HJT log (possibly trojaned), pls help

  1. #1
    cato18 is offline Newbie

    HJT log (possibly trojaned), pls help

    I carelessly use IE (instead of firefox) and was said by norton that it was trojaned. I've use spybot and ad-aware, get rid of some thread, computer running like normal (in safe-mode), but still would like to post a HJT log. pls help to check if there is anything left. Thank you!

    Logfile of HijackThis v1.99.1
    Scan saved at 10:28:11 AM, on 1/23/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\javaw.exe
    C:\Program Files\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://moneycentral.msn.com/home.asp
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\Generic\Power4 Gear\BatteryLife.exe 1
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Wireless Console] C:\Program Files\Generic\Wireless Console\wcourier.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - Startup: Check for TWS Updates.lnk = C:\Jts\WiseUpdt.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://download.shockwave.com/pub/otoy/OTOYAX.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O16 - DPF: {E2739AFF-FA40-4527-9A19-DE81795C2C03} (MSN Money Ticker) - http://moneycentral.msn.com/cabs/ticker.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


  2. #2
    VopThis is offline Senior Member (Canada)
    Nothing is showing up in your HJT log.




    Lets get another opinion with this tool:

    Please download, install, update and scan your system with the free (trial) version of Ewido trojan scanner:
    1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
    2. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
    3. From the main ewido screen, click on update in the left menu, then click the Start update button.
    4. After the update finishes (the status bar at the bottom will display "Update successful"), click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so time to go get a drink and a snack....
    5. If ewido finds anything, it will pop up a notification. You can select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
    6. When the scan finishes, click on "Save Report". This will create a text file. Please then paste the contents of the text file to this thread.

  3. #3
    cato18 is offline Newbie
    Thanks a lot for taking your time and help, i ran ewido scan and founded and removed a infection. here is the report:

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 7:45:06 PM, 1/23/2006
    + Report-Checksum: A84059FA

    + Scan result:

    C:\Documents and Settings\oem\Local Settings\Temporary Internet Files\Content.IE5\6ZYBUTIF\mm[1].js -> Spyware.Chitika : Cleaned with backup
    C:\Program Files\HJT\backups\backup-20051222-164918-516.dll -> Downloader.Agent.acc : Cleaned with backup
    C:\Program Files\HJT\backups\backup-20051222-164918-689.dll -> Downloader.Agent.acc : Cleaned with backup


    ::Report End

  4. #4
    VopThis is offline Senior Member (Canada)
    Download and run the freeware system optimization and privacy tool:
    CCleaner (Crap Cleaner)
    http://www.ccleaner.com/ccdownload.asp

    It removes unnecessary junk from your computer allowing it to run more efficiently and securely.

    You may get more optimal cleaning if you run it in SAFEMODE – while rebooting and at the beep keep tapping the F8 key.


    Once installed, you will notice an Online Help link at the bottom left. An Updates checking link is provided at the bottom right. When first run in its DEFAULT opening setup – Cleaner Settings (Windows TAB is selected) :
    • Uncheck ‘Cookies’ option (advisable)
    • Click the ‘Analyse’ button.
    • Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.





    Please do an online scan (scan only tool) with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:
      • Scan using the following Anti-Virus database:
        - Extended (if available otherwise Standard)
      • Scan Options:
        - Scan Archives
        - Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.




    POST A REVISED HIJACKTHIS LOG for review:
    Reboot and post a new HijackThis log with any feedback as appropriate - how things are now behaving: any new or remaining apparent issues.

  5. #5
    cato18 is offline Newbie
    thank you for the help once again, i've run ccleaner and then kaspersky scan, which says there are viruses found, here is the report:

    -------------------------------------------------------------------------------
    KASPERSKY ON-LINE SCANNER REPORT
    Monday, January 23, 2006 23:59:00
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky On-line Scanner version: 5.0.67.0
    Kaspersky Anti-Virus database last update: 24/01/2006
    Kaspersky Anti-Virus database records: 172780
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 33061
    Number of viruses found: 18
    Number of infected objects: 94
    Number of suspicious objects: 0
    Duration of the scan process: 1475 sec

    Infected Object Name - Virus Name
    C:\Documents and Settings\oem\Desktop\CyclingManager4Setup-dm.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b
    C:\Program Files\Norton AntiVirus\Quarantine\02F0705F.exe Infected: Trojan-Clicker.Win32.Spywad.l
    C:\Program Files\Norton AntiVirus\Quarantine\045A0735.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\049A0FA8.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\05A23856.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\080A0AC1.exe Infected: Trojan-Downloader.Win32.Agent.zx
    C:\Program Files\Norton AntiVirus\Quarantine\082F328E.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\0B7A5931.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\0C262714.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\0E783FF8.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\0ED00A3A.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\108F3C48.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\10EB4150.dat Infected: Trojan-Downloader.Win32.Small.awa
    C:\Program Files\Norton AntiVirus\Quarantine\10EB4150.exe Infected: Trojan-Downloader.Win32.Small.bgv
    C:\Program Files\Norton AntiVirus\Quarantine\10EE6B4C.exe Infected: Trojan-Downloader.Win32.Small.bgv
    C:\Program Files\Norton AntiVirus\Quarantine\16525143.dll Infected: Trojan-Downloader.Win32.Agent.bc
    C:\Program Files\Norton AntiVirus\Quarantine\16525143.exe Infected: Trojan.Win32.Dialer.ay
    C:\Program Files\Norton AntiVirus\Quarantine\1BEE16C1.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\1C140ED4.exe Infected: Trojan.Win32.Dialer.ay
    C:\Program Files\Norton AntiVirus\Quarantine\1CED66B9.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\21E40898.dll Infected: Trojan-Downloader.Win32.Agent.bc
    C:\Program Files\Norton AntiVirus\Quarantine\21E40898.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\262B2245.dat Infected: Trojan-Downloader.Win32.Delf.us
    C:\Program Files\Norton AntiVirus\Quarantine\262F4C42.exe Infected: Trojan-Downloader.Win32.Delf.us
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip/Counter.class Infected: Trojan.Java.Femad
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip/VerifierBug.class Infected: Trojan.Java.Femad
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip/web.exe Infected: Trojan.Win32.Small.ev
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip/Worker.class Infected: Trojan.Java.Femad
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip/Xeyond.class Infected: Trojan.Java.Femad
    C:\Program Files\Norton AntiVirus\Quarantine\3146157E.zip Infected: Trojan.Java.Femad
    C:\Program Files\Norton AntiVirus\Quarantine\315D4F4C.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\332F76B5.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\33C56888.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\3421097A.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\357B628F.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\37C87C3E.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\38554998.tmp Infected: not-virus:Hoax.Win32.SpyWare.a
    C:\Program Files\Norton AntiVirus\Quarantine\3CA13E74.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\40AB3E00.wmf Infected: Trojan-Downloader.Win32.Agent.acd
    C:\Program Files\Norton AntiVirus\Quarantine\40AE67FD.wmf Infected: Trojan-Downloader.Win32.Agent.acd
    C:\Program Files\Norton AntiVirus\Quarantine\40B211F9.zip/BlackBox.class Infected: Exploit.Java.ByteVerify
    C:\Program Files\Norton AntiVirus\Quarantine\40B211F9.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify
    C:\Program Files\Norton AntiVirus\Quarantine\40B211F9.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa
    C:\Program Files\Norton AntiVirus\Quarantine\40B211F9.zip Infected: Trojan-Downloader.Java.OpenConnection.aa
    C:\Program Files\Norton AntiVirus\Quarantine\42495D4F.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\4267548F.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\499A677B.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\4BBA76DF.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\4C951700.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\4DF7108D.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\507F4D11 Infected: not-a-virus:AdWare.Win32.FindSpy.e
    C:\Program Files\Norton AntiVirus\Quarantine\507F4D11.456 Infected: Trojan.Win32.Dialer.ay
    C:\Program Files\Norton AntiVirus\Quarantine\507F4D11.dll Infected: Trojan-Downloader.Win32.Agent.bc
    C:\Program Files\Norton AntiVirus\Quarantine\507F4D11.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\5082770D.dia Infected: Trojan.Win32.Dialer.ay
    C:\Program Files\Norton AntiVirus\Quarantine\5082770D.dll Infected: Trojan-Downloader.Win32.Agent.bc
    C:\Program Files\Norton AntiVirus\Quarantine\5082770D.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\5086210A.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\508A7343.dll Infected: Trojan-Downloader.Win32.Agent.bc
    C:\Program Files\Norton AntiVirus\Quarantine\508A7343.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\58BD0B90.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\590B7BDD.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\59874C8C.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\5C0F77DF.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\5C6D7EBD.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\61855171.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\62F82EE6.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\64E60021.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\652803B3.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\654B4ADD.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\6B151AA7.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\6CA70A26.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\6CA70A26.tmp Infected: Trojan-Clicker.Win32.Spywad.l
    C:\Program Files\Norton AntiVirus\Quarantine\6CAB3422.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\6D305EA2.TMP Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\6D3E2401.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\6E0D655A.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\6EA0652E.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\6F346502.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\710E74B2.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\73E11844.dll Infected: Trojan-Downloader.Win32.Agent.rm
    C:\Program Files\Norton AntiVirus\Quarantine\73E11844.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\74A03287.exe Infected: Trojan-Downloader.Win32.Small.awa
    C:\Program Files\Norton AntiVirus\Quarantine\79997942.exe Infected: Trojan.Win32.Agent.bi
    C:\Program Files\Norton AntiVirus\Quarantine\7C9E768F.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7CAC7997.TMP Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7CF078B5.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DBE4069.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DC26A65.exe Infected: not-virus:Hoax.Win32.SpyWare.a
    C:\Program Files\Norton AntiVirus\Quarantine\7DC26A65.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DC51462.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DC83E5E.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DCC685B.tmp Infected: Trojan.Win32.Small.ga
    C:\Program Files\Norton AntiVirus\Quarantine\7DCF1257.tmp Infected: Trojan.Win32.Small.ga

