[heir]

Please don't edit your post to post new logs, I won't get notified about it.
Notifications only occur for relies not when posts are edited.
Just just do a reply and post the content in the reply.

[Advertisements]

heres kaspersky
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, March 17, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, March 17, 2010 16:23:31
Records in database: 3814691
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Objects scanned: 150592
Threats found: 10
Infected objects found: 17
Suspicious objects found: 0
Scan duration: 05:22:46


File name / Threat / Threats count
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\MapleStory\HaRepacker\HaRepacker.exe Infected: Trojan-PSW.Win32.Dybalom.azs 1
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar Infected: VirTool.Win32.Patcher.i 1
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar Infected: Trojan.Win32.Shutdowner.fr 1
C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe Infected: Trojan-Spy.Win32.Agent.bdzz 1
C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RecordnowLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RunLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\Program Files\Softnyx\RakionIS\Bin\entitiesmp.dll Infected: Rootkit.Win32.Delf.bp 1
C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll Infected: not-a-virus:AdWare.Win32.WebHancer.x 1
C:\_OTL\MovedFiles\03152010_192756\C_WINDOWS\system32\wepatogi.dll Infected: Trojan.Win32.Monder.dcsb 1
C:\_OTL\MovedFiles\03152010_192756\C_WINDOWS\system32\wutakizu.dll Infected: Trojan.Win32.Monder.dcvg 1
C:\_OTL\MovedFiles\03162010_124622\C_WINDOWS\system32\diyobela.dll Infected: Trojan.Win32.Monder.ddda 1

Selected area has been scanned.

[poke963]

heres kaspersky
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, March 17, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, March 17, 2010 16:23:31
Records in database: 3814691
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan statistics:
Objects scanned: 150592
Threats found: 10
Infected objects found: 17
Suspicious objects found: 0
Scan duration: 05:22:46


File name / Threat / Threats count
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\MapleStory\HaRepacker\HaRepacker.exe Infected: Trojan-PSW.Win32.Dybalom.azs 1
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar Infected: VirTool.Win32.Patcher.i 1
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar Infected: Trojan.Win32.Shutdowner.fr 1
C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe Infected: Trojan-Spy.Win32.Agent.bdzz 1
C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RecordnowLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\RunLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe Infected: Trojan-Spy.Win32.Agent.beaf 1
C:\Program Files\Softnyx\RakionIS\Bin\entitiesmp.dll Infected: Rootkit.Win32.Delf.bp 1
C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll Infected: not-a-virus:AdWare.Win32.WebHancer.x 1
C:\_OTL\MovedFiles\03152010_192756\C_WINDOWS\system32\wepatogi.dll Infected: Trojan.Win32.Monder.dcsb 1
C:\_OTL\MovedFiles\03152010_192756\C_WINDOWS\system32\wutakizu.dll Infected: Trojan.Win32.Monder.dcvg 1
C:\_OTL\MovedFiles\03162010_124622\C_WINDOWS\system32\diyobela.dll Infected: Trojan.Win32.Monder.ddda 1

Selected area has been scanned.

[heir]

Run OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Files
  C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\MapleStory\HaRepacker
  C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar
  C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar
  C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe
  C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe
  C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe
  C:\hp\recovery\wizard\fscommand\RecordnowLink_ret.exe
  C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe
  C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe
  C:\hp\recovery\wizard\fscommand\RunLink_ret.exe
  C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe
  C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe
  C:\Program Files\Softnyx\RakionIS\Bin\entitiesmp.dll
  C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll
  :Commands
  [purity]
  [emptytemp]
  [emptyflash]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot when it is done
• Then post the OTL fixlog

[poke963]

All processes killed
========== FILES ==========
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\MapleStory\HaRepacker moved successfully.
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar moved successfully.
C:\Documents and Settings\Compaq_Administrator.YOUR-4DACD0EA75\Desktop\The_Ultimate_Pack_v2.rar moved successfully.
C:\hp\recovery\wizard\fscommand\AppRecoveryLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\CDLogic_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\CreatorLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\RecordnowLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\RestoreLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\RTCDLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\RunLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\SysRecoveryLink_ret.exe moved successfully.
C:\hp\recovery\wizard\fscommand\WizardLink_ret.exe moved successfully.
C:\Program Files\Softnyx\RakionIS\Bin\entitiesmp.dll moved successfully.
C:\WINDOWS\Web\Wallpaper\welcome\AWhelper.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Compaq_Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Compaq_Administrator.YOUR-4DACD0EA75
->Temp folder emptied: 103387514 bytes
->Temporary Internet Files folder emptied: 4000689 bytes
->Java cache emptied: 12118833 bytes
->FireFox cache emptied: 34581643 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 3181 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 16786 bytes

User: NetworkService
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49152 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 5319464 bytes

Total Files Cleaned = 152.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: All Users

User: Compaq_Administrator
->Flash cache emptied: 0 bytes

User: Compaq_Administrator.YOUR-4DACD0EA75
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.1.37.1 log created on 03192010_193815

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\NetworkService\Local Settings\Temp\Perflib_Perfdata_298.dat not found!
File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
C:\WINDOWS\temp\Perflib_Perfdata_6f4.dat moved successfully.

Registry entries deleted on Reboot...

[heir]

Hey there, poke963 !

OK! Well done, your log is clean again!

Time for some housekeeping.

Step 1.
Clean up:

We need to do is to remove all the tools that you have used. This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.

First:

• Click START then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
  

Second:

Double-click OTL.exe to run it.
Click the CleanUp button
Click Yes to the reboot.

Now delete any tools/logs that is left over after you ran OTL CleanUp.


Step 2.
Prevention:

OK, lets carry out a few preventative steps to make sure you reduce the risk of further infections.

First:
Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack.

Please go to the link below to download an update.

http://www.adobe.com.../readstep2.html

Remove the older versions and install the latest,


Second:
One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vunerable. It is best if you have these set to download automatically.

Automatic Updates for Windows

• Click Start.
• Select Settings and then Control Panel.
• Select Automatic Updates.
• Click Automatic (recommended)
• Choose a day and a time when you know the computer will be on and connected to the internet.
• Click Apply then OK.

Third:
Now lets download some preventative programs that will help to keep the nasties away! We will start with Anti Spyware programs. I would advise getting a couple of them at least, and running each at least once a month.

Anti Spyware

• SpywareBlaster to help prevent spyware from installing in the first place. A tutorial can be found here.
• SpywareGuard to catch and block spyware before it can execute. A tutorial can be found here.
• IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

.
Note: If you find your system slows down after installing any of these, just uninstall it, or disable it from running at startup.


Fourth:
Next lets look at Firewalls. These help to prevent unauthorised access both to and from the internet or your local network. A firewall is considered a first line of defense in protecting private information. Below are two free firewalls to choose from, if you do not already have one. Note: You only need one firewall one your system.

Personal Firewalls

• Comodo is a free fully functional firewall
• Online Armor (Free edition) personal firewall

Fifth:
Nearly done! If you like to use chat, MSN and Yahoo have vunerabilities that can leave you open to infections. There are however a couple of very good, Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN):

Instant Messengers

• Trillian or,
• Miranda-IM

Lastly:
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.


I will keep this log open for the next couple of days, so if you have any further problems post another reply here.

OK, all the best, and stay safe!

[heir]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.