#1
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
Maybe anti virus xp2008 infection
Hi all, the wife has managed to download something pretty nasty and i am now getting pop ups galore the desktop has gone white and items have been removed from start up menu.HJT log is the first step so here is the results i got.SP3 (WinNT 5.01.2600)http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 IDE Setup] C:\WINDOWS\JM\JMInsIDE.exehttp://upload.facebook.com/controls/...oUploader5.cab http://download.tvants.com/pub/tvant...cab/tvants.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://www.update.microsoft.com/wind...?1216061211562 http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab http://www.ooxtv.com/stream.ocx http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab https://signin2.valueactive.com/Regi...18/flashax.cab
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
I may be charging in here but after reading a similar post on here i took the liberty of running combofix then HJT and will post the results nowWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://hqsextube08.com IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 13:44 36864]http://www.gmer.net
#3
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
Nd here is the HJT log file, doing this has restored my desktop and has far less pop ups so i then ran atf cleaner the tried to run anm online kaspersky scan but i get the error, java applet cannot be loaded try again online.SP3 (WinNT 5.01.2600)http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 IDE Setup] C:\WINDOWS\JM\JMInsIDE.exehttp://upload.facebook.com/controls/...oUploader5.cab http://download.tvants.com/pub/tvant...cab/tvants.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://www.update.microsoft.com/wind...?1216061211562 http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab http://www.ooxtv.com/stream.ocx http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab https://signin2.valueactive.com/Regi...18/flashax.cab
#4
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
Ok got a web scan to run here is the results
#5
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi TechnicPreview-T-3545425-closer stonebridge remix.mp3 <<AdWare P2P software ( Limewire , BitTorrent uTorrent Azureus , etc… ). We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , here and here .I would strongly recommend that you uninstall them, Note: Now do this. contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
C:\Program Files\KB55771.exe
C:\WINDOWS\kx43632.dll
C:\WINDOWS\wxml19418.dll
C:\WINDOWS\emtb.exe
C:\WINDOWS\tqwolser.exe
C:\WINDOWS\system32\nvModes.dat
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{400D5264-3D1D-398C-9DB6-95167DBA60EE}] Now this. here or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log.
#6
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
Hi there and thanks for the reply.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 13:44 36864]http://www.gmer.net
#7
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
And now the malwarebytes log
#8
Member
Profile: Join Date: Aug 2008
Posts: 7
Computer Experience:
And the HJT logSP3 (WinNT 5.01.2600)www.google.co.uk http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 IDE Setup] C:\WINDOWS\JM\JMInsIDE.exehttp://upload.facebook.com/controls/...oUploader5.cab http://www.kaspersky.nl/scanforvirus...an_unicode.cab http://acs.pandasoftware.com/actives.../as2stubie.cab http://download.tvants.com/pub/tvant...cab/tvants.cab https://moneymanager.egg.com/Pinsafe...nttracking.cab http://www.update.microsoft.com/wind...?1216061211562 http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab http://www.ooxtv.com/stream.ocx http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab https://signin2.valueactive.com/Regi...18/flashax.cab
#9
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing the infected files there as well.
All times are GMT +1. The time now is 02:22 .
