Jump to content


Photo
- - - - -

Trojan.Agent.SZ : Need Help to Remove, Please.


  • This topic is locked This topic is locked
19 replies to this topic

#1 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 26 May 2012 - 02:04 PM

Sometime over the last few days my PC became infected with a trojan which started as a "S.M.A.R.T." alert but now seems to be presenting itself differently after my repeated failed attempts at manually removing pieces of it, using Microsoft Security Essentials and then SpyBot. As a disclaimer, I am not a PC techy by any means; I'm just a PC user, so my abilities are limited.

Anyway, I am now seeing this trojan identified as something like "Trojan.Agent.SZ" and I just cannot remove it, now using Malwarebytes' Anti-Malware. It keeps coming back/regenerating on restart. It also seems to have disabled Microsoft Security Essentials, which now shows an error code of 0x80070424 when I try to open that program.

Right now I am using a different PC to submit my "help" plea to this forum, as I am hesitant to connect the infected PC to the network.

The "MBAM" log on the infected PC has shown something like:
1 registry value detected : Trojan.Agent.SZ
2 registry items detected : Trojan.Zaccess
6 files detected : Trojan.Agent.SZ , Trojan.Agent.SZ , Trojan.Oaccess , Trojan.Dropper.BCMiner , Trojan.Sirefef , Rootkit.Oaccess

Prior to re-running Anti-Malware, I did disable two start-up items that seemed to resemble two objects identified in the Anti-Malware report. I am running Anti-Malware again right now, so far it has detected just one object, looked like it was detected when scanning "restore" files. That detected file is: C:/System Volume Information /_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}/RP1098/A0201194.exe

Thanks in advance for your help. . . . .

#2 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 27 May 2012 - 08:27 AM

Posted Image

The pc is already infected so connect it to the internet while we're working on it.

Logs will be closed if you haven't replied within 3 days


Please don't attach the scans / logs for these tools, use "copy/paste".


DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.



Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.


Please don't attach the scans / logs, use "copy/paste".
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#3 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 27 May 2012 - 04:56 PM

Thanks for your reply.

I messed around a bit, trying a manual fix by eliminating suspect files and disabling start-up items. And I ran Anti-Malware a few times to detect and remove what remained. Lastly I ran Microsoft Security Essentials, which also did not detect and probelms.

Am I fixed? Or is something just sitting idle?

Here is my latest scan, which did not detect any objects:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.05.24.04
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
xxxx:: xxxxx [administrator]
5/27/2012 7:40:53 AM
mbam-log-2012-05-27 (07-40-53).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 260843
Time elapsed: 2 hour(s), 6 minute(s), 10 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)


Here is any earlier scan results, which did detect objects:

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
XXXX:: XXXX [administrator]
5/26/2012 12:55:44 PM
mbam-log-2012-05-26 (12-55-44).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 261253
Time elapsed: 51 minute(s), 33 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|afbabeaebbcbdct (Trojan.Agent.SZ) -> Data: "C:\Documents and Settings\All Users\Application Data\afbabeaebbcbdct.exe" -> Quarantined and deleted successfully.
Registry Data Items Detected: 2
HKCR\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Bad: (C:\Documents and Settings\Tony Grausso\Local Settings\Application Data\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\n.) Good: (%SystemRoot%\system32\shdocvw.dll) -> Quarantined and repaired successfully.
HKCR\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32| (Trojan.Zaccess) -> Bad: (\\.\globalroot\systemroot\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\n.) Good: (%systemroot%\system32\wbem\wbemess.dll) -> Quarantined and repaired successfully.
Folders Detected: 0
(No malicious items detected)
Files Detected: 6
C:\Documents and Settings\All Users\Application Data\afbabeaebbcbdct.exe (Trojan.Agent.SZ) -> Quarantined and deleted successfully.
C:\Documents and Settings\Tony Grausso\Local Settings\Temp\uoepougjrudefv.exe (Trojan.Agent.SZ) -> Quarantined and deleted successfully.
C:\WINDOWS\assembly\GAC\Desktop.ini (Trojan.0access) -> Delete on reboot.
C:\WINDOWS\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.
C:\WINDOWS\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\80000000.@ (Trojan.Sirefef) -> Quarantined and deleted successfully.
C:\WINDOWS\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\80000032.@ (Rootkit.0Access) -> Quarantined and deleted successfully.
(end)

#4 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 27 May 2012 - 05:00 PM

Please do not attach the scan results from Combofx. Use copy/paste.


Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")



Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

    Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

    Note: If you have XP SP3, use the XP SP2 package.
    If Vista or Windows 7, skip the Recovery Console part

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.


Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#5 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 27 May 2012 - 05:21 PM

I'll need instruction on how to disable MSE. When I "right click" on the taskbar icon, all I get is an "Open" option. Thanks.

#6 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 27 May 2012 - 05:24 PM

Open MSE and go to Settings > Real Time Protection.
Then uncheck "Turn on real time protection".
Exit MSE when done.
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#7 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 27 May 2012 - 05:25 PM

Sorry. I got it disabled. Please standby. Thanks.

#8 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 27 May 2012 - 05:27 PM

Give it at least 30 minutes if need be
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#9 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 27 May 2012 - 06:32 PM

Just to update, Combofix is still running: one hour so far. . . .

#10 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 27 May 2012 - 09:33 PM

Larry,

Here is the Combofix log from my just completed scan:

ComboFix 12-05-27.02 - Tony Grausso 05/27/2012 21:33:59.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.305 [GMT -4:00]
Running from: c:\documents and settings\Tony Grausso\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Norton Internet Worm Protection *Disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\afbabeaebbcbdct.exe
c:\documents and settings\All Users\Application Data\zbKPpNp4NTSbMR
c:\documents and settings\LocalService\GoToAssistDownloadHelper.exe
c:\documents and settings\Tony Grausso\GoToAssistDownloadHelper.exe
c:\documents and settings\Tony Grausso\Local Settings\Application Data\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}
c:\documents and settings\Tony Grausso\Local Settings\Application Data\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\@
c:\documents and settings\Tony Grausso\Local Settings\Application Data\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\n
c:\windows\EventSystem.log
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\L\00000004.@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\L\1afb2d56
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\L\201d3dde
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\n
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\00000004.@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\00000008.@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\000000cb.@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\80000000.@
c:\windows\Installer\{7d712ca2-4ba1-1acb-a94a-3e9054a8a08c}\U\80000032.@
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-28 )))))))))))))))))))))))))))))))
.
.
2012-05-27 11:39 . 2012-05-08 13:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6A0A7021-C743-40DC-AF0C-0C1BA4169806}\mpengine.dll
2012-05-27 11:38 . 2012-05-27 11:38 -------- d-----w- c:\program files\Microsoft Security Client
2012-05-24 15:57 . 2012-05-24 15:57 -------- d-----w- c:\documents and settings\Tony Grausso\Application Data\Malwarebytes
2012-05-24 15:56 . 2012-05-24 15:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-05-24 15:56 . 2012-05-24 18:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-05-24 15:56 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-24 13:13 . 2012-05-24 13:13 -------- d-----w- c:\documents and settings\Tony Grausso\Local Settings\Application Data\PCHealth
2012-05-23 14:08 . 2012-05-23 14:08 -------- d-----w- c:\windows\system32\wbem\Repository
2012-05-16 20:00 . 2012-05-16 20:04 -------- dc----w- c:\windows\ie8
2012-05-16 19:41 . 2012-05-16 19:41 -------- d-----w- c:\windows\system32\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-16 19:42 . 2012-04-03 22:16 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-16 19:42 . 2011-05-19 13:39 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2004-08-10 17:51 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2004-08-10 17:51 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2004-08-04 03:59 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-03-21 00:44 . 2012-03-21 00:44 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-01 11:01 . 2004-08-10 17:51 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-10 17:51 43520 ------w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-10 17:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-10 17:51 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-10 17:51 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-10 17:51 385024 ------w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnk
backup=c:\windows\pss\Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 15:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 06:05 127035 ----a-w- c:\windows\system32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 21:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2012-03-26 21:08 931200 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-03-21 11:03 7557120 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-03-24 21:30 282624 ----a-w- c:\windows\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-08 16:48 761947 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"wltrysvc"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"MsMpSvc"=2 (0x2)
"LiveUpdate"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"NVSvc"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
S0 gskmfa;gskmfa;c:\windows\system32\drivers\sela.sys --> c:\windows\system32\drivers\sela.sys [?]
S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [7/28/2007 3:48 PM 537216]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/16/2012 10:38 AM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/16/2012 10:38 AM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 14:38]
.
2012-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 14:38]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.2.1
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-afbabeaebbcbdct - c:\documents and settings\All Users\Application Data\afbabeaebbcbdct.exe
SafeBoot-WudfPf
SafeBoot-WudfRd
SafeBoot-MsMpSvc
MSConfigStartUp-afbabeaebbcbdct - c:\documents and settings\All Users\Application Data\afbabeaebbcbdct.exe
MSConfigStartUp-HP Component Manager - c:\program files\HP\hpcoretech\hpcmpmgr.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
MSConfigStartUp-Zune Launcher - c:\program files\Zune\ZuneLauncher.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-27 22:11
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\docume~1\TONYGR~1\LOCALS~1\Temp\catchme.dll 53248 bytes executable
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(844)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2012-05-27 22:28:03
ComboFix-quarantined-files.txt 2012-05-28 02:27
.
Pre-Run: 129,097,228,288 bytes free
Post-Run: 129,737,076,736 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 171FBA086B82FF1C659866D4731D4E2C

