLeanit from Here save it to your desktop.
Double click on OT Clean it to run it.
Then click on Clean up.
Restart your computer when prompted.
This will remove what tools we used.
===============
Use a Firewall:

Install and use a firewall with outbound protection
While the firewall built into Windows XP is adequate to protect you from incoming attacks, it will not be much help in alerting you to programs already on your PC attempting to connect to remote servers
I therefore strongly recommend that you install one of the following free firewalls: Sunbelt Free Firewall or Zonealarm
See Bleepingcomputer's excellent tutorial to help using and understanding a firewall here
Note: You should only have one firewall installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as seriously impairing the performance of your PC.


=============================
Delete\uninstall anything else that we have used.

System Restore
Then I will need you to reset your System Restore points.
The link below shows how to create a clean restore point.
How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us

If you are using Vista then see this link > http://www.bleepingc...143.html#manual
=====================================
After that your log is clean. :)

The following is a list of tools and utilities that I like to suggest to people.
You do not have to have all or any of them they are only suggestions.
This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

Spybot Search & Destroy-Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

Spyware Blaster - Great prevention tool to keep nasties from installing on your system.

Spywareguard-Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP