userintrouble
2007-08-25, 16:20
I have this on my other pc :(
Symantec online found this:
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356 is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab is infected with Downloader
C:\Archivos de programa\Passware\ariskkey.dll is infected with Ariskkey
C:\Archivos de programa\Passware\ariskkey.exe is infected with Ariskkey
I don't think Ariskey is virus, I use it to remember my own paswords to reveal asterisks...
But I deleted and unistalled java, that was infected. That seems to be clean now.
KASPERSKY ONLINE SCANNER REPORT
Thursday, August 23, 2007 7:02:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 23/08/2007
Kaspersky Anti-Virus database records: 388371
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Folders:
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\
Scan Statistics:
Total number of scanned objects: 7518
Number of viruses found: 1
Number of infected objects: 24
Number of suspicious objects: 0
Duration of the scan process: 00:02:35
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356 ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip ZIP: infected - 3 skipped
Scan process completed.
Now I can't scan with trend antispyware (quits). Spybot says there is nothing.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:45 a.m., on 25/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Avast4\aswUpdSv.exe
C:\Archivos de programa\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Acronis\Schedule2\schedul2.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\LckFldService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\ARCHIV~1\Avast4\ashDisp.exe
C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
C:\Archivos de programa\SlickRun\sr.exe
C:\Archivos de programa\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\IE New Window Maximizer\iemaximizer.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Aladdin Systems\DragStrip\DragStrip.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Archivos de programa\Avast4\ashMaiSv.exe
C:\Archivos de programa\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Siber Systems\AI RoboForm\Passcards.exe
C:\DOCUME~1\Zero\CONFIG~1\Temp\OnlineScanner\Anti-Virus\fsgk32.exe
C:\DOCUME~1\Zero\CONFIG~1\Temp\OnlineScanner\Anti-Virus\fssm32.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {30C4957C-A15E-48E2-99ED-7623B8EF4182} - (no file)
O2 - BHO: (no name) - {3C84954D-23A1-4D71-9185-6BE2BB312C24} - (no file)
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {626636D0-04B8-4241-84B5-8A6BC3F03501} - (no file)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: Bridge Class - {E479EDE1-923E-11D3-B82B-00E09871521B} - C:\Archivos de programa\Compass\CmpsIE.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
O4 - HKCU\..\Run: [SlickRun] "C:\Archivos de programa\SlickRun\sr.exe"
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Archivos de programa\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IE New Window Maximizer] C:\Archivos de programa\IE New Window Maximizer\iemaximizer.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk.disabled
O4 - Global Startup: DragStrip.lnk = C:\Archivos de programa\Aladdin Systems\DragStrip\DragStrip.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Archivos de programa\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &Copy Location - C:\WINDOWS\WEB\graburl.htm
O8 - Extra context menu item: &Document Tree - C:\WINDOWS\web\tree.htm
O8 - Extra context menu item: Abrir enlace destino en Firefox - file://C:\Documents and Settings\Zero\Datos de programa\Mozilla\Firefox\Profiles\al4mei1l.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: AccountLogon - C:\WINDOWS\al-popup-zero.html
O8 - Extra context menu item: Advanced Email Extractor - res://C:\Archivos%20de%20programa\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html
O8 - Extra context menu item: Download &All by FD - file://C:\Archivos de programa\FreshDevices\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download with &FD - file://C:\Archivos de programa\FreshDevices\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagea...en/preview.html
O8 - Extra context menu item: Identities Editor - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
O8 - Extra context menu item: Logoff - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComLogoff.html
O8 - Extra context menu item: Save Forms - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Scan link with AEE - res://C:\Archivos%20de%20programa\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Ver esta pagina en Firefox - file://C:\Documents and Settings\Zero\Datos de programa\Mozilla\Firefox\Profiles\al4mei1l.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O8 - Extra context menu item: View Partial So&urce - C:\WINDOWS\web\source.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: AccountLogon - {1CB13C88-96B6-11d6-9AF5-D12D26EE1F36} - C:\WINDOWS\al-popup-zero.html (HKCU)
