CastleCops® virtumonde

Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9736.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Survey

Forum FAQ

Usergroups

Profile

Select FavForums

[IN PROGRESS]virtumonde

All -> FavForums -> Trend Micro HijackThis Logs

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

ARBALE01

Corporal

Joined: Oct 05, 2004
Posts: 54
Location: USA

Prince_Serendip

Site Moderator

Joined: Sep 07, 2002
Posts: 17303

Posted: Fri Jul 11, 2008 2:31 pm Post subject:

Are you doing this voluntarily, or are you getting paid for it? We just need the HijacKThis log but we'll leave the rest as it's not too long. You're Ready for cleaning. At CastleCops we screen all HijackThis logs for errors, out-of-date versions, unupdated operating systems, omissions and P2P applications; getting you [READY] for cleaning by our 1st Responders and Security Experts. Now you wait for one of them to come help you. _________________ Microsoft MVP Consumer Security 2006, 2007 & 2008

ARBALE01

Corporal

Joined: Oct 05, 2004
Posts: 54
Location: USA

Posted: Sun Jul 13, 2008 1:25 am Post subject:

hes offered a few times but i havent agreed yet. my financial policy with computer or other repair is the same as with my artwork. if a friend is very well off then i dont mind accepting money, but if money is tight i dont want anything. ive been struggling with his PC for like a week and half on and off, so i might be more open. its funny that u responded first, i saw that PEBKAC sig a few days ago on here and saved it to my funny pics/quotes folder. anyway thanks for the initial HJT check, ill be patiently awaiting followup instructions. ~Arkbg (btw if u guys need some help with unspecialized volunteer/first responder type help lemme know. i dont have any formal PC education but i learn fast. its the least i could do for all the times ive gotten help from u guys over last few years)

Rosty

1st Responder

Joined: Dec 25, 2005
Posts: 19
Location: Belgium

Posted: Wed Jul 16, 2008 8:07 am Post subject:

Please download Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select Perform full scan (Full scan is optional. According to the program's creator Quick Scan will do just fine.). Click Scan. When the scan is complete, click OK, then Show Results to view the results. If Malware is found... Be sure that everything is checked, and click Remove Selected. When completed, a log will open in Notepad. Please save it to your desktop. NOTE: Logs can be retrieved at a later date from the Malwarebytes' Anti-Malware main screen: Launch Malwarebytes' Anti-Malware. Click the Logs tab. Double-click log-mm.dd.yyyy [xxxxxx].txt. In your next reply, please include: -The log from Malwarebytes' Anti-Malware. - A new HijackThis log

ARBALE01

Corporal

Joined: Oct 05, 2004
Posts: 54
Location: USA

Posted: Fri Jul 18, 2008 10:27 pm Post subject:

ok malwarebytes updated and scanned(128 detected and all cleaned). posting new HJT at end of this post Malwarebytes' Anti-Malware 1.20 Database version: 965 Windows 5.1.2600 Service Pack 2 3:20:55 PM 7/18/2008 mbam-log-7-18-2008 (15-20-55).txt Scan type: Full Scan (C:\\|) Objects scanned: 79325 Time elapsed: 29 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 25 Registry Values Infected: 8 Registry Data Items Infected: 0 Folders Infected: 26 Files Infected: 61 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{f43bfc6c-47cc-4798-8798-a0721b8ed7ab} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Usysd_is1 (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\USS (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uss_{20cf7fd9-6c26-450b-bc5b-b4ad67438a26}_is1 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00c6a5e (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchwbtoolbar.temperaturebarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products (Rogue.Multiple) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{f43bfc6c-47cc-4798-8798-a0721b8ed7ab} (Trojan.Zlob) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uss (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemDoctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bm0721d71f (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0412e483 (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\USS (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26} (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\AppBase (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\VirusHeat 4.3 (Rogue.VirusHeat) -> Quarantined and deleted successfully. C:\WINDOWS\system32\375013 (Trojan.Zlob) -> Quarantined and deleted successfully. C:\Program Files\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully. C:\Program Files\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Program Files\Common Files\System Doctor (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\Mp3DB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\MpegDB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\SafeMedia\WaveDB (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SalesMon (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\SalesMon\Data (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Application Data\DriveCleaner Freeware (Rogue.DriveCleaner) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Application Data\DriveCleaner Freeware\Logs (Rogue.DriveCleaner) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Start Menu\Programs\AntiSpywareShield (Rogue.AntiSpywareShield) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareExpert (Rogue.AntiSpywareExpert) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Application Data\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Start Menu\Antivirus2008y (Rogue.Antivirus2008) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\System Doctor Free\Data (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\User\Application Data\System Doctor Free\Logs (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\System Doctor Unregistered Version (Rogue.SystemDoctor) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\User\Local Settings\Temp\ICD1.tmp\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\jpbii's data backup\NSW2006B\Checkit\CheckIt.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\systemdoc.exe (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\WINDOWS\Downloaded Program Files\AntvrsInstall.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Program Files\USS\Schedule.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\unins000.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\unins000.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\USS.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\bnlink.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\DCPlugin.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\DCPlugin.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\ScanReport.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\AppBase\pfilelst.xda (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\USS\{20CF7FD9-6C26-450b-BC5B-B4AD67438A26}\AppBase\wordslst.xda (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\Activate.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\atl71.dll (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\bhpv.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\bhupdater.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\bnlink.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\DataBase.sav (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\hmlink.dat (Rogue.SystemDoctor) -> Quarantined and deleted successfully. C:\Program Files\System Doctor Free\insthelp.exe (Rogue.SystemDoctor) -> Quarantined an