|
|
#1
26th Feb 2009, 12:52
| |||
| |||
 Trojan.Vundo.H Removal. Need Help Please. Hello, Need help in removing the file(s) please. Here are the log files (Let me know if I missed anything, Thank you): Quote:
Quote:
Quote:
|
|
#2
26th Feb 2009, 13:09
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Did you let Malwarebytes' Anti-Malware fix what it found after copying the log? It says "No action taken."
__________________  |
|
#3
26th Feb 2009, 13:23
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Disable Spybot's TeaTimer While TeaTimer is an excellent tool for the prevention of spyware, it can also interfere with HijackThis fixes. Please disable TeaTimer for now until you are clean. 1. Right click Spybot in the System Tray (looks like a calendar with a padlock symbol). Choose Exit Spybot S&D Resident 2. Run Spybot S&D 3. Go to the Mode menu, and make sure Advanced Mode is selected. 4. On the left hand side, choose Tools > Resident uncheck Resident TeaTimer and OK any prompt and Restart your computer. Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it. If TeaTimer will not turn off then uninstall Spybot until we are done cleaning. ---------- Open HijackThis and select Do a system scan only. Place a check mark next to the following entries: (if there)
Exit HijackThis. ---------- Go to Start > Run and type notepad.exe then click OK Copy and paste the below into Notepad and save as fixme.reg to Your Desktop Code: REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run] "Alcmtr"=- "zipowatona"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" Make sure that you tell me if you receive a success message about adding the above to the registry. If you do not get a success message, it did not work. Delete the fixme.reg from the Desktop. ---------- Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop. Link #1 Link #2 **Note: It is important that it is saved directly to your Desktop Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix. Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them. Double click combofix.exe & follow the prompts. When finished ComboFix will produce a log for you. Post the ComboFix log in your next reply. Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your antivirus and antispyware protection when ComboFix is complete. If you have problems with ComboFix usage, see How to use ComboFix
__________________ |
|
#4
26th Feb 2009, 14:15
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Quote:
Here is the log: ComboFix 09-02-26.01 - Compaq_Administrator 2009-02-26 12:51:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.541 [GMT -8:00] Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning disabled* (Updated) FW: Norton AntiVirus *disabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2009-01-26 to 2009-02-26 ))))))))))))))))))))))))))))))) . 2009-02-25 16:43 . 2009-02-25 16:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-02-25 16:42 . 2009-02-25 16:42 <DIR> d-------- c:\program files\SUPERAntiSpyware 2009-02-25 16:42 . 2009-02-25 16:42 <DIR> d-------- c:\documents and settings\Compaq_Administrator\Application Data\SUPERAntiSpyware.com 2009-02-24 18:43 . 2009-02-24 18:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\id Software 2009-02-24 13:17 . 2009-02-24 13:17 <DIR> d-------- c:\program files\ETS 2009-02-24 13:02 . 2009-02-24 13:02 <DIR> d-------- c:\program files\iLinc 2009-02-19 13:53 . 2009-02-19 13:53 68,265 --a------ c:\windows\IIF Transaction Creator Uninstaller.exe 2009-02-16 11:32 . 2009-02-16 11:32 <DIR> d-------- c:\windows\Intuit 2009-02-05 12:50 . 2009-02-05 12:50 42,320 --a------ c:\windows\system32\xfcodec.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) )) . 2009-02-26 20:40 --------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\Xfire 2009-02-26 20:38 --------- d-----w c:\program files\Steam 2009-02-26 20:33 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-02-26 19:35 --------- d-----w c:\program files\Java 2009-02-26 19:33 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-26 00:42 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-26 00:07 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-02-25 23:26 --------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\CoreFTP 2009-02-25 05:01 188,896 ----a-w c:\windows\system32\PnkBstrB.exe 2009-02-25 05:01 138,784 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2009-02-25 05:00 70,968 ----a-w c:\windows\system32\pnkbstra.exe 2009-02-25 04:21 --------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\id Software 2009-02-25 02:49 --------- d-s---w c:\program files\Xfire 2009-02-25 02:44 22,328 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\PnkBstrK.sys 