#11 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 06:39 AM

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

c:\windows\system32\drivers\sela.sys


Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky...anforvirus.html
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#12 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 06:51 AM

I just noticed you're running 2 anti-virus programs.
You need to uninstall one of them

AV: AVG Anti-Virus Free Edition 2012
AV: Microsoft Security Essentials
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#13 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 28 May 2012 - 07:46 AM

I could not find that file: c:\windows\system32\drivers\sela.sys

It did not appear in the driver folder. ???

I did see that the combofix identified remnants of virus/security software that I thought I had previously uninstalled. So I did go to the vendor websites and downloaded and ran uninstallers for AVG and Norton.

I also updated Java. And reinstalled MSE, updated it, and ran a scan, which did not detect any viruses. I also updated Anti-Malware and ran a scan. The result are here:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Database version: v2012.05.27.06
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Tony XXXX:: TONY [administrator]
5/28/2012 5:10:46 AM
mbam-log-2012-05-28 (05-10-46).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 253172
Time elapsed: 1 hour(s), 2 minute(s), 18 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)

#14 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 07:58 AM

How's it running?
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#15 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 08:03 AM

We need to get a copy of the file


Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.malwarebytes.org/index.php?showtopic=110352&hl=&fromsearch=1

Collect::
c:\windows\system32\drivers\sela.sys 

ClearJavaCache::

Driver::
gskmfa

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...


Posted Image

Drag CFScript.txt into ComboFix.exe


Then post the results log using Copy / Paste


Also please describe how your computer behaves at the moment.
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#16 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 28 May 2012 - 10:06 AM

PC seems to be running fine. I ran Combofix again per youor instructions and it detected "AVG Anti-Virus Free Edition 2012" which perplexes me because I had "uninstalled" that twice before, the last time just yesterday using the AVG Uninstaller. Anyway, when I was opening Combofix, it asked me if I wanted to update Combofix to the latest edition, I selected "yes." Here is the report that was generated. Thanks much. . . .

