PDA

View Full Version : Infected with shortcut virus?



florenciam
2015-04-30, 20:07
Hi, a week ago my USB drive got infected with a virus that turned my files into shortcuts, and my brother accidentally clicked on one of them. I ran the Spybot scan on my computer and it found some threats but after "deleting" such threats they appear again in the following scans. I run Windows XP and I had already scanned my computer with ESET NOD 32 antivirus, which didn't found anything.

Here are the scan results:

Search results from Spybot - Search & Destroy

30/04/2015 13:22:07
Scan took 00:00:09.
32 items found.

DoubleClick: Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)


Statcounter: Tracking cookie (Google Chrome: Default) (Browser: Cookie, nothing done)


Common Dialogs: History (26 files) (Registry Key, nothing done)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU

Adobe FlashPlayer Cookies: [SBI $065CE2DC] Text file (File, nothing done)
C:\Documents and Settings\cacha\Datos de programa\Macromedia\Flash Player\#SharedObjects\XE9W6D9D\s.ytimg.com\soundData.sol
Properties.size=58
Properties.md5=90D8E5B41FCAF58616D8916ECD1535CA
Properties.filedate=1430345627
Properties.filedatetext=2015-04-29 19:13:47

Adobe FlashPlayer Cookies: [SBI $E17C7B50] Text file (File, nothing done)
C:\Documents and Settings\cacha\Datos de programa\Macromedia\Flash Player\#SharedObjects\XE9W6D9D\xml5.xmlrequest.info\login.swf\1427632_0_es.sol
Properties.size=872
Properties.md5=ED0E75E8BFA370785CD5B7F1A0113220
Properties.filedate=1429980371
Properties.filedatetext=2015-04-25 13:46:11

MS Direct3D: [SBI $C2A44980] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Direct3D\MostRecentApplication\Name

MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name

MS DirectInput: [SBI $9A063C91] Most recent application (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\DirectInput\MostRecentApplication\Name

MS DirectInput: [SBI $7B184199] Most recent application ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\DirectInput\MostRecentApplication\Id

MS Office 12.0 (Word): [SBI $E357B233] Recent Document List (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Office\12.0\Word\File MRU

MS Wordpad: [SBI $4C02334D] Recent file list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Recent File List

Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources

Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList

Windows Explorer: [SBI $AA0766B5] Stream history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU

Windows Explorer: [SBI $2026AFB6] User Assistant history IE (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{5E6AB780-7743-11CF-A12B-00AA004AE837}\Count

Windows Explorer: [SBI $6107D172] User Assistant history files (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count

Windows Explorer: [SBI $B7EBA926] Last visited history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU

Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows Media\WMSDK\General\ComputerName

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows Media\WMSDK\General\UniqueID

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber

WinRAR: [SBI $0B56E92B] Recent file list (Registry Key, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\WinRAR\ArcHistory

WinRAR: [SBI $B84F9965] Last used directory (Registry Change, nothing done)
HKEY_USERS\S-1-5-21-1844237615-1767777339-1417001333-1003\Software\WinRAR\General\LastFolder

Caché: [SBI $49804B54] Browser: Cache (19) (Browser: Cache, nothing done)


Historial: [SBI $49804B54] Browser: History (38) (Browser: History, nothing done)


Historial: [SBI $49804B54] Browser: History (56) (Browser: History, nothing done)


Historial: [SBI $49804B54] Browser: History (17) (Browser: History, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (66) (Browser: Cookie, nothing done)


Cookie: [SBI $49804B54] Browser: Cookie (1359) (Browser: Cookie, nothing done)