O9 - Extra 'Tools' menuitem: AccountLogon - {1CB13C88-96B6-11d6-9AF5-D12D26EE1F36} - C:\WINDOWS\al-popup-zero.html (HKCU)
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Archivos de programa\Flash utils\Flash Saving Plugin\FlashSButton.dll (HKCU)
O16 - DPF: Yahoo! Chat -
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} -
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} -
O16 - DPF: {2882C368-D508-11D4-A2AB-000102598CE4} (LProtect Control) - http://download.globalhauri.com/Eng/online...ce/livecall.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {342999A3-728D-4DF6-BB81-CDD1A743096A} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Archivos de programa\Archivos comunes\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Archivos de programa\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Archivos de programa\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Archivos de programa\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Archivos de programa\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Archivos de programa\Archivos comunes\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
--
End of file - 11963 bytes
Symantec online found this:
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356 is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a is infected with Downloader
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab is infected with Downloader
C:\Archivos de programa\Passware\ariskkey.dll is infected with Ariskkey
C:\Archivos de programa\Passware\ariskkey.exe is infected with Ariskkey
I don't think Ariskey is virus, I use it to remember my own paswords to reveal asterisks...
But I deleted and unistalled java, that was infected. That seems to be clean now.
KASPERSKY ONLINE SCANNER REPORT
Thursday, August 23, 2007 7:02:46 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.0
Kaspersky Anti-Virus database last update: 23/08/2007
Kaspersky Anti-Virus database records: 388371
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Folders:
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\
Scan Statistics:
Total number of scanned objects: 7518
Number of viruses found: 1
Number of infected objects: 24
Number of suspicious objects: 0
Duration of the scan process: 00:02:35
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-4406ec9a ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\20\7328ad54-467534ab ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-5e121356 ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\6.0\49\348259f1-65970c9e ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\crtdcghcn.jar-2a1ae695-16fe24b0.zip ZIP: infected - 3 skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/BaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/VaaaaaaaBaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip/Baaaaa.class Infected: Trojan.Java.ClassLoader.ao skipped
C:\Documents and Settings\Zero\Datos de programa\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms-counter.jar-4535331c-5079cac7.zip ZIP: infected - 3 skipped
Scan process completed.
Now I can't scan with trend antispyware (quits). Spybot says there is nothing.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:45 a.m., on 25/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Avast4\aswUpdSv.exe
C:\Archivos de programa\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Acronis\Schedule2\schedul2.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\LckFldService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\ARCHIV~1\Avast4\ashDisp.exe
C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
C:\Archivos de programa\SlickRun\sr.exe
C:\Archivos de programa\Cactus Spam Filter 2.13\cactusspamfilter.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\IE New Window Maximizer\iemaximizer.exe
C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
C:\Archivos de programa\Aladdin Systems\DragStrip\DragStrip.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Archivos de programa\Avast4\ashMaiSv.exe
C:\Archivos de programa\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Siber Systems\AI RoboForm\Passcards.exe
C:\DOCUME~1\Zero\CONFIG~1\Temp\OnlineScanner\Anti-Virus\fsgk32.exe
C:\DOCUME~1\Zero\CONFIG~1\Temp\OnlineScanner\Anti-Virus\fssm32.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O2 - BHO: (no name) - {30C4957C-A15E-48E2-99ED-7623B8EF4182} - (no file)
O2 - BHO: (no name) - {3C84954D-23A1-4D71-9185-6BE2BB312C24} - (no file)
