ComboFix 08-08-06.02 - Administrator 2008-08-06 23:18:34.5 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.832 [GMT -5:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! .
((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) .
C:\WINDOWS\system32\ebjuvewv.ini . ---- Previous Run ------- . C:\Documents and Settings\All Users\Application Data\Rabio C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\S3FFRVA3\interclick.com C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\#SharedObjects\S3FFRVA3\interclick.com\ud.sol C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\Documents and Settings\Owner\Desktop\Error Cleaner.url C:\Documents and Settings\Owner\Desktop\Privacy Protector.url C:\Documents and Settings\Owner\Desktop\Spyware&Malware Protection.url C:\Documents and Settings\Owner\Favorites\Error Cleaner.url C:\Documents and Settings\Owner\Favorites\Privacy Protector.url C:\Documents and Settings\Owner\Favorites\Spyware&Malware Protection.url C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe C:\kmd.exe C:\WINDOWS\bgrqfetx.dll C:\WINDOWS\BM3f2cf806.txt C:\WINDOWS\BM3f2cf806.xml C:\WINDOWS\exwd.exe C:\WINDOWS\privacy_danger C:\WINDOWS\privacy_danger\images\capt.gif C:\WINDOWS\privacy_danger\images\danger.jpg C:\WINDOWS\privacy_danger\images\down.gif C:\WINDOWS\privacy_danger\images\spacer.gif C:\WINDOWS\privacy_danger\index.htm C:\WINDOWS\pskt.ini C:\WINDOWS\system32\awtuuVNH.dll C:\WINDOWS\system32\ebjuvewv.ini C:\WINDOWS\system32\MSINET.oca C:\WINDOWS\system32\owcvxu.dll C:\WINDOWS\system32\RBaHRqru.ini C:\WINDOWS\system32\RBaHRqru.ini2 C:\WINDOWS\system32\urqRHaBR.dll C:\WINDOWS\system32\vtUmMebx.dll C:\WINDOWS\system32\wnbdrdkn.dll C:\WINDOWS\tfnslopk.dll C:\WINDOWS\wnlmdakqxmd.dll C:\WINDOWS\xokvrpwg.dll
. ((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) .
Logfile of HijackThis v1.99.1 Scan saved at 23:26, on 2008-08-06 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Adware.Tracking Cookie C:\Documents and Settings\Owner\Cookies\owner@2adultflashgames.txt C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager.txt C:\Documents and Settings\Owner\Cookies\owner@adopt.euroclick.txt C:\Documents and Settings\Owner\Cookies\owner@adopt.specificclick.txt C:\Documents and Settings\Owner\Cookies\owner@adrevolver.txt C:\Documents and Settings\Owner\Cookies\owner@adrevolver.txt C:\Documents and Settings\Owner\Cookies\owner@ads.addynamix.txt C:\Documents and Settings\Owner\Cookies\owner@ads.bridgetrack.txt C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll.txt C:\Documents and Settings\Owner\Cookies\owner@ads.widgetbucks.txt C:\Documents and Settings\Owner\Cookies\owner@adserver.txt C:\Documents and Settings\Owner\Cookies\owner@adultadworld.txt C:\Documents and Settings\Owner\Cookies\owner@advertising.txt C:\Documents and Settings\Owner\Cookies\owner@apmebf.txt C:\Documents and Settings\Owner\Cookies\owner@at.atwola.txt C:\Documents and Settings\Owner\Cookies\owner@atdmt.txt C:\Documents and Settings\Owner\Cookies\owner@atwola.txt C:\Documents and Settings\Owner\Cookies\owner@bs.serving-sys.txt C:\Documents and Settings\Owner\Cookies\owner@casalemedia.txt C:\Documents and Settings\Owner\Cookies\owner@cdn.at.atwola.txt C:\Documents and Settings\Owner\Cookies\owner@doubleclick.txt C:\Documents and Settings\Owner\Cookies\owner@dynamic.media.adrevolver.txt C:\Documents and Settings\Owner\Cookies\owner@fastclick.txt C:\Documents and Settings\Owner\Cookies\owner@interclick.txt C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver.txt C:\Documents and Settings\Owner\Cookies\owner@media6degrees.txt C:\Documents and Settings\Owner\Cookies\owner@mediaplex.txt C:\Documents and Settings\Owner\Cookies\owner@overture.txt C:\Documents and Settings\Owner\Cookies\owner@realmedia.txt C:\Documents and Settings\Owner\Cookies\owner@revsci.txt C:\Documents and Settings\Owner\Cookies\owner@richmedia.yahoo.txt C:\Documents and Settings\Owner\Cookies\owner@server.cpmstar.txt C:\Documents and Settings\Owner\Cookies\owner@serving-sys.txt C:\Documents and Settings\Owner\Cookies\owner@specificclick.txt C:\Documents and Settings\Owner\Cookies\owner@trafficmp.txt C:\Documents and Settings\Owner\Cookies\owner@tribalfusion.txt C:\Documents and Settings\Owner\Cookies\owner@wmvmedialease.txt C:\Documents and Settings\Owner\Cookies\owner@www.2adultflashgames.txt
