#1
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
HiJackThis Log + Win32.TrojanDownloader.Obfuscated
When I ran Ad -Aware SE, it found the Trojan Win32.TrojanDownloader.Obfuscated. I told Ad -Aware to delete, but I want to make sure my system is clean.Ad -Aware gives me the following:SP2 (WinNT 5.01.2600)http://my.msn.com/?page=1&refresh=1 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http ://www.sony.com/vaiopeoplehttp://esupport.sony.com/EN/mdldetect/VaioInfo.CAB http://www.musicnotes.com/download/mnviewer.cab http://www.silvercrk.com/php/hweuchr...45_8863019.cab http://photo.walgreens.com/WalgreensActivia.cab http://lads.myspace.com/upload/MySpaceUploader1005.cab http://by11fd.bay11.hotmail.msn.com/...s/MsnPUpld.cab https://webdl.symantec.com/activex/symdlmgr.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://aolsvc.aol.com/onlinegames/ch...ploader_v7.cab http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab HTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exeHTTP ) (VAIOMediaPlatform-VideoServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
Didn't find the information you thought to find?Similar Threads
#2
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi zekeburgerHere this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users right click Combofix.exe and select Run As Administrator.When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
I forgot to disable the programs before running the tool, but it still worked. I hope that won't make a difference.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! www.broadcaster.com www.broadcaster.com www.broadcaster.com\settings.sol 0 2.05.0000.1082\en-us\bin\WindowsSearch.exe [2005-06-15 19:59:34 238080]http://www.gmer.net
#4
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)http://my.msn.com/?page=1&refresh=1 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http ://www.sony.com/vaiopeoplehttp://esupport.sony.com/EN/mdldetect/VaioInfo.CAB http://www.musicnotes.com/download/mnviewer.cab http://www.silvercrk.com/php/hweuchr...45_8863019.cab http://photo.walgreens.com/WalgreensActivia.cab http://lads.myspace.com/upload/MySpaceUploader1005.cab http://by11fd.bay11.hotmail.msn.com/...s/MsnPUpld.cab https://webdl.symantec.com/activex/symdlmgr.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://aolsvc.aol.com/onlinegames/ch...ploader_v7.cab http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab HTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exeHTTP ) (VAIOMediaPlatform-VideoServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
#5
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi zekeburgerJotti File Submission: Please go to Jotti's malware scan
Copy and paste the following file path into the "File to upload & scan" box on the top of the page:C:\WINDOWS\system32\j3211036.dll
Click on the submit button
Please post the results in your next reply.
Now do this. contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\WINDOWS\system32\xbadd.bak1
C:\WINDOWS\system32\xbadd.bak2
C:\WINDOWS\system32\xbadd.ini2
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{382C3158-A341-4DD9-9905-9C5B91552E82}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BA2198B-DAFA-4DBC-8255-23C7B3F32D54}] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.http://img.photobucket.com/albums/v6...s/CFScript.gif Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#6
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Quote:
Originally Posted by
Geri
I need a file scanned that I can't find any info on, so please do this.
Jotti File Submission: Please go to Jotti's malware scan
Copy and paste the following file path into the "File to upload & scan" box on the top of the page:C:\WINDOWS\system32\j3211036.dll
Click on the submit button
Please post the results in your next reply.
When I tried to do this, it said the following:The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file. WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 0 2.05.0000.1082\en-us\bin\WindowsSearch.exe [2005-06-15 19:59:34 238080]http://www.gmer.net
Last edited by zekeburger; 30th January 2008 at 04:39 .
Reason: Adding a note.
#7
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Here's my HiJackThis log:SP2 (WinNT 5.01.2600)http://my.msn.com/?page=1&refresh=1 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http ://www.sony.com/vaiopeoplehttp://esupport.sony.com/EN/mdldetect/VaioInfo.CAB http://www.musicnotes.com/download/mnviewer.cab http://www.silvercrk.com/php/hweuchr...45_8863019.cab http://photo.walgreens.com/WalgreensActivia.cab http://lads.myspace.com/upload/MySpaceUploader1005.cab http://by11fd.bay11.hotmail.msn.com/...s/MsnPUpld.cab https://webdl.symantec.com/activex/symdlmgr.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://aolsvc.aol.com/onlinegames/ch...ploader_v7.cab http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab HTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exeHTTP ) (VAIOMediaPlatform-VideoServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
#8
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi zekeburger<<Do you know what this is? contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\WINDOWS\system32\xbadd.bak1
C:\WINDOWS\system32\xbadd.bak2
C:\WINDOWS\system32\xbadd.ini2
C:\WINDOWS\system32\j3211036.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{382C3158-A341-4DD9-9905-9C5B91552E82}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BA2198B-DAFA-4DBC-8255-23C7B3F32D54}] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.http://img.photobucket.com/albums/v6...s/CFScript.gif Please do not click on the ComboFix window while it is running a scan. This can cause it to stall. HJT log.
#9
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Geri,
#10
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
HiHere
Quote:
the GIF, it tells me that bandwidth has been exceeded
I'm getting the same message.Click here to see how to use CFScript.txt
#11
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Geri,WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! 0 2.05.0000.1082\en-us\bin\WindowsSearch.exe [2005-06-15 19:59:34 238080]http://www.gmer.net
#12
Inactive
Profile: Join Date: May 2004
Posts: 42
Computer Experience:
Here's my HiJack This log file:SP2 (WinNT 5.01.2600)http://my.msn.com/?page=1&refresh=1 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http ://www.sony.com/vaiopeoplehttp://esupport.sony.com/EN/mdldetect/VaioInfo.CAB http://www.musicnotes.com/download/mnviewer.cab http://www.silvercrk.com/php/hweuchr...45_8863019.cab http://photo.walgreens.com/WalgreensActivia.cab http://lads.myspace.com/upload/MySpaceUploader1005.cab http://by11fd.bay11.hotmail.msn.com/...s/MsnPUpld.cab https://webdl.symantec.com/activex/symdlmgr.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://aolsvc.aol.com/onlinegames/ch...ploader_v7.cab http://pdl.stream.aol.com/downloads/...ampx_en_dl.cab HTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exeHTTP ) (VAIOMediaPlatform-VideoServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe
#13
WindowsBBS Team Member
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,640
Computer Experience:
Hi Please delete the combofix you have and get the newer version before running the below CFScript. contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{382C3158-A341-4DD9-9905-9C5B91552E82}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5BA2198B-DAFA-4DBC-8255-23C7B3F32D54}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"j3211036"=- Please post the new CF log.
All times are GMT +1. The time now is 08:53 .