ComboFix 12-05-28.01 - Tony Grausso 05/28/2012 10:05:44.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.309 [GMT -4:00]
Running from: c:\documents and settings\Tony Grausso\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Tony Grausso\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_gskmfa
.
.
((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-28 )))))))))))))))))))))))))))))))
.
.
2012-05-28 03:47 . 2012-05-28 03:47 -------- d-----w- c:\documents and settings\Tony Grausso\Local Settings\Application Data\Sun
2012-05-28 03:01 . 2012-05-28 03:01 -------- d-----w- c:\program files\Common Files\Java
2012-05-28 03:00 . 2012-05-28 03:00 -------- d-----w- c:\program files\Oracle
2012-05-28 03:00 . 2012-05-28 03:00 -------- d-----w- c:\documents and settings\Tony Grausso\Application Data\Oracle
2012-05-28 03:00 . 2012-04-04 22:47 772504 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-05-28 02:47 . 2012-05-08 13:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B7C9D7A7-6781-4CF7-9D29-274D5BF28164}\mpengine.dll
2012-05-28 02:45 . 2012-05-28 02:45 -------- d-----w- c:\program files\Microsoft Security Client
2012-05-24 15:57 . 2012-05-24 15:57 -------- d-----w- c:\documents and settings\Tony Grausso\Application Data\Malwarebytes
2012-05-24 15:56 . 2012-05-24 15:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-05-24 15:56 . 2012-05-24 18:00 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-05-24 15:56 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-05-24 13:13 . 2012-05-24 13:13 -------- d-----w- c:\documents and settings\Tony Grausso\Local Settings\Application Data\PCHealth
2012-05-23 14:08 . 2012-05-23 14:08 -------- d-----w- c:\windows\system32\wbem\Repository
2012-05-16 20:00 . 2012-05-16 20:04 -------- dc----w- c:\windows\ie8
2012-05-16 19:41 . 2012-05-16 19:41 -------- d-----w- c:\windows\system32\Adobe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-16 19:42 . 2012-04-03 22:16 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-16 19:42 . 2011-05-19 13:39 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-11 13:14 . 2004-08-10 17:51 2148352 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2004-08-10 17:51 1862272 ----a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2004-08-04 03:59 2026496 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-04 22:47 . 2007-06-22 18:58 143872 ----a-w- c:\windows\system32\javacpl.cpl
2012-03-21 00:44 . 2012-03-21 00:44 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-03-01 11:01 . 2004-08-10 17:51 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-10 17:51 43520 ------w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-10 17:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-10 17:51 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-10 17:51 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17 . 2004-08-10 17:51 385024 ------w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-28_02.12.42 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-28 14:40 . 2012-05-28 14:40 16384 c:\windows\temp\Perflib_Perfdata_210.dat
- 2004-08-10 17:51 . 2012-05-28 01:23 72582 c:\windows\system32\perfc009.dat
+ 2004-08-10 17:51 . 2012-05-28 13:48 72582 c:\windows\system32\perfc009.dat
- 2004-08-10 17:51 . 2012-05-28 01:23 443482 c:\windows\system32\perfh009.dat
+ 2004-08-10 17:51 . 2012-05-28 13:48 443482 c:\windows\system32\perfh009.dat
+ 2012-05-28 03:00 . 2012-04-04 22:47 227720 c:\windows\system32\javaws.exe
+ 2012-05-28 03:00 . 2012-05-28 02:59 174024 c:\windows\system32\javaw.exe
+ 2012-05-28 03:00 . 2012-05-28 02:59 174024 c:\windows\system32\java.exe
+ 2012-05-28 03:01 . 2012-05-28 03:01 176128 c:\windows\Installer\4f51ca.msi
+ 2012-05-28 03:00 . 2012-05-28 03:00 457216 c:\windows\Installer\4f51bc.msi
+ 2012-05-28 02:59 . 2012-05-28 02:59 863744 c:\windows\Installer\4f51b8.msi
+ 2012-05-28 02:45 . 2012-05-28 02:45 301056 c:\windows\Installer\4f51a3.msi
- 2012-04-24 23:51 . 2012-05-27 11:38 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe
+ 2012-04-24 23:51 . 2012-05-28 02:45 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\SCEP.exe
+ 2012-05-28 02:45 . 2012-05-28 02:45 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe
- 2012-05-27 11:38 . 2012-05-27 11:38 123352 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\MSE.exe
- 2012-04-24 23:51 . 2012-05-27 11:38 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe
+ 2012-04-24 23:51 . 2012-05-28 02:45 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\INTUNE.exe
+ 2012-04-24 23:51 . 2012-05-28 02:45 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe
- 2012-04-24 23:51 . 2012-05-27 11:38 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\FEP.exe
- 2012-04-24 23:51 . 2012-05-27 11:38 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe
+ 2012-04-24 23:51 . 2012-05-28 02:45 109563 c:\windows\Installer\{0F842B77-56EA-4AAF-8295-81A022350B5E}\EPP.exe
+ 2012-05-28 02:45 . 2012-05-28 02:45 1826304 c:\windows\Installer\4f51a8.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2011-07-27 434080]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnk
backup=c:\windows\pss\Belkin F5D8073 N Wireless ExpressCard Adapter Utility.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2010-03-25 02:50 2516296 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenuEx]
2010-04-02 15:18 1185112 ----a-w- c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-12-06 06:05 127035 ----a-w- c:\windows\system32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 21:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSC]
2012-03-26 21:08 931200 ----a-w- c:\program files\Microsoft Security Client\msseces.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2006-03-21 11:03 7557120 ----a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-03-24 21:30 282624 ----a-w- c:\windows\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2006-03-08 16:48 761947 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"wltrysvc"=2 (0x2)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"MsMpSvc"=2 (0x2)
"LiveUpdate"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)
"idsvc"=3 (0x3)
"gupdatem"=3 (0x3)
"gupdate"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"NVSvc"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
S3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [7/28/2007 3:48 PM 537216]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [3/16/2012 10:38 AM 136176]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [3/16/2012 10:38 AM 136176]
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 14:38]
.
2012-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-16 14:38]
.
2012-05-28 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 21:03]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 10.0.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-28 10:41
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(856)
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(2764)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\jscript.dll
c:\windows\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\ImgUtil.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\Dxtrans.dll
c:\windows\system32\Dxtmsft.dll
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\dtplugin\deployJava1.dll
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jp2iexp.dll
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\deploy.dll
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jp2native.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\program files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
.
**************************************************************************
.
Completion time: 2012-05-28 10:57:27 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-28 14:56
ComboFix2.txt 2012-05-28 02:28
.
Pre-Run: 129,311,805,440 bytes free
Post-Run: 129,334,202,368 bytes free
.
- - End Of File - - 4DA8A3D590B391FC018E643EE98A556B

#17 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 10:19 AM

If AVG will not uninstall, it is first recommended to uninstall it with AppRemover by Opswat. The AVG uninstaller can be downloaded from here > http://www.appremove.../AppRemover.exe Go to their homepage and you will see they have support for removal of other AV's as well http://www.appremover.com/


Might be leftover registry items.
After you do that, do this:


Good job Posted Image

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:
  • Click START run
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7
  • Click START Search
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.


Here's my usual final post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.


Log looks good :D


  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.
  • Securing Your Web Browser
    This paper will help you configure your web browser for safer internet surfing.

  • Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.

    •Free browser plug-in for Internet Explorer and Firefox
    •Real-time safety ratings
    •Ideal for Facebook, Twitter and LinkedIn

  • JAVA Click this link and click on the Free JAVA Download

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

Only run one Anti-Virus and Firewall program.


I would suggest you read:
PC Safety and Security--What Do I Need?.
How to Prevent Malware:


The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.
We use different ways of protecting your computer(s):
  • Dynamically Blocks Malware Sites & Servers
  • Malware Execution Prevention
Save yourself the hassle and get protected.







Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#18 TeeGee123

TeeGee123

    New Member

  • Members
  • Pip
  • 29 posts

Posted 28 May 2012 - 10:47 AM

Thanks so much for your help. . . and your patience!

#19 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 10:52 AM

You're more than welcome.
Glad we were able to help

Peace be with you Posted Image
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

#20 LDTate

LDTate

    Forum Deity

  • Moderators
  • PipPipPipPipPipPip
  • 21,126 posts
  • Gender:Male
  • Location:Missouri, USA

Posted 28 May 2012 - 10:52 AM

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.
Larry Tate
Product Support

Posted Image

Follow us: Twitter, Become a fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users