#1
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
Another Infostealer.Gampass infection
I've searched on the site and tried using previous threads to no avail.dss /hijackThis tool:SP2 (WinNT 5.01.2600)Ad -Aware\aawservice.exedss .exeYahoo! MSN.com Live Search Live Search MSN.com http://myportal.perficient.com:10038/wps/portal http://quickplace.perficient.com/qp2.cab http://inotes.perficient.com/iNotes6W.cab http://update.microsoft.com/microsof...?1167765449254 http://update.microsoft.com/microsof...?1167765444223 http://135.100.200.124:10038/wps/PA_...s/DMPlugin.cab http://inotes.perficient.com/dwa8W.cab http://inotes.perficient.com/dwa7W.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exeHDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.EXEDHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
Last edited by sovapid; 19th July 2008 at 06:52 .
Reason: removed real name
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
My hosts file was modified at the same time the notices first appeared:¾¢ÎèÍÅÎè²½_¾¢ÎèÍÅ˽·þ_¾¢ÎèÍŸèÇú www.hao601.cn www.psp476.cn ad .update365.uswww.xdj2008.com www.revtr.cn www.aassccwe.cn www.infomt.net haoaoaoÍøÖ·µ¼º½£*Öйú×îºÃµÄÍøÖ·Õ¾ Adobe
#3
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
Running a full Symantec scan did not turn up anything.
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 10,975
Computer Experience:
Welcome to WindowsBBS sovapid here . Save it to your desktop then reboot to safe mode and run it.
#5
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
Ran it in safe mode, it took a long time to run. Left it running overnight.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! Broadcaster.com | Home | Viral Video Clips, Live Community, News, Software, Movies, Music, Games, Mobile Media & More www.broadcaster.com\played_list.sol www.broadcaster.com\video_queue.sol Broadcaster.com | Home | Viral Video Clips, Live Community, News, Software, Movies, Music, Games, Mobile Media & More www.broadcaster.com\settings.sol ISA and ESA\\IBM Support Assistant\\jre\\bin\\javaw.exe"=http://www.gmer.net
Last edited by sovapid; 21st July 2008 at 03:35 .
Reason: name
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 10,975
Computer Experience:
Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/removing-spyware-viruses/75252-another-infostealer-gampass-infection.html
KillAll::
Suspect::
C:\WINDOWS\system32\drivers\eth8023.sys
C:\WINDOWS\system32\qbhxaklo.sys
C:\WINDOWS\system32\BBB2CAA0A2.dll
C:\WINDOWS\system32\vlhxaklo.sys
File::
C:\WINDOWS\AppPatch\AclLayer.dll
C:\WINDOWS\AppPatch\DesktopWin.dll
C:\WINDOWS\system32\nhmxejkl.dll
Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#7
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
ComboFix log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! ISA and ESA\\IBM Support Assistant\\jre\\bin\\javaw.exe"=http://www.gmer.net Ad -Aware\aawservice.exe
#8
Member
Profile: Join Date: Jul 2008
Posts: 6
Computer Experience:
dss /hjt log after running combofix:SP2 (WinNT 5.01.2600)Ad -Aware\aawservice.exedss .exeYahoo! MSN.com
