please help me off from: trojan-downloader.BAT.ftp.ab

[chavezz]

Hi

well fesrt i wld be very thankfull if u guys can help me out of this problem.

i run Kaspersky av and since a week it detected a trojan it deleted but when i restarted my pc again it comes back and also if i deleted and i still work on my pc for a view houres it detected again the same trojan.

i fellowed the steps here on this forum and i did the fellowing steps:

- i downloaded spybot S&D and scanned my pc 2x. ferst time it detected 22 spywares and addwares, seconde time it was clean.

- i scanned my pc with online panda av i foun 22 spywares (see panada av log info bellow)

- i downloaded Hijackthis and scanned my pc with it (see hijacklog info bellow)



Panda anti virus online scan log 28-06-2006:
Incident Status Location

Adware:adware/aureate-radiate Not disinfected Windows Registry
Adware:adware/fastlook Not disinfected Windows Registry
Spyware:spyware/cws.olehelp Not disinfected Windows Registry
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.adtech.de/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/HotLog Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.hotlog.ru/]
Spyware:Cookie/MetriWeb Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.metriweb.be/]
Spyware:Cookie/SpyLog Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.spylog.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[fe.lea.lycos.fr/]
Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[fl01.ct2.comclick.com/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[server.iad.liveperson.net/]
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[server.iad.liveperson.net/hc/6038405]
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\bkry6url.default\cookies.txt[stat.onestat.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\user\Cookies\user@ad.yieldmanager[2].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\user\Cookies\user@zedo[2].txt


Hijackthis log 28-06-2006
Logfile of HijackThis v1.99.1
Scan saved at 17:58:08, on 28-6-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\palstart.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [RegistryOptimizer] "C:\Downloads\Programs\RegistryOptimizer2006\RegistryOptimizer.exe" ShowError
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft System Saver] mssave.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [Tau Monitor] C:\PROGRA~1\Agnitum\TAUSCA~1.7\taumon.exe
O4 - HKLM\..\RunServices: [Microsoft System Saver] mssave.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: palstart.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


Thanks for the help

[LonnyRJones]

Hi chavezz

Start Hijackthis and place a check next to these items If there.
O4 - HKLM\..\Run: [Microsoft System Saver] mssave.exe
O4 - HKLM\..\RunServices: [Microsoft System Saver] mssave.exe

fix this if spysweeper has been uninstalled
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
====================================
Hit fix checked and close Hijackthis.
Restart the PC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Post a fresh Hijackthis log

Post a report from this tool if any FILES show
F-Secure Blacklight: http://www.f-secure.com/blacklight/try.shtml
Click the i accept button near the bottom of that page.
Download and run blacklite click > scan then > next, next again then exit
there will be a new txt near blacklite. post it please.
Important: If any files show Do not rename them YET.....legitimate files can be listed.

[chavezz]

Hi chavezz

Start Hijackthis and place a check next to these items If there.
O4 - HKLM\..\Run: [Microsoft System Saver] mssave.exe
O4 - HKLM\..\RunServices: [Microsoft System Saver] mssave.exe

fix this if spysweeper has been uninstalled
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
====================================
Hit fix checked and close Hijackthis.
Restart the PC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Post a fresh Hijackthis log

Hi LonnyRJones thanx for the instructions! i did what u wreat above and this is the logfile:


Logfile of HijackThis v1.99.1
Scan saved at 12:58:45, on 2-7-2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\SPYWAR~1\swdoctor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Documents and Settings\All Users\Menu Start\Programma's\Opstarten\palstart.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wuauclt.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Program Files\Common Files\Paltalk\PaltalkWebLogin.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [RegistryOptimizer] "C:\Downloads\Programs\RegistryOptimizer2006\RegistryOptimizer.exe" ShowError
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spyware Doctor] C:\PROGRA~1\SPYWAR~1\swdoctor.exe /Q
O4 - HKCU\..\Run: [VoipBuster] "C:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe" -nosplash -minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: palstart.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

[chavezz]

Post a report from this tool if any FILES show
F-Secure Blacklight: http://www.f-secure.com/blacklight/try.shtml
Click the i accept button near the bottom of that page.
Download and run blacklite click > scan then > next, next again then exit
there will be a new txt near blacklite. post it please.
Important: If any files show Do not rename them YET.....legitimate files can be listed.

i think this part is not needed (becouse i didnt finde any FILES shows F-Secure Blacklight)

am i right ?

[chavezz]

i keep getting that alert message from kaspersky av that it detected a backdoor.win32.Rbot.gen trojan.

[LonnyRJones]

Right. thats a good sign.