O2 - BHO: (no name) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {626636D0-04B8-4241-84B5-8A6BC3F03501} - (no file)
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos de programa\google\googletoolbar1.dll
O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - (no file)
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O2 - BHO: Bridge Class - {E479EDE1-923E-11D3-B82B-00E09871521B} - C:\Archivos de programa\Compass\CmpsIE.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar1.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
O4 - HKCU\..\Run: [SlickRun] "C:\Archivos de programa\SlickRun\sr.exe"
O4 - HKCU\..\Run: [com.codeode.cactusspamfilter] "C:\Archivos de programa\Cactus Spam Filter 2.13\cactusspamfilter.exe" -minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IE New Window Maximizer] C:\Archivos de programa\IE New Window Maximizer\iemaximizer.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: SpywareGuard.lnk.disabled
O4 - Global Startup: DragStrip.lnk = C:\Archivos de programa\Aladdin Systems\DragStrip\DragStrip.exe
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Trend Micro Anti-Spyware.lnk = C:\Archivos de programa\Trend Micro\Tmas\Tmas.exe
O8 - Extra context menu item: &Copy Location - C:\WINDOWS\WEB\graburl.htm
O8 - Extra context menu item: &Document Tree - C:\WINDOWS\web\tree.htm
O8 - Extra context menu item: Abrir enlace destino en Firefox - file://C:\Documents and Settings\Zero\Datos de programa\Mozilla\Firefox\Profiles\al4mei1l.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewlink.html
O8 - Extra context menu item: AccountLogon - C:\WINDOWS\al-popup-zero.html
O8 - Extra context menu item: Advanced Email Extractor - res://C:\Archivos%20de%20programa\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/page.html
O8 - Extra context menu item: Download &All by FD - file://C:\Archivos de programa\FreshDevices\FreshDownload\fdiectx2.htm
O8 - Extra context menu item: Download with &FD - file://C:\Archivos de programa\FreshDevices\FreshDownload\fdiectx.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagea...en/preview.html
O8 - Extra context menu item: Identities Editor - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComEditIdent.html
O8 - Extra context menu item: Logoff - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComLogoff.html
O8 - Extra context menu item: Save Forms - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Scan link with AEE - res://C:\Archivos%20de%20programa\Advanced%20Email%20Extractor%20PRO\AeePMsie.dll/link.html
O8 - Extra context menu item: Sothink SWF Catcher - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O8 - Extra context menu item: Ver esta pagina en Firefox - file://C:\Documents and Settings\Zero\Datos de programa\Mozilla\Firefox\Profiles\al4mei1l.default\extensions\{5D558C43-550F-4b12-84AB-0D8ABDA9F975}\firefoxviewpage.html
O8 - Extra context menu item: View Partial So&urce - C:\WINDOWS\web\source.htm
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Archivos de programa\Archivos comunes\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: AccountLogon - {1CB13C88-96B6-11d6-9AF5-D12D26EE1F36} - C:\WINDOWS\al-popup-zero.html (HKCU)
O9 - Extra 'Tools' menuitem: AccountLogon - {1CB13C88-96B6-11d6-9AF5-D12D26EE1F36} - C:\WINDOWS\al-popup-zero.html (HKCU)
O9 - Extra button: Flash - {43CF38F3-5AEC-45a3-AD31-04EB06E9C6CA} - C:\Archivos de programa\Flash utils\Flash Saving Plugin\FlashSButton.dll (HKCU)
O16 - DPF: Yahoo! Chat -
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} -
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} -
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} -
O16 - DPF: {2882C368-D508-11D4-A2AB-000102598CE4} (LProtect Control) - http://download.globalhauri.com/Eng/online...ce/livecall.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} -
O16 - DPF: {342999A3-728D-4DF6-BB81-CDD1A743096A} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} -
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} -
O16 - DPF: {CAFEEFAC-0014-0002-0004-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Archivos de programa\Archivos comunes\Acronis\Schedule2\schedul2.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Archivos de programa\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Archivos de programa\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Archivos de programa\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Archivos de programa\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Archivos de programa\Archivos comunes\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Archivos de programa\Archivos comunes\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
--
End of file - 11963 bytes