Attn: Noahdfear

This one is for you! RAV scan

Johanna
Scan started at 11/20/2004 5:04:05 PM

Scanning memory...
Scanning boot sectors...
Scanning files...
C:\hooks.dll - Trojan:Win32/Small.BT -> Infected
C:\ldr.exe - TrojanDropper:Win32/Small.MF -> Infected
C:\Documents and Settings\Lydia\Local Settings\Temporary Internet Files\Content.IE5\257SPGVA\emCraft1[1].cab->ATPartners.dll - TrojanDownloader:Win32/Rameh.C -> Infected
C:\Documents and Settings\Lynn Koenig\Local Settings\Temporary Internet Files\Content.IE5\43GTOJEP\loader[1].exe - Trojan:Win32/SecondThought.Q -> Infected
C:\Documents and Settings\Sue Koenig\Application Data\nrrt.exe - TrojanDownloader:Win32/PurityScan.O -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temp\cehd.dat->(UPXW)->(RARSfx)->ldr.exe - TrojanDropper:Win32/Small.MF -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temp\cehd.dat->(UPXW)->(RARSfx)->dl11.exe - ToolornDialer.BP -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temp\temp.fr2F4E - TrojanDownloader:Win32/Agent.Z -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temp\temp.fr8890 - TrojanDownloader:Win32/Agent.Z -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\43XF2239\main[1].chm->/main.htm->(EncScript) - JS/Psyme.F* -> Suspicious
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\43XF2239\main[1].chm->/main.htm->(SCRIPT0000)->(EncScript) - JS/Psyme.F* -> Suspicious
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\I5TU3YPO\classload[1].jar->GetAccess.class - Trojan:Java/ClassLoader -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\I5TU3YPO\classload[1].jar->InsecureClassLoader.class - Java/Bytverify -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\I5TU3YPO\classload[1].jar->Installer.class - TrojanDownloader:Java/OpenConnection.F -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\QDCJU565\classload[1].jar->GetAccess.class - Trojan:Java/ClassLoader -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\QDCJU565\classload[1].jar->InsecureClassLoader.class - Java/Bytverify -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\QDCJU565\classload[1].jar->Installer.class - TrojanDownloader:Java/OpenConnection.F -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\W98PM3SP\ne2[1].chm->/index.html->(OBJECT0000) - HTML/CodeBaseExec* -> Infected
C:\Documents and Settings\Sue Koenig\Local Settings\Temporary Internet Files\Content.IE5\WJ1RUYZD\f11111[1].hta->(SCRIPT0001) - VBS/Inor.V.gen* -> Infected
C:\Program Files\Internet Explorer\ffbfsqfk.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\Internet Explorer\jijgdjrm.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\Internet Explorer\jqoukyrq.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\Internet Explorer\jrvnxotj.exe - TrojanDownloader:Win32/Petrolin.A -> Suspicious
C:\Program Files\Internet Explorer\ljxrcsec.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\Internet Explorer\rgqmnqrt.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\Internet Explorer\ubdbbhgh.exe - TrojanDownloader:Win32/Petrolin.B -> Suspicious
C:\Program Files\shockwave.com\Jigsaw Puzzles - Pets!\Jigsaw Puzzles - Pets!.exe - Backdoor:Win32/Khazana.A -> Infected
C:\Program Files\shockwave.com\Jigsaw Puzzles - Pets!\product\Jigsaw Puzzles - Pets!.exe - Backdoor:Win32/Khazana.A -> Infected
C:\WINDOWS\37186301.exe->ADS:wqxxe - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\37186301.exe->ADS:gjuov - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\ACCWIZ.INI->ADS:lrmop - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\ADGEJHGO.ini->ADS:wvpij - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\appcc.exe - TrojanDownloader:Win32/Agent.Z -> Infected
C:\WINDOWS\atlfm32.exe - TrojanDownloader:Win32/Agent.Z -> Infected
C:\WINDOWS\atlfm32.exe.bak - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Blue Lace 16.bmp->ADS:tjjzv - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\Blue Lace 16.bmp->ADS:tcgmh - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\Blue Lace 16.bmp->ADS:fjhbh - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\bootstat.dat->ADS:mqbwe - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\bqlcl.dll - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\CMISETUP.INI->ADSqsca - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\CMISETUP.INI->ADS:mkmts - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\cmsetacl.log->ADS:kajpo - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\comsetup.log->ADS:gzhab - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\comsetup.log->ADS:flfgu - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Directx.log->ADS:mqwgd - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\dmwqh.dll - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\DtcInstall.log->ADS:sjysi - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\FaxSetup.log->ADS:kjnhm - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\FeatherTexture.bmp->ADS:hnppf - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Greenstone.bmp->ADS:fyoqt - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Greenstone.bmp->ADS:fkhdu - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Greenstone.bmp->ADS:avagz - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\hpoins01.dat->ADS:xlzjw - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\hpoins01.dat->ADS:uczdy - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\hpoins01.dat->ADS:solmt - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\hpoins01.dat.temp->ADS:xlzjw - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\hpomdl01.dat.temp->ADSktcu - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\hpomdl01.dat.temp->ADS:edris - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\ippl.dll - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\KB823980.log->ADS:szqrn - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\KB823980.log->ADS:iygzr - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\KB834707.log->ADS:byzel - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\KB885884.log->ADS:hhfzc - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\MININU.LOG->ADS:tqxqr - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\msdfmap.ini->ADS:mridu - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\netid32.exe - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\ntbtlog.txt->ADS:fdsth - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\ntdtcsetup.log->ADS:dqrsk - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\ntdtcsetup.log->ADS:cwtxr - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\ocmsn.log->ADS:ympam - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\ODBC.INI->ADS:wqbfm - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\ODBC.INI->ADS:bqtxy - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\ODBC.INI->ADS:alsxt - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\Q322011.log->ADS:clxxn - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Q322011.log->ADS:bjyrz - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\Q323255.log->ADS:hknqi - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Q328310.log->ADS:ryzrd - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Q329048.log->ADS:gkqxz - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\Q329115.log->ADS:nckzx - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Q329170.log->ADS:ytaqt - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Q329390.log->ADS:jyrxx - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Q329441.log->ADS:fdces - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Q329834.log->ADS:rttvn - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Q810577.log->ADS:tyzck - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Q811630.log->ADS:cadna - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\Q814995.log->ADS:nolzv - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\Q814995.log->ADS:mrnlv - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\Q815485.log->ADS:uljes - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\QDQICK.INI->ADS:ufrsh - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\QDQICK.INI->ADS:jnreg - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\QDQICK.INI->ADS:jfgmr - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\QDQICK.INI->ADS:esgqp - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\QFNOA.INI->ADS:idfgv - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\QFNOAD16.DAT->ADScqfk - TrojanDownloader:Win32/WinShow.AK -> Infected
C:\WINDOWS\QFNOAD16.DAT->ADS:mecjm - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\QfnOnl.ini->ADS:uyqsl - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\QfnOnl.ini->ADS:uhjve - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\QfnOnl.ini->ADS:mgcxc - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\QfnOnl.ini->ADS:bokji - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\regopt.log->ADS:tzcon - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\regopt.log->ADS:jfkes - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\River Sumida.bmp->ADS:eavbq - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Santa Fe Stucco.bmp->ADS:lnrbq - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\sdkny.dll - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\sdksk32.exe - TrojanDownloader:Win32/Agent.Z -> Infected
C:\WINDOWS\sessmgr.setup.log->ADS:zwcnd - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\sessmgr.setup.log->ADS:egkgs - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\spuninst.log->ADS:mloql - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\system.ini->ADS:flyvn - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\tsc.ptn->ADS:ugdir - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\tsoc.log->ADS:cmxns - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\twain.dll->ADS:mhnnt - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\twunk_16.exe->ADS:nvgub - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\vldku.dll - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\WindowsShell.Manifest->ADS:wtrmg - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\WindowsUpdate.log->ADS:turhm - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\WMSysPr9.prx->ADS:vxoys - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\WMSysPr9.prx->ADS:kpbsm - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\xpsp1hfm.log->ADS:qfcjt - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\xpsp1hfm.log->ADS:nyhdu - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\Zapotec.bmp->ADS:lhuve - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\_default.pif->ADS:dbjnk - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\_detmp.1->ADS:daeag - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\pss\winlgn.exeCommon Startup - Trojan:Win32/StartPage.AI -> Infected
C:\WINDOWS\system32\addor.exe - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\system32\atldc32.dll - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\system32\crdj32.dll - TrojanDownloader:Win32/Agent -> Infected
C:\WINDOWS\system32\cree.exe - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\system32\crrk32.exe - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\system32\crrq.exe - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\system32\doriot.exe - TrojanDropper:Win32/Small.KY -> Infected
C:\WINDOWS\system32\ifaxx.dll - TrojanDownloader:Win32/WinShow.AK -> Suspicious
C:\WINDOWS\system32\scvhosting.exe - Win32/HLLW.Forbot.U -> Infected
C:\WINDOWS\system32\sysap32.exe - TrojanDownloader:Win32/Agent.Z -> Infected
C:\WINDOWS\system32\sysnq.dll - Trojan:Win32/Agent.BQ -> Infected
C:\WINDOWS\system32\sysyg.exe - TrojanDownloader:Win32/Agent.CD -> Infected
C:\WINDOWS\system32\windll.exeopen - Win32/Bagle.AN@mm -> Infected
C:\WINDOWS\system32\windll.exeopenopen - Win32/Bagle.AN@mm -> Infected
C:\WINDOWS\system32\wwnrot.exe - TrojanDropper:Win32/Small.KT -> Infected

Scanned
============================
Objects: 45565
Directories: 2611
Archives: 1260
Size(Kb): 981760
Infected files: 117

Found
============================
Viruses found: 22
Suspicious files: 23
Disinfected files: 0
Mail files: 813

 

Hehehe .......... Goodbye Sue Koenig. Sure makes one wonder, huh? My all time best was a 13 year old that had 5,000+ infected files on XP Home - Used to know the exact number and may still have it archived but it looks like Sue plays second fiddle to no one.

 

LOL! Is this for real? I just LOVE a challenge!!

Start with disabling system restore, booting to safe mode, on the Admin account and empty all of the temp folders, prefetch folder and recycle bin. Then run scans with Panda, Housecall and eTrust, allowing them to clean what they will. Download and run TrojanHunter, A² and Stinger. We'll take it from there when done.

 

I'd bet Johanna is sitting back giggling at an image of me droolin over getting my hands on a comp like that, and she had the XP cd in hand before even posting that log. Johanna, you're either after my heart or really enjoy teasing me.

Had one a while back with almost 1000 infected files. It was pretty easy though. The same 14 files copied themselves to every directory with the word share in it's name, and were easily removed with an updated AV scan.

 

This is the lady who told me "About:Blank" for a homepage was just an extra click...all her business records are on there. Had to boot into safe mode just to run that scan. You are right, as soon as she finds her XP cd, that comp is getting WIPED.

Johanna

 

Could a Virus also travel from machine to machine via SHARED folders, files ?

1- If the other machines were actuall on at the time of the invasion ?

2- Or would it just wait till the other machine actually accesed the corrupted files/folders ?

I have however DISABLED ALL of the Stuff ( My Docs and such ) the XP sets up as shared by default. I did this mainly because I found that some Teenager had gotten into The shared folders on my machine and copied some stuff to the other machine.

The Virus question came up after reading this post.

BillyBob

 

It reads like I left an important item.

I am referring to machines that are on a Local Area Network.

BB

 

These were my suggestions:
Get a USB backup for the business data
Password protect the computer from teenagers
Install 3rd party firewall
Let me try to get the data off, then wipe clean.