Do a file search for mssave.exe and let me know if its present and where.
That panda report actualy looks fine, mainly cookies.

i run Kaspersky av and since a week it detected a trojan it deleted but when i restarted my pc again it comes back and also if i deleted and i still work on my pc for a view houres it detected again the same trojan.,
If that happens again tell us the file names and location's

Why havent you install service pack 2 yet ?

[chavezz]

Do a file search for mssave.exe and let me know if its present and where.

i did a file searche for mssave.exe and i found this:
file name: MSSAVE.EXE-298A10F6.pf and its present in: C:\WINDOWS\Prefetch




If that happens again tell us the file names and location's

this is a part of the kaspersky av log for today maybe u can see wich file names becouse i have no idea:

2-7-2006 7:39:11 Process (PID 1640) tried to access Kaspersky Anti-Virus 6.0 process (PID 1524), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 7:39:11 Process (PID 1640) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 7:39:12 Update completed successfully.
2-7-2006 7:44:16 Process (PID 3712) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 7:44:16 Process (PID 3712) tried to access Kaspersky Anti-Virus 6.0 process (PID 1524), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 8:31:50 Process (PID 3312) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 8:31:50 Process (PID 3312) tried to access Kaspersky Anti-Virus 6.0 process (PID 1524), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 9:36:16 Process (PID 3852) tried to access Kaspersky Anti-Virus 6.0 process (PID 1524), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 9:36:16 Process (PID 3852) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 9:39:53 Update completed successfully.
2-7-2006 9:51:56 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0043160.exe/PE_Patch/MewBundle/MEW: detected Trojan program Backdoor.Win32.Rbot.gen
2-7-2006 9:51:56 Security threats have been detected. You are advised to neutralize them immediately.
2-7-2006 10:04:25 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0043160.exe/PE_Patch/MewBundle/MEW: is not disinfected, cannot be disinfected
2-7-2006 10:04:26 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0043160.exe: deleted
2-7-2006 11:56:12 Update completed successfully.
2-7-2006 11:57:48 Process (PID 2356) tried to access Kaspersky Anti-Virus 6.0 process (PID 1496), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 11:57:48 Process (PID 2356) tried to access Kaspersky Anti-Virus 6.0 process (PID 2000), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 11:58:12 Process (PID 1584) tried to access Kaspersky Anti-Virus 6.0 process (PID 1496), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 11:58:13 Process (PID 1584) tried to access Kaspersky Anti-Virus 6.0 process (PID 2000), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 12:04:38 Process (PID 1656) tried to access Kaspersky Anti-Virus 6.0 process (PID 1564), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 12:04:38 Process (PID 1656) tried to access Kaspersky Anti-Virus 6.0 process (PID 2004), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 12:56:08 Process (PID 1616) tried to access Kaspersky Anti-Virus 6.0 process (PID 1476), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 12:56:08 Process (PID 1616) tried to access Kaspersky Anti-Virus 6.0 process (PID 1992), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 13:57:12 Update completed successfully.
2-7-2006 14:12:03 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0044160.exe/PE_Patch/MewBundle/MEW: detected Trojan program Backdoor.Win32.Rbot.gen
2-7-2006 14:12:03 Security threats have been detected. You are advised to neutralize them immediately.
2-7-2006 14:59:32 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0044160.exe/PE_Patch/MewBundle/MEW: is not disinfected, cannot be disinfected
2-7-2006 15:00:16 File C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0044160.exe: deleted


Reports
-------
Task Status Start Finish Size
---- ------ ----- ------ ----
Mail Anti-Virus running 2-7-2006 12:55:39 0 bytes
Web Anti-Virus running 2-7-2006 12:55:39 415.9 KB
Proactive Defense running 2-7-2006 12:55:39 0 bytes
File Anti-Virus running 2-7-2006 12:55:39 391.3 KB
Scan Startup Objects completed 2-7-2006 12:57:50 2-7-2006 12:58:09 526.9 KB
Update completed 2-7-2006 13:57:05 2-7-2006 13:57:12 10.8 KB


Quarantine
----------
Status Object Size Added
------ ------ ---- -----


Backup
------
Status Object Size
------ ------ ----
Infected: Trojan program Backdoor.Win32.Rbot.gen c:\system volume information\_restore{705b722e-1c95-4622-8195-90cbdc8b57bd}\rp149\a0038444.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3176 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 65 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0043160.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\mssave.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0044160.exe 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 60 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\System32\qusgbr.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3332 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 65 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP2568 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3076 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3708 98.7 KB


