worm.win32.netsky, trojanSPM/LX [as far as i know]

View previous topic View next topic Go down

worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 21st January 2010, 11:32 pm

I can't open any of my removal programs (McAfee, Malwarebytes, and I tried to download AVG but my computer said there was an error in the download)
So, I finally scanned it with HijackThis and these are the results
Please help me :/

--------------------------------------------

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 5:20:54 PM, on 1/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\smss32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\InternetSecurity2010\IS2010.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\635L1AFN\TCODEW~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\BHCXL6MN\AIM_UA~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\4P08TIPU\PASS_1~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\STOG0Z1D\TCODE3~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I18G43NC\TCODEW~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\2DQY020M\AIM_UA~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\HN6HDHXG\PASS_1~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I18G43NC\TCODE3~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I6UCRWQ7\TPP_1_~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\2DQY020M\ADBA74~1.SH!
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\helper32.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\sched.exe (file missing)
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Network LookOut Agent (NetworkLookOutAgent) - Unknown owner - C:\WINDOWS\system32\nladm\NLAgentProSvc.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8902 bytes

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 21st January 2010, 11:50 pm

I also looked at other threads that have my situation, but the links are blocked or the downloads don't open

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Belahzur on 21st January 2010, 11:56 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon32.exe
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [smss32.exe] C:\WINDOWS\system32\smss32.exe
    O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\635L1AFN\TCODEW~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\BHCXL6MN\AIM_UA~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\4P08TIPU\PASS_1~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\STOG0Z1D\TCODE3~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I18G43NC\TCODEW~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\2DQY020M\AIM_UA~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\HN6HDHXG\PASS_1~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I18G43NC\TCODE3~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\I6UCRWQ7\TPP_1_~1.SH! C:\DOCUME~1\Miriam\LOCALS~1\TEMPOR~1\Content.IE5\2DQY020M\ADBA74~1.SH!
    O4 - HKCU\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\sched.exe (file missing)
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 22nd January 2010, 12:05 am

It doesn't open up to install itself

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Belahzur on 23rd January 2010, 1:47 am

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to Combo-Fix as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 25th January 2010, 11:41 pm

Either link would not go. This is what it said: "DNS error occurred. Server cannot be found. The link may be broken."
Also, something new happened. I can't open HijackThis or any other icon on my desktop." Application cannot be executed. The file hijackthis.exe is infected." New malware has popped up called Antivirus Live, and it says that I have BankerFox.A?

Please help me :/

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Belahzur on 26th January 2010, 1:20 am

Hello.
Combofix was taken offline for a few hours, but it's back now, please try the link again.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 26th January 2010, 3:30 am

The links must be blocked because of the viruses D:

And now I also have BankerFox.A and Win32/Nuquel.E

This is infuriating

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Belahzur on 26th January 2010, 6:09 pm

Download [You must be registered and logged in to see this link.] by OldTimer to your Desktop.

  • Close all windows and double click OTL.exe
  • Click Run Scan and let the program run uninterrupted
  • It will produce two logs for you, one will pop up - OTL.txt, the other will be saved on your Desktop - Extras.txt. Post both logs in this thread.
  • You may need to use two posts to get it all.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Meemz on 26th January 2010, 11:57 pm

I still cannot get to OTL or ComboFix, but I was finally able to download AVG and perform a scan and this is what I got

AVG 9.0 Anti-Virus command line scanner
Copyright (c) 1992 - 2009 AVG Technologies
Program version 9.0.712, engine 9.0.729
Virus Database: Version 271.1.1/2645 2010-01-25

C:\WINDOWS\system32\H8SRTkpfypdmrqo.dll Trojan horse Crypt.MUK Object was moved to Virus Vault.
C:\WINDOWS\system32\winlogon.exe (1184) Trojan horse Crypt.MUK
C:\WINDOWS\system32\H8SRTkpfypdmrqo.dll Trojan horse Crypt.MUK Object was moved to Virus Vault.
C:\WINDOWS\system32\svchost.exe (1632) Trojan horse Crypt.MUK
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\LocalService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\LocalService\ntuser.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Miriam\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\Miriam\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\Miriam\Local Settings\Temp\qxsmuw.exe Trojan horse Downloader.Generic9.AIKZ Object was moved to Virus Vault.
C:\Documents and Settings\Miriam\Local Settings\Temporary Internet Files\Content.IE5\EP0NHFCQ\dfghfghgfj[1].dll Trojan horse Crypt.MQX Object was moved to Virus Vault.
C:\Documents and Settings\Miriam\Local Settings\Temporary Internet Files\Content.IE5\H4LWZ5Y0\0001420[1].exe Trojan horse Generic16.ANBA Object was moved to Virus Vault.
C:\Documents and Settings\Miriam\Local Settings\Temporary Internet Files\Content.IE5\H4LWZ5Y0\SetupIS2010[1].exe Trojan horse Generic16.AHND Object was moved to Virus Vault.
C:\Documents and Settings\Miriam\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\Miriam\ntuser.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Locked file. Not tested.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Locked file. Not tested.
C:\Documents and Settings\NetworkService\NTUSER.DAT Locked file. Not tested.
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Locked file. Not tested.
C:\pagefile.sys Locked file. Not tested.
C:\Program Files\InternetSecurity2010\IS2010.exe Trojan horse Generic16.AHND Object was moved to Virus Vault.
C:\Program Files\Malware Defense\mdefense.exe Trojan horse Generic16.CFN Object was moved to Virus Vault.
C:\Program Files\Malware Defense\mdext.dll Trojan horse Downloader.Zlob.AQLT Object was moved to Virus Vault.
C:\System Volume Information\ Locked file. Not tested.
C:\WINDOWS\system32\config\default Locked file. Not tested.
C:\WINDOWS\system32\config\default.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SAM Locked file. Not tested.
C:\WINDOWS\system32\config\SAM.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY Locked file. Not tested.
C:\WINDOWS\system32\config\SECURITY.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\software Locked file. Not tested.
C:\WINDOWS\system32\config\software.LOG Locked file. Not tested.
C:\WINDOWS\system32\config\system Locked file. Not tested.
C:\WINDOWS\system32\config\system.LOG Locked file. Not tested.
C:\WINDOWS\system32\drivers\sptd.sys Locked file. Not tested.
C:\WINDOWS\system32\helper32.dll Trojan horse Crypt.MQX Object was moved to Virus Vault.
C:\WINDOWS\system32\spool\prtprocs\w32x86\26.tmp Trojan horse Generic16.ANBA Object was moved to Virus Vault.
C:\WINDOWS\system32\warning.html Trojan horse FakeAlert.OP Object was moved to Virus Vault.
C:\WINDOWS\Temp\27.tmp Trojan horse Vundo.KA Object was moved to Virus Vault.

------------------------------------------------------------
Objects scanned : 176829
Found infections : 15
Found PUPs : 0
Healed infections : 13
Healed PUPs : 0
Warnings : 0
------------------------------------------------------------

Meemz
Novice
Novice

Posts Posts : 6
Joined Joined : 2010-01-21
Gender Gender : Female
OS OS : Windows XP
Points Points : 25198
# Likes # Likes : 0

View user profile

Back to top Go down

Re: worm.win32.netsky, trojanSPM/LX [as far as i know]

Post by Belahzur on 27th January 2010, 1:43 am

Download the GMER rootkit scan from here: [You must be registered and logged in to see this link.]

  1. Unzip it and start GMER.
  2. Click the >>> tab and then click the Scan button.
  3. Once done, click the Copy button.
  4. This will copy the results to your clipboard.
  5. Paste the results in your next reply.
Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum