W32.Gammima.AG threat: please help thanks

apriljczm · Feb 28, 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:42:38, on 28/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Elantech\ktp.exe
C:\Program Files\Arcade\PCMService.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1204115208343
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 7443 bytes

Shaba · Feb 29, 2008

Hi apriljczm

Does Norton also have a firewall?

Which program finds that virus and where it is present according to it?

apriljczm · Feb 29, 2008

Hi Shaba,

I got this virus before i installed Norton. I am currently using Norton Firewall if i'm not wrong. And I did a scan using norton, it spotted this W32.Gammima.Ag virus in
my C:/Windows/System32 a file named 'kbd101.dll'.

Please guide me on how i would be able to remove this virus.
Thanks!

apriljczm · Feb 29, 2008

In addition, I have this virus also in my thumbdrive and some other files.

Norton also warned me of threat names ' Hacktool.Rootkit' and 'Infostealer.Gampass' in my System32.

Thanks.

Shaba · Feb 29, 2008

Hi

Then you should uninstall ZoneAlarm.

Please click this link-->Jotti

Copy/paste the first file on the list into the white Upload a file box and click Submit/Send (depends on which one you are using Jotti or VirusTotal).

C:\Windows\System32\kbd101.dll

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

apriljczm · Feb 29, 2008

Hi

I tried scanning the C:\WINDOWS\system32\kavo0.dll
(previously typed wrongly)
both Virustotal & jotti replied:
The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

And when i scanned it with norton, it said access denied, repair failed cause its auto-protected.

please advise. Thanks.

Shaba · Feb 29, 2008

Hi

You can try to disable Norton firewall during upload and scan and enable windows firewall.

Does that help?

apriljczm · Mar 1, 2008

Hi,

I stopped the firewal, but it still couldnt be scanned, the same message appeared.

Shaba · Mar 1, 2008

Hi

Let's try this then.

Download suspicious file packer from here

Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

C:\Windows\System32\kbd101.dll

Now try to upload that archive again, please.

apriljczm · Mar 2, 2008

Hi,

Sorry for the trouble.
I have uploaded the file as guided.

I did a reformat of my computer by myself. It seems that the computer is better.
Hopefully the virus has been deleted.

Thanks for the prompt reply.

Rgds

Shaba · Mar 2, 2008

Hi

If you re-formatted computer, all viruses are gone.

What I meant is that you are supposed to upload that .zip to jotti/virustotal, please

Post back also a fresh HijackThis log.

apriljczm · Mar 2, 2008

Hi,
sorry for my misread.

Here's the details from the joiit scan

File: requested-files[03_16_35].zip
Status: OK
MD5: 144dcc9f161561e24ccb7749a8c5bd1e
Packers detected: -
Bit9 reports: File not found

and my hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:14:00, on 02/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Elantech\ktp.exe
C:\Program Files\Arcade\PCMService.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\System32\svchost.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1204115208343
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 7423 bytes

Thanks alot for your help.

Shaba · Mar 2, 2008

Hi

Uninstall via add/remove programs

ZoneAlarm (if Norton has a firewall)
ZoneAlarm SpyBlocker (uninstall anyway)

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:

o Scan using the following Anti-Virus database:

+ Extended (If available otherwise Standard)

o Scan Options:

+ Scan Archives
+ Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

Note: This scanner will work with Internet Explorer Only!

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Post:

- a fresh HijackThis log
- kaspersky report

apriljczm · Mar 4, 2008

Hi,

this is my new hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:35:54, on 05/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Elantech\ktp.exe
C:\Program Files\Arcade\PCMService.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Acer\eRecovery\Monitor.exe
C:\WINDOWS\System32\svchost.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wuauclt.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Arcade\PCMService.exe"
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Program Files\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunOnce: [ZoneAlarmSB Uninstall] rundll32 C:\PROGRA~1\UNINST~1.DLL,O -3
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1204115208343
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe

--
End of file - 7901 bytes

apriljczm · Mar 5, 2008

And this is my scan report
thanks alot!!

KASPERSKY ONLINE SCANNER REPORT
Wednesday, March 05, 2008 7:33:47 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/03/2008
Kaspersky Anti-Virus database records: 595714
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 41933
Number of viruses found: 18
Number of infected objects: 93
Number of suspicious objects: 0
Duration of the scan process: 00:45:58

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\Temp\ZLT0643c.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT07df9.TMP Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{FE4CF536-E851-4CB6-A87E-764680F60BD6}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5D8C834D-2B65-48CB-B1C6-57E6F4783917}.bin Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\Internet Logs\MIN.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-03-04_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\min\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\min\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\min\Local Settings\Temp\~DFCAEC.tmp Object is locked skipped
C:\Documents and Settings\min\Local Settings\Temp\~DFCB11.tmp Object is locked skipped
C:\Documents and Settings\min\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\min\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\min\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\min\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\min\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\min\Cookies\index.dat Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPStop.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Quarantine\3767410F.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped
C:\Program Files\Norton AntiVirus\Quarantine\37B206BD.exe Infected: Worm.Win32.AutoRun.clt skipped
C:\Program Files\Norton AntiVirus\Quarantine\37B530B9.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped
C:\Program Files\Norton AntiVirus\Quarantine\37B95AB5.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped
C:\Program Files\Norton AntiVirus\Quarantine\3825443F.exe Infected: Trojan-PSW.Win32.OnLineGames.pvp skipped
C:\Program Files\Norton AntiVirus\Quarantine\025138DF.EXE Infected: Virus.Win32.VB.bu skipped
C:\Program Files\Norton AntiVirus\Quarantine\5555283D.exe Infected: Worm.Win32.Agent.av skipped
C:\Program Files\Norton AntiVirus\Quarantine\025138DF.bat Infected: Worm.Win32.AutoRun.cjo skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000614.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000615.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000618.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000801.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000802.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000805.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP7\A0000865.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP7\A0000911.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP9\A0000946.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0000957.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0001045.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0001150.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0001151.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0001161.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP11\A0001177.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001198.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001215.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001216.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001237.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP13\A0001241.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP13\A0001245.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001252.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001257.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001276.DLL Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001279.DLL Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001282.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP15\A0001414.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP15\A0001417.DLL Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP15\A0001421.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP15\A0001428.EXE Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0001517.DLL Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0001784.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0001811.dll Infected: Trojan-PSW.Win32.OnLineGames.run skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002045.exe Infected: Trojan-PSW.Win32.OnLineGames.qii skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002046.com Infected: Worm.Win32.AutoRun.bsy skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002047.com Infected: Trojan-PSW.Win32.OnLineGames.nkc skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002048.bat Infected: Worm.Win32.AutoRun.cpr skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002049.bat Infected: Worm.Win32.AutoRun.cpr skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002050.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002051.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002052.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002053.dll Infected: Trojan-PSW.Win32.OnLineGames.ruj skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002054.com Infected: Trojan-PSW.Win32.OnLineGames.prs skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002055.com Infected: Trojan-PSW.Win32.OnLineGames.prs skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002056.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002057.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002058.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002059.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002060.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002061.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002062.bat Infected: Worm.Win32.AutoRun.cjo skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002063.bat Infected: Worm.Win32.AutoRun.cjo skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002064.com Infected: Trojan-PSW.Win32.OnLineGames.mkp skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002065.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002066.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002067.exe Infected: Worm.Win32.AutoRun.clt skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002068.exe Infected: Worm.Win32.AutoRun.clt skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002069.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0002070.exe Infected: Trojan-PSW.Win32.OnLineGames.pvp skipped
C:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP20\change.log Object is locked skipped

apriljczm · Mar 5, 2008

continuation of virus scan report ...

D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000358.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000620.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP6\A0000807.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP7\A0000867.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP9\A0000948.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0000959.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP10\A0001163.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP11\A0001179.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001200.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP12\A0001239.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP13\A0001243.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001254.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001284.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001355.com Infected: Trojan-PSW.Win32.OnLineGames.prs skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001356.bat Infected: Trojan-PSW.Win32.OnLineGames.qix skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001357.bat Infected: Worm.Win32.AutoRun.cjo skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001358.com Infected: Worm.Win32.AutoRun.bsy skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001359.exe Infected: Worm.Win32.AutoRun.clt skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001360.bat Infected: Trojan-PSW.Win32.OnLineGames.rad skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001361.bat Infected: Trojan-PSW.Win32.OnLineGames.rey skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001362.exe Infected: Trojan-PSW.Win32.OnLineGames.pvp skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001363.exe Infected: Trojan-PSW.Win32.OnLineGames.qii skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001364.com Infected: Trojan-PSW.Win32.OnLineGames.rhc skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP14\A0001365.bat Infected: Worm.Win32.AutoRun.cpr skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP15\A0001423.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped
D:\System Volume Information\_restore{8C8D5AE3-6CDE-456D-AD78-6FEA199CF53C}\RP16\A0001528.exe Infected: Trojan-PSW.Win32.OnLineGames.rui skipped

Scan process completed.

Shaba · Mar 5, 2008

Hi

Empty this folder:

C:\Program Files\Norton AntiVirus\Quarantine\

Empty Recycle Bin.

All other viruses are in system restore and inactive.

I give you later instructions how to empty it.

Other than that, any problems left?

apriljczm · Mar 5, 2008

Hi,

thanks for the reply.

I've emptied the norton bin.

Other then these... the computer seems alright at the moment.

Thanks

Shaba · Mar 5, 2008

Hi

Then you're clean!

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Update Adobe Reader
It looks like your version of Adobe Reader is out of date and you're vulnerable for infections.
Please download the newest version here:
http://www.adobe.com/products/acrob...used=0&esdcanhandle=0&hasjavascript=1&dlm=nos

Install it, then go to Add/Remove Programs and remove any older versions that may remain.

Next we remove all used tools.

Please download OTMoveIt2 and save it to desktop.

Double-click OTMoveIt2.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTMoveIt2 attempting to contact the internet, please allow it to do so.

Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above

Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:

Instructions for Spybot S & D
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety

MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar <= Get the free google toolbar to help stop pop up windows.
Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software

Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean! :bigthumb:

apriljczm · Mar 5, 2008

Wow...
ok i'll get back to u if i'm stuck somewhere.
Meanwhile thanks alot again!!!!

Regards =)

W32.Gammima.AG threat: please help thanks

New member

Security Expert: Emeritus

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member