2009-02-25 02:43 2,246,144 ----a-w c:\windows\system32\pbsvc.exe 2009-02-23 23:31 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-23 23:31 --------- d-----w c:\program files\Intuit 2009-02-23 23:31 --------- d-----w c:\documents and settings\All Users\Application Data\Intuit 2009-02-23 19:17 --------- d-----w c:\program files\Google 2009-02-19 21:05 --------- d-----w c:\program files\Quicken 2009-02-17 00:50 --------- d-----w c:\program files\Common Files\Intuit 2009-02-11 18:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 18:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-02-05 19:43 --------- d-----w c:\program files\Microsoft SQL Server 2009-01-28 21:46 --------- d-----w c:\program files\Wolfenstein - Enemy Territory 2009-01-20 18:09 --------- d-----w c:\documents and settings\Compaq_Administrator\Application Data\OpenOffice.org 2009-01-20 17:36 --------- d-----w c:\program files\OpenOffice.org 3 2009-01-20 17:36 --------- d-----w c:\program files\JRE 2008-12-29 22:46 --------- d-----w c:\program files\CCleaner 2008-04-18 20:28 56,912 ----a-w c:\documents and settings\Compaq_Administrator\g2mdlhlpx.exe 2007-12-12 00:45 72 ----a-w c:\documents and settings\Compaq_Administrator\Application Data\wklnhst.dat 2008-11-06 10:23 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008110620081 107\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run] "NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 81920] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe" [2007-07-17 68856] "Steam"="c:\program files\steam\steam.exe" [2008-10-08 1410296] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-17 1830128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run] "PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-06-10 45108] "NvMediaCenter"="c:\windows\system32\NvMcTray. dll" [2008-10-07 86016] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2007-09-12 172032] "googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-07-01 1447168] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-08-07 180269] "SetDefPrt"="c:\program files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 49152] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-06-10 36864] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856] "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-03-17 1838592] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "Diamondback"="c:\program files\Razer\Diamondback\razerhid.exe" [2007-02-14 147456] "ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 864256] "FCService"="c:\program files\ETS\Financial Client 3.0.0\FCService.exe" [2009-01-16 20480] "FCManager"="c:\program files\ETS\Financial Client 3.0.0\FinancialClientManager.exe" [2009-01-16 237568] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-26 148888] "RTHDCPL"="RTHDCPL.EXE" [2008-11-07 c:\windows\RTHDCPL.EXE] "nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 c:\windows\arpwrmsg.exe] c:\documents and settings\Compaq_Administrator\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-09-12 384000] Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-02-05 3008336] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-02-07 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] Google Calendar Sync.lnk - c:\program files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-02 546288] [hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Return to Castle Wolfenstein - 1.0\\WolfMP.exe"= "c:\\Program Files\\WS_FTP\\WS_FTP95.exe"= "c:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"= "c:\\Program Files\\Return to Castle Wolfenstein - Game of The Year Edition\\WolfMP_VID.exe"= "c:\\Program Files\\Return to Castle Wolfenstein - Game of The Year Edition\\WolfMP.exe"= "c:\\WINDOWS\\system32\\pnkbstra.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Q3Ademo\\quake3.exe"= "c:\\Program Files\\Steam\\steam.exe"= "c:\\Program Files\\Steam\\steamapps\\\\team fortress 2\\hl2.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "c:\\Program Files\\Steam\\steamapps\\\\counter-strike source\\hl2.exe"= "c:\\Program Files\\GtkRadiant-1.4\\GtkRadiant-1.4.0.exe"= "c:\\Program Files\\Steam\\steamapps\\\\zombie panic! source\\hl2.exe"= "c:\\Program Files\\Steam\\steamapps\\\\insurgency\\hl2.exe"= "c:\\Program Files\\Steam\\steamapps\\\\synergy\\hl2.exe"= "c:\\Program Files\\Google\\Google Talk\\googletalk.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "c:\\Program Files\\MSN Messenger\\livecall.exe"= "c:\\WINDOWS\\system\\hpsysdrv.exe"= "c:\\Documents and Settings\\Compaq_Administrator\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "c:\\WINDOWS\\system32\\drwtsn32.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3sp.