Virtumunde and Virtumunde Generic

OK, here's the Kaspersky report. Looks like there's still some nastiness on the drive. Though not nearly as much as was found on the last scan, so it's progress. :D:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, November 14, 2007 12:08:51 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/11/2007
Kaspersky Anti-Virus database records: 429354
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 161973
Number of viruses found: 1
Number of infected objects: 4
Number of suspicious objects: 0
Duration of the scan process: 01:49:12

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\cert8.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\history.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\key3.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\parent.lock Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\Jukebox\mmjbaltlog.txt Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\Jukebox\mmjblog.txt Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\MIM\Database\Default.ldb Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\MIM\Database\Default.mdb Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\History\History.IE5\MSHist012007111320071114\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\JET405F.tmp Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\~ROMFN_0000082C Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\ntuser.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cyc skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp/stream Infected: Trojan-Downloader.Win32.Zlob.cyc skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp NSIS: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp CryptFF.b: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP540\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{15805E3A-5501-46B7-B14D-FA6E8B2C1651}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{F994B18B-83FB-490F-8D75-21BFF98A0369}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\IntelDH.evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.
 
KASPERSKY ONLINE SCANNER REPORT Wednesday, November 14, 2007 12:08:51 AM
Number of infected objects: 4
Oops...I must have missed these:sad:

C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cyc skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp/stream Infected: Trojan-Downloader.Win32.Zlob.cyc skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp NSIS: infected - 2 skipped
C:\Program Files\Trend Micro\Internet Security 14\Quarantine\192.tmp CryptFF.b: infected - 2 skipped

Delete the contents of that quarantine folder

Thanks
 
Yay! :D: Looks like it's clean! Thank you, thank you, thank you, thank you, thank you, thank you, thank you...

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Wednesday, November 14, 2007 2:53:57 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 14/11/2007
Kaspersky Anti-Virus database records: 430466
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 163831
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 02:19:34

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\cert8.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\history.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\key3.db Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\parent.lock Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Application Data\Mozilla\Firefox\Profiles\6lxti32m.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\Jukebox\mmjbaltlog.txt Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\Jukebox\mmjblog.txt Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\MIM\Database\Default.ldb Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Application Data\Musicmatch\MIM\Database\Default.mdb Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\History\History.IE5\MSHist012007111420071115\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\JET94ED.tmp Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\~ROMFN_00000154 Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temp\~ROMFN_00000234 Object is locked skipped
C:\Documents and Settings\Dean Kneeland\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\My Documents\SmitfraudFix\dumphive.exe Object is locked skipped
C:\Documents and Settings\Dean Kneeland\My Documents\SmitfraudFix\swxcacls.exe Object is locked skipped
C:\Documents and Settings\Dean Kneeland\ntuser.dat Object is locked skipped
C:\Documents and Settings\Dean Kneeland\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP542\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Conexant D850 56K V.9x DFVc Modem.txt Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{185B3BAD-548A-47ED-88DC-1E9ABAF2DD8D}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\IntelDH.evt Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

... thank you, thank you, thank you, thank you, thank you, thank you. :yahoo:
 
Review those links I posted, those folks are some of the very best and that information will go far to helping you stay clean and safe online.

Thanks...Phil:bigthumb:
 
You must log in or register to reply here.
Back
Top