This is what she decided:
Wants me to pick out a new computer, ship it to my house so I can "tweak" it
Wipe old comp and give it to her teenagers
said to put whatever firewall I wanted to on


Old computer is a home built T-Bird by some guy who is now in jail. She has no idea where her XP & Office disks are, or if she ever had them. The computer had to be booted to safe mode to stay on task, and the Windows Firewall would not turn on (error message) Norton AV was disabled, as well as Spybot. She kept getting as ad for a rogue "Spyware Remover" program at boot. Using MSConfig, I stopped about 35 processes from loading at boot (basically, anything I didn't recognize!) Dumped TIFs, SR points, etc, rebooted into safe mode w/ networking and ran the scan, deep sigh an hour later.... I have no idea which bad guy took out what, and don't care to go line by line in the registry. Think I'll swap out her hard drive with a comparable one, and send hers to Dave so that he can infect himself until his heart is content. (Some people have hobbies, Dave, like crossword puzzles or horseback riding...you have an OBSESSION!)

I asked her what she was looking for in a new computer...she said "Well, you know what I do, just get me a good one!" and gave me a price range guaranteed to get her what she needs. She also gave me her Visa, so we are ready to roll. I asked her to look for her cds today, and I'll come get the computer tomorrow, after she verifies with her accountant what date his data is current to. I will probably try to use my computer to save whatever stuff I can, but if it were my computer, I'd accept the loss as the cost of the risk. No active security, no back ups, teenagers...bad bad bad... I wouldn't WANT that data back! Even Word couldn't open a new doc, yesterday- that's the only time I saw Norton active, when it lit up "Malicious Code Detected!" What are the odds Quickbooks is affected, too? Does that software have any built in corruption protection? For her sake, I hope so.

I got called when the computer would no longer stay on task (freezes, "system recovered from serious error" messages, reboots, programs shutting down unexpectedly etc.) If she would have let me fix "About:Blank" a couple of weeks ago, maybe this wouldn't have gotten so out of hand. The last time I was there, she was online, but couldn't get IE to work, and was calling, desperate for her Yahoo email. The local ISP said thewy weren't coming out again, since she was online, and gave her my name. Thanks, guys! These are the same techs that broke my website this week trying to switch over to an Apache server they kow NOTHING about. But, that's another story for another day...off to "shop" for her, online, with a hot cup of coffee,and all the kids gone for the day. Does life get any sweeter?

Johanna

 

By all means, yes it can and will. As a matter of fact, the one I referred to actually infected every folder, as stated above, with the word share in it's name, across 8 partitions on 2 hard drives. Only two of those partitions had operating systems, the rest being data storage. Had the comp been connected to a network, there is no doubt in my mind that it would have spread also to the other machines. Many viruses are passed back and forth among networked comps, which makes it often necessary to remove all PCs from the network and clean each one before reconnecting.

Johanna,

I'll be anxiously awaiting the UPS truck.

 

noahdfear

Thank you.

I am now happier than ever that I disabled ALL sharing on this PC. No make that THESE PCs.

I have an unhappy Teenager ( niece from next door ) but that is tuff cookies for her. Her Mother stepped in and came VERY close to getting her Kids ( 3 of them ) off of my PCs ( they only get to use 2 ) for a week.

I just can't seem to make them understand that these are my PCs and I am 100% responsible.

I do have some things on here that need to go back to one of the other PCs. But when I get a chance I will Virus check all machine. Enable sharing on the proper folders. Move things around and then DISABLE sharing again.

Thank you again.
BillyBob

 

Good strategy BB.

 

BB,
I know you know this, but for others in the same situation (that teenager thing!) make sure you give them limited accounts, with no administrator privileges. If they do make an error in judgment, and something sneaks past your regular security, it is less likely to do any serious damage because the account has no authorization to "do" anything. You set parameters in Control Panel, User Accounts in XP.

Johanna