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\call of duty world at war\\CoDWaW.exe"= "c:\\Program Files\\Steam\\steamapps\\common\\call of duty world at war\\CoDWaWmp.exe"= "c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"= R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfw tdir.sys [2008-07-01 34312] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-02-17 8944] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-02-17 55024] R2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-07-01 468224] R2 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\Firebird\Firebird_1_5\bin\fb_inet_server.exe -s --> c:\program files\Firebird\Firebird_1_5\bin\fb_inet_server.exe -s [?] R2 MSSQL$AVAILSUITE;SQL Server (AVAILSUITE);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504] R2 MSSQL$ESC;SQL Server (ESC);c:\program files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504] R2 MSSQL$SCHEDUFLOW2008;SQL Server (SCHEDUFLOW2008);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2008-02-26 29183504] R2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\Intuit\Q UICKB~3\QBDBMgrN.exe -hvQuickBooksDB18 --> c:\progra~1\Intuit\QUICKB~3\QBDBMgrN.exe -hvQuickBooksDB18 [?] R2 ubsbm;Unibrain 1394 SBM Driver;c:\windows\system32\drivers\UBSBM.sys [2005-07-27 14080] R2 ubumapi;Unibrain 1394 FireAPI Driver;c:\windows\system32\drivers\UBUMAPI.sys [2005-07-27 36352] R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-08-04 12032] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408] R3 ubohci;Unibrain 1394 OHCI Driver;c:\windows\system32\drivers\ubohci.sys [2005-07-27 77056] S3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [2007-01-31 13225] S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\Usbicp.sys [2008-08-04 14592] S3 USBPNPA;USB PnP Sound Device Interface;c:\windows\system32\drivers\CM108.sys [2008-07-07 1312768] S4 AcowinRemote;AcowinRemote;"c:\program files\Acowin\AcowinRemote.exe" --> c:\program files\Acowin\AcowinRemote.exe [?] [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\D] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480 [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\autorun.exe tgde . Contents of the 'Scheduled Tasks' folder 2009-02-24 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2009-02-26 c:\windows\Tasks\User_Feed_Synchronization-{661BB66C-840B-4B54-822D-7FB97CB2FD2E}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 11:58] . - - - - ORPHANS REMOVED - - - - Notify-LBTWlgn - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESAR IO&pf=desktop mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=PRESARIO &pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PRESAR IO&pf=desktop uInternet Settings,ProxyOverride = *.local Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} - hxxp://webserver.dyyno.com/DyynoClient/DyynoCAB.CAB FF - ProfilePath - c:\documents and settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\wecvbkpz.default\ FF - plugin: c:\program files\Dyyno\Dyyno Player\npvlc.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\NPCltInstall.dll ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************** ************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-26 12:57:41 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************** ************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2233629751-1246927609-129493443-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*] "??"=hex:0e,47,c3,e2,43,90,a0,cd,bb,23,43,e7,74,32 ,8f,96,84,30,3f,1e,21,48,67, 3b,32,bb,ad,7f,82,c0,03,3f,97,61,77,92,d3,70,27,34 ,d1,ee,16,b3,9d,82,3c,0e,\ "??"=hex:cf,e8,83,6d,33,42,1d,e3,3e,1b,ea,be,2f,00 ,4c,9e . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(680) c:\program files\SUPERAntiSpyware\SASWINLO.dll . Completion time: 2009-02-26 12:59:30 ComboFix-quarantined-files.txt 2009-02-26 20:59:18 Pre-Run: 90,180,632,576 bytes free Post-Run: 90,984,087,552 bytes free 225 --- E O F --- 2008-12-02 11:03:45 |
|
#5
26th Feb 2009, 14:17
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. I should also point out that I got the "Blue Screen" few munutes after ComboFix finshed up (Not sure if rebooting messed anything up or not). |
|
#6
26th Feb 2009, 14:24
| |||
| |||
Trojan.Vundo.H Removal. Need Help Please.
---------- Use the Kaspersky Lab Online Scanner In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.
When the scan is done, in the Scan is complete window, any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As
 Copy and paste the Kaspersky Online Scanner Report in your next reply. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ---------- Also let me know how the computer is running now. .
