HiJackThis Log

[shining]

computer is running great, a little slow today but other then that fine 

Malwarebytes' Anti-Malware 1.39
Database version: 2421
Windows 5.1.2600 Service Pack 2

11/20/2009 12:22:03 PM
mbam-log-2009-11-20 (12-22-03).txt

Scan type: Quick Scan
Objects scanned: 99076
Time elapsed: 11 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Derek]

I think that is as clear as we will ever get it

*Follow these steps to uninstall Combofix and the other tools it downloaded to remove the malware*
*  Click START then RUN
*  Now type Combofix /Uninstall in the runbox  and click OK.  Note the space between the X and the /U, it needs to be there.


This will also purge the restore folder and clear any malware that has been put in there. Now Empty Recycle bin on desktop Then reboot.

go here http://www.thespykiller.co.uk/index.php?page=3 for info on how to tighten your security settings and how to help prevent future attacks.

and scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer and update whatever it suggests

Then pay an urgent visit to windows update & make sure you are fully updated,  that will help to plug the security holes that let these pests on in the first place

[shining]

I ran a updated version of Malwarebytes and this is what it found:


Malwarebytes' Anti-Malware 1.41
Database version: 3202
Windows 5.1.2600 Service Pack 2

5/25/2006 12:01:04 AM
mbam-log-2006-05-25 (00-01-04).txt

Scan type: Quick Scan
Objects scanned: 117023
Time elapsed: 6 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Active Security (Rogue.ActiveSecurity) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\fias4051 (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\ntuser.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\wwmeoblk.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1148533305.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1148533443.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1148533461.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1148533650.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1148533816.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1245945511.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\sedup_1245956937.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

[Derek]

lets run an  online scan to double check if anymore left

* Run Kaspersky online virus scan  Kaspersky Online Scanner.

After the updates have downloaded, click on the "Scan Settings" button.
select the (b)"Spyware, Adware, Dialers and other potentially dangerous programs" for the scan.
Under "Please select a target to scan", click "My Computer".
When the scan is finished, Save the results from the scan!

Note: Kavscan is a scanner only & won't fix anything but will normally find the most infected files so it's report gives us a good place to work from

[shining]

here is the results from the Kaspersky scan

[Derek]

delete these
C:\Documents and Settings\samantha\Shared\beauty will rise.wma
C:\Documents and Settings\samantha\Shared\black gives way to blues.wma
C:\Documents and Settings\samantha\Shared\Blossom Dearie - I Want to be Bad.wma
C:\Documents and Settings\samantha\Shared\Blossom Dearie - Someone to watch over me.wma
C:\Documents and Settings\samantha\Shared\Blossom dearie - Unpack Your Adjectives.wma
C:\Documents and Settings\samantha\Shared\clap your hands say yeah.wma
C:\Documents and Settings\samantha\Shared\southern discomfort bartender1.mp3
C:\Program Files\Mozilla Firefox\a.exe

the first ones are inside your P2P shared folder so you will probably have to delete them from within teh P2P program

[shining]

all have been removed

[Derek]

you should be fine now then

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser