#1
Member
Profile: Join Date: Nov 2008
Posts: 2
Computer Experience:
[INACTIVE]Facebook virus gampass/infostealer HijackThis log attached
My wife answered a post from a supossed friend titled "there is a video of you on youtube getting lots of hits" The post had a link which went to a fake yuotube site, speeled like this. She was then prompted to download something. My computer is now infected awfull. Every think on the web sais this is the gampass infostealer virus. I tried to search for the file and cant find it. I also updated and ran a Norton Virus scan and it also dii not find it. I heard I should download HijackThis and run it and did. Please help me. RAM : 766 MB (38% free)SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://windowsupdate.microsoft.com/ http =127.0.0.1:9090http://edits.mywebsearch.com/toolbar...p=ZKxdm011YYUS http://ak.exe.imgfarm.com/images/noc...1.0.0.15-3.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab http://update.microsoft.com/windowsu...?1161648138587 https://webdl.symantec.com/activex/symdlmgr.cab http://mediaplayer.walmart.com/installer/install.cab HD ---- C:\Config.MsiHD ---- C:\WINDOWS\infHD ---- C:\Program Files\InstallShield Installation InformationHD ---- C:\WINDOWS\$hf_mig$HD ---- C:\Documents and Settings\Owner\Application Data\Move Networks
Didn't find the information you thought to find?Similar Threads
#2
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 906
Computer Experience:
Instructions posted for this user are customized for this user only. The tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a HJT log and start a new topic. SDFix Here Desktop SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:\SDFix) Safe Mode by doing the following Restart your computer
After hearing your computer beep once during startup, but before the Windows
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter .
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.cmd to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished , press any key to end the script and load
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the
Finally paste the contents of the SDFix Report.txt back on the forum with a new HijackThis log
Malwarebytes' Anti-Malware desktop Additional Link Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.Perform quick scan , then click Scan .Show Results to view the results.Be sure that everything is checked , and click Remove Selected .http://thespykiller.co.uk/index.php/topic,5946.0.html If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. SDFix report.txtHJT log You may need several replies to post the requested logs, otherwise they might get cut off .
#3
Member
Profile: Join Date: Nov 2008
Posts: 2
Computer Experience:
[ACTIVE]SDfix report.txt
I had to go on my work computer becuase for some reaon after I ran the SDfix I now cant get online. Do you know what would have caused this also? Thank you so much for your help.SDFix: Version 1.240 Checking Services :Name : Path :Checking Files : ADS Check :Final Check :http://www.gmer.net Remaining Services :Remaining Files :Files with Hidden Attributes :Finished!
#4
Malware Analyst
Profile: Join Date: Sep 2008
Posts: 906
Computer Experience:
Please make all replies to this topic and not start any new ones.Notepad , (Start > Run, type in: notepad ) copy and paste next present in the CODE box below in it: (don't forget to copy and paste REGEDIT4)
Code:
REGEDIT4
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\tinyproxy\\tinyproxy.exe"=- Save this as fix.reg and change the "Save as type " to "All Files " and place it on your desktop. It should look like this: http://i204.photobucket.com/albums/b.../regMiekie.png Yes " or "OK ". You should receive a message that it was successful. You may delete the file afterwardsNetwork and Internet Connections category , otherwise double click on Network Connections . Then right click Internet Protocol (TCP /IP ) item and select the radio dial that says "Obtain DNS servers automatically "Start , Run and type cmd and hit OKipconfig /flushdns ipconfig and / is needed)WinSockFix Here Here Backing up the Registry TCP Repair Utility screen, click "ReG-Backup"Resetting the Winsock Stack TCP Repair Utility screen, click "Fix".DHCP , you will need to reconfigure TCP /IP .Winsock Repair Tutorial Tutorial with graphics Malwarebytes' Anti-Malware desktop Additional Link Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.Perform quick scan , then click Scan .Show Results to view the results.Be sure that everything is checked , and click Remove Selected .http://thespykiller.co.uk/index.php/topic,5946.0.html If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Malwarebytes' Anti-Malware logHJT log You may need several replies to post the requested logs, otherwise they might get cut off .
All times are GMT +1. The time now is 22:47 .
