#1
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
[Resolved]Help me get rid of this Trojan please, HJT log included
One of the computers here keeps coming up with a Macafee alert that it is infected with a file called __c00A56A1.dat but it fails whenever I try to clean, move, or delete it. Here is the HJT logSP3 (WinNT 5.01.2600)http://www.hp.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://update.microsoft.com/windowsu...?1175709720614
Didn't find the information you thought to find?Similar Threads
#2
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi wbrumfiel
Quote:
One of the computers here
Is this a work computer?
#3
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
It is a work computer and I would be the local IT guy. I'm at my wits end with this one though and I'd prefer it to be fixed instead of wiped out and rebuilt so I was looking for some help. Not sure what I've posted that would make us vulnerable but you're probably right. I guess I'll just have to end up rebuilding it.
#4
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi
#5
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
I'd love to have the help. I'll try and delete anything that is work related. Not sure if its against the rules or anything but we could also maybe do it via PM??? Sorry, I'm not much of a software or security guy and our security person is out of the office for 6-8 weeks.
#6
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi wbrumfiel
Quote:
Not sure if its against the rules or anything but we could also maybe do it via PM
That is frowned upon here Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.HJT log.
#7
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
Ok, Here is the Combofix logWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://DPHEMS68.DPHE.LOCAL:80 0 \0 ]0 \0 ]0 \0 ]0 \0 ]TCP "= 3389:TCP :@xpsp2res.dll,-22009http://www.gmer.net
#8
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
Sorry for the delay, I was having problems posting to the site, here is the HJT logSP3 (WinNT 5.01.2600)http://www.hp.com http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://update.microsoft.com/windowsu...?1175709720614
#9
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountp oints2\D]
Now post the Combofix log and let me know how things are.
#10
Member
Profile: Join Date: Aug 2008
Posts: 13
Computer Experience:
I'll have to run that on Monday when I get back to work. I did use a thumb drive on the machine to get the combofix and HJT programs copied to the PC because the PC was unable to get on the internet. What do I need to do to clean it? Can I put it in any PC or does it have to be this specific PC so as not to spread anything?
#11
Staff
Lifetime Subscription
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 3,848
Computer Experience:
Hi
also the logs could be to long to send via PM.