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch
Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
Copy and Paste that log into your next reply, along with fresh combofix log.
NB: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
Memory Processes Infected: (No malicious items detected)
Memory Modules Infected: (No malicious items detected)
Registry Keys Infected: HKEY_CLASSES_ROOT\AppID\{543bd811-f148-4b3a-a0b9-177014555bf9} (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bndblock5.band (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bndblock5.band.1 (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bndblock5.bho (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bndblock5.bho.1 (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d6b0c179-6343-442c-8175-9652e200cb55} (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\rabio.rabiobho.1 (Adware.RABCO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\BndBlock5.DLL (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RABCO (Adware.RABCO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\RABCO (Adware.RABCO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\RABCO (Adware.RABCO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bgrqfetx.bbkr (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\bgrqfetx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected: (No malicious items detected)
Registry Data Items Infected: (No malicious items detected)
Folders Infected: (No malicious items detected)
Files Infected: C:\Documents and Settings\Owner\DoctorWeb\Quarantine\A0007477.exe (Trojan.Winpop) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\DoctorWeb\Quarantine\A0008838.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\DoctorWeb\Quarantine\InsiDERIns.exe.vir (Trojan.Winpop) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\DoctorWeb\Quarantine\xinside.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\Program Files\Outerinfo\FF\components\FF.dll.#ir (Adware.ClickSpring) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\b153.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\exwd.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\xokvrpwg.dll.vir (Trojan.Zlob) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\awtuuVNH.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\owcvxu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\urqRHaBR.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\wnbdrdkn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\QooBox\Quarantine\C\WINDOWS\system32\p9\liopud89104.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036846.dll (Trojan.Zlob) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036848.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036849.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036850.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036851.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{D23EFF2A-BFEF-46A5-8364-D064E372DF2B}\RP322\A0036853.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vwevujbe.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\lnvegaow.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Owner\Start Menu\Programs\Startup\RABCO - Auto Update.lnk (Adware.RABCO) -> Quarantined and deleted successfully.
And here is the Combofix Log...
ComboFix 08-08-06.02 - Administrator 2008-08-07 4:54:48.6 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.769 [GMT -5:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! .
((((((((((((((((((((((((( Files Created from 2008-07-07 to 2008-08-07 ))))))))))))))))))))))))))))))) .
Currently it is Thursday, December 04, 2008 8:12 PM (GMT +1) There are a total of 64.634 posts in 15.923 threads. In the last 3 days there were 21 new threads and 135 reply posts. View Active Threads
Who's Online
This forum has 27355 registered members. Please welcome our newest member, bigstu. 43 Guest(s), 3 Registered Member(s) are currently online. Details Churrosgomoo, Wello, JHT
|