Welcome to GeekPolice!
HomeInfected by Nuqel.E, BankerFox.A, unlimited pop-ups
Page 3 of 4 • 
1, 2, 3, 4 
- Sanddj
Novice
-
OS : Windows XP updated to SP3
Posts : 25
Rubies : 3062
Likes : 0 
Sanddj on 21st February 2010, 6:58 pm
Done. Combo-Fix is uninstalled.
I think the computer is running pretty well!!
Do you think we should "clean" some else more? Or looks everything so well?
And what do you recommend to get installed on the computer to keep it safely? (in addition to Windows Defender and Avast Home 5.0).
I think the computer is running pretty well!!
Do you think we should "clean" some else more? Or looks everything so well?
And what do you recommend to get installed on the computer to keep it safely? (in addition to Windows Defender and Avast Home 5.0).
- Belahzur
Site Admin
-
OS : 7 Home Premium x64
Posts : 34946
Rubies : 217957
Likes : 18 -
- BelahzurSite Admin
-
OS : 7 Home Premium x64
Posts : 34946
Rubies : 217957
Likes : 18 -
Belahzur on 22nd February 2010, 1:02 am
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. 
1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.
Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.
2) In order to protect yourself against spyware, you should consider installing and running the following free programs:
Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.
Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.
SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.
SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.
Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.
3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433
4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.
To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker
5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.
Please also read Tony Klein's excellent article: How I got Infected in the First Place
If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.
Hopefully this should take care of your problems! Good luck.
1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.
Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.
2) In order to protect yourself against spyware, you should consider installing and running the following free programs:
Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.
Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.
SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.
SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.
Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.
3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433
4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.
To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker
5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.
Please also read Tony Klein's excellent article: How I got Infected in the First Place
If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.
Hopefully this should take care of your problems! Good luck.
Site Admin / Security Administrator
[Prework] - Please PM me if I fail to respond within 24hrs.
- SanddjNovice
-
OS : Windows XP updated to SP3
Posts : 25
Rubies : 3062
Likes : 0 -
Sanddj on 22nd February 2010, 8:52 pm
Thank you so much. My sister (her computer was the infected one) was so interested in to know the last information.
Only one more question. I think the infection could came from an external USB hard drive used for storage and back-up copies.
How should I scan it to not being infected again? Any remarkable instruction?
Only one more question. I think the infection could came from an external USB hard drive used for storage and back-up copies.
How should I scan it to not being infected again? Any remarkable instruction?
- BelahzurSite Admin
-
OS : 7 Home Premium x64
Posts : 34946
Rubies : 217957
Likes : 18 -
Belahzur on 22nd February 2010, 9:04 pm
Hello.
The loading point is removed, is it just one removalable drive you think is infected?
The loading point is removed, is it just one removalable drive you think is infected?
Site Admin / Security Administrator
[Prework] - Please PM me if I fail to respond within 24hrs.
- BelahzurSite Admin
-
OS : 7 Home Premium x64
Posts : 34946
Rubies : 217957
Likes : 18 -
Belahzur on 22nd February 2010, 9:37 pm
Please download USBNoRisk to your Desktop and run it by double clicking the program's icon.
- Wait a couple of seconds for initial scan to finish.
- Connect all of your USB storage devices to the PC, one at a time, and keep each one connected at least for 10 seconds.
- If there are more USB storage devices to scan, please take a note about the order in which these were connected.
- After all the devices are scanned, right click in the Monitor tab, and choose "Save log". That will open the log in Notepad. Please copy and paste the log into this thread.
Site Admin / Security Administrator
[Prework] - Please PM me if I fail to respond within 24hrs.
- SanddjNovice
-
OS : Windows XP updated to SP3
Posts : 25
Rubies : 3062
Likes : 0 -
Sanddj on 22nd February 2010, 9:59 pm
The log! (I think I didn't do it well 
)
I plugged in the (same) Hard Drive (the one it could have the virus inside) on each usb port.
It was that?
)I plugged in the (same) Hard Drive (the one it could have the virus inside) on each usb port.
It was that?
USBNoRisk 2.5 (26 July 2009) by bobby
Started at 22/02/2010 22:44:28
Searching for connected USB Mass storage...
----------------------------------------
========================================
Searching for other storage...
----------------------------------------
C: {f5053ce0-ff50-11dc-bcee-806d6172696f}
========================================
Scanning fixed storage...
----------------------------------------
No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for f5053ce0-ff50-11dc-bcee-806d6172696f
----------------------------------------
Desktop.ini found at C:\i386\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
----------------------------------------
HKCR\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\DefaultIcon,@ = C:\WINDOWS\system32\ieframe.dll,-20780
HKCR\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\InProcServer32,@ = C:\WINDOWS\system32\ieframe.dll
HKLM\Software\Classes\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\DefaultIcon,@ = C:\WINDOWS\system32\ieframe.dll,-20780
HKLM\Software\Classes\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\InProcServer32,@ = C:\WINDOWS\system32\ieframe.dll
----------------------------------------
========================================
Initial scan finished!
========================================
New device connected at 22/02/2010 22:44:49
Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================
Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------
----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------
No mimics found on drive E:
========================================
========================================
Removed E:
========================================
New device connected at 22/02/2010 22:45:22
Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================
Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------
----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------
No mimics found on drive E:
========================================
========================================
Removed E:
========================================
New device connected at 22/02/2010 22:46:09
Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================
Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------
----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------
No mimics found on drive E:
========================================
- BelahzurSite Admin
-
OS : 7 Home Premium x64
Posts : 34946
Rubies : 217957
Likes : 18 -
Belahzur on 22nd February 2010, 10:01 pm
Hello.
Looks good, no autorun file found on the removable media.
It's not infected.
Looks good, no autorun file found on the removable media.
It's not infected.Site Admin / Security Administrator
[Prework] - Please PM me if I fail to respond within 24hrs.
Page 3 of 4 • 1, 2, 3, 4
Similar topics
Create an account or log in to leave a reply
You need to be a member in order to leave a reply.
Page 3 of 4
Permissions in this forum:
You can reply to topics in this forum