Statistics
----------
Last update: 2-7-2006 13:57:12
Last full scan: 28-6-2006 16:15:46
Files scanned (detected): 5958 (Detected 1)
E-mails scanned (detected): 0 (Detected 0)
Scripts scanned (detected): 1188 (Detected 0)
Dangerous actions blocked: 0 (Moved to Quarantine 0)
VBA macros blocked: 0



Why havent you install service pack 2 yet ?

do u have maybe a download link for the pack 2?
thanks

[chavezz]

10 minutes a go i get again a alert message from kaspersky av:

here is a part of the kaspersky av log (log to big for placing on the forum)

2-7-2006 21:57:08 Process (PID 2300) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 21:57:08 Process (PID 2300) tried to access Kaspersky Anti-Virus 6.0 process (PID 1484), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:21:19 Process (PID 2928) tried to access Kaspersky Anti-Virus 6.0 process (PID 1484), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:21:19 Process (PID 2928) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:32:14 File C:\WINDOWS\system32\TFTP3576/PE_Patch/MewBundle/MEW: detected Trojan program Backdoor.Win32.Rbot.gen
2-7-2006 22:32:14 Security threats have been detected. You are advised to neutralize them immediately.
2-7-2006 22:32:19 File C:\WINDOWS\system32\TFTP3576/PE_Patch/MewBundle/MEW: is not disinfected, cannot be disinfected
2-7-2006 22:32:25 File C:\WINDOWS\system32\TFTP3576: deleted
2-7-2006 22:32:52 Process (PID 2960) tried to access Kaspersky Anti-Virus 6.0 process (PID 1988), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:32:52 Process (PID 2960) tried to access Kaspersky Anti-Virus 6.0 process (PID 1484), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:39:23 Process (PID 1632) tried to access Kaspersky Anti-Virus 6.0 process (PID 1544), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:39:23 Process (PID 1632) tried to access Kaspersky Anti-Virus 6.0 process (PID 1968), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:39:59 Process (PID 2748) tried to access Kaspersky Anti-Virus 6.0 process (PID 1544), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:39:59 Process (PID 2748) tried to access Kaspersky Anti-Virus 6.0 process (PID 1968), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:40:35 Process (PID 2968) tried to access Kaspersky Anti-Virus 6.0 process (PID 1544), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.
2-7-2006 22:40:35 Process (PID 2968) tried to access Kaspersky Anti-Virus 6.0 process (PID 1968), but it has been blocked. This is Self-Defense monitoring, and you do not need to do anything.


Reports
-------
Task Status Start Finish Size
---- ------ ----- ------ ----
Proactive Defense running 2-7-2006 22:38:54 0 bytes
File Anti-Virus running 2-7-2006 22:38:54 200.8 KB
Mail Anti-Virus running 2-7-2006 22:38:54 0 bytes
Web Anti-Virus running 2-7-2006 22:38:54 0 bytes


Quarantine
----------
Status Object Size Added
------ ------ ---- -----


Backup
------
Status Object Size
------ ------ ----
Infected: Trojan program Backdoor.Win32.Rbot.gen c:\system volume information\_restore{705b722e-1c95-4622-8195-90cbdc8b57bd}\rp149\a0038444.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3576 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3176 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 65 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0043160.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\mssave.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\System Volume Information\_restore{705B722E-1C95-4622-8195-90CBDC8B57BD}\RP156\A0044160.exe 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 60 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\System32\qusgbr.exe 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3332 98.7 KB
Infected: Trojan program Trojan-Downloader.BAT.Ftp.ab c:\windows\system32\o 65 bytes
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP2568 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3076 98.7 KB
Infected: Trojan program Backdoor.Win32.Rbot.gen C:\WINDOWS\system32\TFTP3708 98.7 KB

[LonnyRJones]

Hi

Set windows to show hidden file's, folder and extensions
>click here for instructions<. (http://www.xtra.co.nz/help/0,,4155-1916458,00.html)

Dont worry about file's in the prefetch or c:\system volume information folders

Boot your PC into safe mode and get samples of these files,
C:\WINDOWS\system32\mssave.exe <98.7 KB
c:\windows\system32\o <60 bytes
C:\WINDOWS\System32\qusgbr.exe <98.7 KB
C:\WINDOWS\system32\TFTP3332 <98.7 KB
meaning copy them to a new folder such as C:\baddies
zip up the entire folder
run a full scan with your av and tell it to delete or quarantine then run any other antispyware/antivirus programs you have (dont let them clean the folder you zipped)

How to Reboot into safe mode Click here if needed (http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx) For instructions.



Restart back to a normal windows session and send me that zip file
Send it to submitlonny AT subratam.org
Replace AT with @ and remove spaces, then include a link back to this thread.

[tashi]

This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me or your helper a pm and provide a link to the thread.

Applies only to the original topic starter.