--- Spybot - Search & Destroy version: 2.4.40.131 DLL (build: 20140425) ---

2014-06-24 blindman.exe (2.4.40.151)
2014-06-24 explorer.exe (2.4.40.181)
2014-06-24 SDBootCD.exe (2.4.40.109)
2014-06-24 SDCleaner.exe (2.4.40.110)
2014-06-24 SDDelFile.exe (2.4.40.94)
2013-06-18 SDDisableProxy.exe
2014-06-24 SDFiles.exe (2.4.40.135)
2014-06-24 SDFileScanHelper.exe (2.4.40.1)
2014-06-24 SDFSSvc.exe (2.4.40.217)
2014-06-24 SDHelp.exe (2.4.40.1)
2014-04-25 SDHookHelper.exe (2.3.39.2)
2014-04-25 SDHookInst32.exe (2.3.39.2)
2014-06-24 SDImmunize.exe (2.4.40.130)
2014-06-24 SDLogReport.exe (2.4.40.107)
2014-06-24 SDOnAccess.exe (2.4.40.11)
2014-06-24 SDPESetup.exe (2.4.40.3)
2014-06-24 SDPEStart.exe (2.4.40.86)
2014-06-24 SDPhoneScan.exe (2.4.40.28)
2014-06-24 SDPRE.exe (2.4.40.22)
2014-06-24 SDPrepPos.exe (2.4.40.15)
2014-06-24 SDQuarantine.exe (2.4.40.103)
2014-06-24 SDRootAlyzer.exe (2.4.40.116)
2014-06-24 SDSBIEdit.exe (2.4.40.39)
2014-06-24 SDScan.exe (2.4.40.181)
2014-06-24 SDScript.exe (2.4.40.54)
2014-06-24 SDSettings.exe (2.4.40.139)
2014-06-24 SDShell.exe (2.4.40.2)
2014-06-24 SDShred.exe (2.4.40.108)
2014-06-24 SDSysRepair.exe (2.4.40.102)
2014-06-24 SDTools.exe (2.4.40.157)
2014-06-24 SDTray.exe (2.4.40.129)
2014-06-27 SDUpdate.exe (2.4.40.94)
2014-06-27 SDUpdSvc.exe (2.4.40.77)
2014-06-24 SDWelcome.exe (2.4.40.130)
2014-04-25 SDWSCSvc.exe (2.3.39.2)
2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0)
2014-07-31 spybotsd2-translation-esx.exe
2013-06-19 spybotsd2-translation-frx.exe
2015-03-25 spybotsd2-translation-hrx.exe
2014-08-25 spybotsd2-translation-hux2.exe
2014-10-01 spybotsd2-translation-nlx2.exe
2014-11-05 spybotsd2-translation-ukx.exe
2015-04-17 unins000.exe (51.1052.0.0)
1999-12-02 xcacls.exe
2012-08-23 borlndmm.dll (10.0.2288.42451)
2012-09-05 DelZip190.dll (1.9.0.107)
2012-09-10 libeay32.dll (1.0.0.4)
2012-09-10 libssl32.dll (1.0.0.4)
2014-04-25 NotificationSpreader.dll
2014-06-24 SDAdvancedCheckLibrary.dll (2.4.40.98)
2014-04-25 SDAV.dll
2014-06-24 SDECon32.dll (2.4.40.114)
2014-06-24 SDEvents.dll (2.4.40.2)
2014-06-24 SDFileScanLibrary.dll (2.4.40.14)
2014-04-25 SDHook32.dll (2.3.39.2)
2014-06-24 SDImmunizeLibrary.dll (2.4.40.2)
2014-06-24 SDLicense.dll (2.4.40.0)
2014-06-24 SDLists.dll (2.4.40.4)
2014-06-24 SDResources.dll (2.4.40.7)
2014-06-24 SDScanLibrary.dll (2.4.40.131)
2014-06-24 SDTasks.dll (2.4.40.15)
2014-06-24 SDWinLogon.dll (2.4.40.0)
2012-08-23 sqlite3.dll
2012-09-10 ssleay32.dll (1.0.0.4)
2014-06-24 Tools.dll (2.4.40.36)
2014-03-05 Includes\Adware-000.sbi
2015-02-27 Includes\Adware-001.sbi
2015-04-15 Includes\Adware-C.sbi
2014-01-13 Includes\Adware.sbi
2014-01-13 Includes\AdwareC.sbi
2010-08-13 Includes\Cookies.sbi
2014-11-14 Includes\Dialer-000.sbi
2014-11-14 Includes\Dialer-001.sbi
2014-01-08 Includes\Dialer-C.sbi
2014-01-13 Includes\Dialer.sbi
2014-01-13 Includes\DialerC.sbi
2014-01-09 Includes\Fraud-000.sbi
2014-01-09 Includes\Fraud-001.sbi
2014-03-31 Includes\Fraud-002.sbi
2014-01-09 Includes\Fraud-003.sbi
2012-11-14 Includes\HeavyDuty.sbi
2014-11-14 Includes\Hijackers-000.sbi
2014-11-14 Includes\Hijackers-001.sbi
2014-01-08 Includes\Hijackers-C.sbi
2014-01-13 Includes\Hijackers.sbi
2014-01-13 Includes\HijackersC.sbi
2014-01-08 Includes\iPhone-000.sbi
2014-01-08 Includes\iPhone.sbi