__________________ |
|
#7
27th Feb 2009, 01:50
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Computer seems a little slow, especially noticeable when using IE. Here is the scan log (took a while) -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Friday, February 27, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Friday, February 27, 2009 03:22:46 Records in database: 1850629 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan statistics: Files scanned: 135049 Threat name: 7 Infected objects: 15 Suspicious objects: 0 Duration of the scan: 05:07:19 File name / Threat name / Threats count C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\00577DC7.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29503BE2.htm Infected: Trojan-Downloader.JS.Agent.hv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\295A39D8.wmf Infected: Exploit.Win32.IMG-WMF.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C616099.htm Infected: Trojan-Downloader.JS.Agent.hv 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\3C6E088B.wmf Infected: Exploit.Win32.IMG-WMF.v 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\42236C1D.exe Infected: not-a-virus:AdWare.Win32.180Solutions.ax 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\461B5ACB.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\49B92C9B.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\548D09F3.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\549133EF.tmp Infected: Trojan.Java.ClassLoader.ao 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D010BFB.htm Infected: Trojan-Downloader.JS.Psyme.ea 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\630F6301.tmp Infected: Trojan-Downloader.Java.OpenConnection.ao 2 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\630F6301.tmp Infected: Trojan.Java.ClassLoader.au 1 C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71C22E3C.tmp Infected: Trojan.Java.ClassLoader.ao 1 |
|
#8
27th Feb 2009, 09:02
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Empty ALL Norton/Symantec Quarantine files. Guide: Removing files from Norton AntiVirus Quarantine ---------- Download ATF Cleaner by Atribune to your Desktop. Alternate download link Note: Vista users must use Run As Administrator
Note that your system will run slower for a reboot or two after having used this tool so don't panic. Important: Restart the computer before continuing. ---------- I would also recommend that you Defrag the computer. There may be a lot of fragmented sections on the drive after cleaning the malware. You can use the built in Windows Defrag or a faster FREE program. Defraggler is very effective and easy to use. Be sure to clean out temp files and restart the computer just before using this. How is it now?
__________________ |
|
#9
27th Feb 2009, 17:07
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Systems seems to be running a lot better now that updated java, removed all older versions and used ccleaners reg tool. I'm also happy to report that neither Malwarebites, NOD32 nor SUPERAntiSpyware are picking up any suspicious or infected files. Thank You! Quote:
I no longer have Norton installed, it was removed prior to installing NOD32. Is there a program that can be used to remove Symantec Quarantine files and is it ok if I jump to step 2 of your last post without removing those. |
|
#10
27th Feb 2009, 17:12
| |||
| |||
| Trojan.Vundo.H Removal. Need Help Please. Download the OTMoveIt3 by OldTimer Note: If you are running on Vista, right-click on OTMoveIt3.exe and choose Run As Administrator. * Save it to your Desktop. * Double-click OTMoveIt3.exe to run it. * Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy) Code: :Processes explorer.exe :files C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine :Commands [emptytemp] [start explorer] * Click the red Moveit! button. Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. ---------- Download the Norton Removal Tool (SymNRT) to your Desktop. Once downloaded please close ALL open browsers, also save any work because this may require a restart.
Use the Secunia Software Inspector to check for out of date software. Out of date software has security vulnerabilities that malware can exploit.
Go to Microsoft Windows Update and get all critical updates. ---------- Make sure all of your security programs are up to date and run scans with them regularly. I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free. SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox. * Using SpywareBlaster to protect your computer from Spyware and Malware * If you don't know what ActiveX controls are, see here Check out Keeping Yourself safe On The Web for tips and free tools to keep you safe in the future. Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.
__________________ |
 |
 |
| Bookmarks |
Similar Threads | ||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Need Help... Can't Get Rid of TROJAN.VUNDO.H. | sukun | Virus, Spyware & Security | 1 | 2nd May 2009 16:27 |
| I Can't Get Rid of TROJAN.VUNDO.H from my PC | theprodigycmb | Virus, Spyware & Security | 13 | 16th Mar 2009 16:40 |
| TROJAN.VUNDO.H Removal | SK1985 | Virus, Spyware & Security | 26 | 18th Feb 2009 09:14 |
| Need Help w/ Trojan.Vundo H! | Nicholas02 | Virus, Spyware & Security | 22 | 22nd Dec 2008 17:59 |
| Trojan.vundo.h , trojan.agent , adware.mirar + MORE! :( | sillyarfer | Virus, Spyware & Security | 1 | 14th Dec 2008 09:59 |
| Thread Tools | |
| |