2014-11-14 Includes\Keyloggers-000.sbi
2014-09-24 Includes\Keyloggers-C.sbi
2014-01-13 Includes\Keyloggers.sbi
2014-01-13 Includes\KeyloggersC.sbi
2014-11-14 Includes\Malware-000.sbi
2014-11-14 Includes\Malware-001.sbi
2014-11-14 Includes\Malware-002.sbi
2014-11-14 Includes\Malware-003.sbi
2014-11-14 Includes\Malware-004.sbi
2014-11-14 Includes\Malware-005.sbi
2014-02-26 Includes\Malware-006.sbi
2014-01-09 Includes\Malware-007.sbi
2015-04-15 Includes\Malware-C.sbi
2014-01-13 Includes\Malware.sbi
2013-12-23 Includes\MalwareC.sbi
2014-11-14 Includes\PUPS-000.sbi
2014-01-15 Includes\PUPS-001.sbi
2014-01-15 Includes\PUPS-002.sbi
2015-04-15 Includes\PUPS-C.sbi
2012-11-14 Includes\PUPS.sbi
2014-01-07 Includes\PUPSC.sbi
2014-01-08 Includes\Security-000.sbi
2014-01-08 Includes\Security-C.sbi
2014-01-21 Includes\Security.sbi
2014-01-21 Includes\SecurityC.sbi
2014-11-14 Includes\Spyware-000.sbi
2014-12-10 Includes\Spyware-001.sbi
2015-01-14 Includes\Spyware-C.sbi
2014-01-21 Includes\Spyware.sbi
2014-01-21 Includes\SpywareC.sbi
2011-06-07 Includes\Tracks.sbi
2012-11-19 Includes\Tracks.uti (*)
2014-01-15 Includes\Trojans-000.sbi
2014-01-15 Includes\Trojans-001.sbi
2014-11-14 Includes\Trojans-002.sbi
2014-01-15 Includes\Trojans-003.sbi
2014-01-15 Includes\Trojans-004.sbi
2014-03-19 Includes\Trojans-005.sbi
2015-03-31 Includes\Trojans-006.sbi
2014-01-15 Includes\Trojans-007.sbi
2014-07-09 Includes\Trojans-008.sbi
2014-07-09 Includes\Trojans-009.sbi
2015-04-15 Includes\Trojans-C.sbi
2014-01-15 Includes\Trojans-OG-000.sbi
2014-01-15 Includes\Trojans-TD-000.sbi
2014-01-15 Includes\Trojans-VM-000.sbi
2014-01-15 Includes\Trojans-VM-001.sbi
2014-01-15 Includes\Trojans-VM-002.sbi
2014-01-15 Includes\Trojans-VM-003.sbi
2014-01-15 Includes\Trojans-VM-004.sbi
2014-01-15 Includes\Trojans-VM-005.sbi
2014-01-15 Includes\Trojans-VM-006.sbi
2014-01-15 Includes\Trojans-VM-007.sbi
2014-01-15 Includes\Trojans-VM-008.sbi
2014-01-15 Includes\Trojans-VM-009.sbi
2014-01-15 Includes\Trojans-VM-010.sbi
2014-01-15 Includes\Trojans-VM-011.sbi
2014-01-15 Includes\Trojans-VM-012.sbi
2014-01-15 Includes\Trojans-VM-013.sbi
2014-01-15 Includes\Trojans-VM-014.sbi
2014-01-15 Includes\Trojans-VM-015.sbi
2014-01-15 Includes\Trojans-VM-016.sbi
2014-01-15 Includes\Trojans-VM-017.sbi
2014-01-15 Includes\Trojans-VM-018.sbi
2014-01-15 Includes\Trojans-VM-019.sbi
2014-01-15 Includes\Trojans-VM-020.sbi
2014-01-15 Includes\Trojans-VM-021.sbi
2014-01-15 Includes\Trojans-VM-022.sbi
2014-01-15 Includes\Trojans-VM-023.sbi
2014-01-15 Includes\Trojans-VM-024.sbi
2014-01-15 Includes\Trojans-ZB-000.sbi
2014-01-15 Includes\Trojans-ZL-000.sbi
2014-01-09 Includes\Trojans.sbi
2014-01-16 Includes\TrojansC-01.sbi
2014-01-16 Includes\TrojansC-02.sbi
2014-01-16 Includes\TrojansC-03.sbi
2014-01-16 Includes\TrojansC-04.sbi
2014-01-16 Includes\TrojansC-05.sbi
2014-01-09 Includes\TrojansC.sbi

tashi
2015-04-30, 22:12
Hello florenciam,

Please refer to the forum FAQ and instructions in post #2 on how to provide the logs from Farbar Recovery Scan Tool and aswMBR, which are used in the preliminary analysis.

http://forums.spybot.info/showthread.php?t=288

Then start a new topic providing the logs as shown and a volunteer analyst will advise. :)

Best regards.

florenciam
2015-04-30, 23:17
Thank you! I will