    Scan process completed.

  6. #6
    VopThis is offline Senior Member (Canada)
    Save 20% on AVG Internet Security 2012 Suite!
    All those viruses are sitting in the safe Norton AntiVirus\Quarantine area. Cleanout the Norton AV quarantine area.



    Empty the cache in your Java Plugins control panel or remove the jar cache:


    Start > Settings > Control panel > Java Plugin [version number] > Choose Cache and click remove JAR Cache.

    Or

    From the Start button, click Settings > Control Panel
    In the Control Panel, open the "Java Plug-in Control Panel"
    Select the Cache Tab
    Click the Clear button inside the Cache Tab, which will clear your JRE cache directory





    Delete file (in SAFE MODE, if necessary - F8):

    C:\Documents and Settings\oem\Desktop\CyclingManager4Setup-dm.exe







    To help avoid serious infection again, please look carefully at this post for some excellent preventative measures. Prevention must be made the first line of defense to improve upon.



    ONLY ONCE your are as clean as possible from any needed cleanup steps - As a final cleanup step (after serious infection), it may be advisable to Reset and Re-enable your System Restore to remove any bad files that may have been backed up by Windows . The files in System Restore are protected to prevent any programs changing them. And, this is the only complete way to clean these files: (You will lose all previous restore points which could likely be infected, anyway.)

    PLEASE NOTE: you will need to log into your computer with an account that has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.


    (Windows XP)
    c:\System Volume Information\_restore….
    To Turn OFF System Restore.
    1. Click the Start button.
    2. Right-click My Computer, and then click Properties.
    3. On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.
    4. Click Apply.

    To Turn ON System Restore.
    1. Follow the steps in the previous section, but in step 3, uncheck Turn off System Restore or Turn off System Restore on all drives. Then click OK.
    2. Create new System Restore points.


    (Windows ME)
    c:\_RESTORE\TEMP\….
    See the following link for instructions:
    http://service1.symantec.com/SUPPORT...rc=sec_doc_nam




    To reduce the re-infection potential for malware and protect your PC against spyware, here are a few helpful suggestions:
    1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft . This will patch many of the security holes through which attackers can gain access to your computer . You CANNOT complete this update using an alternate browser – you must use Internet Explorer.
      http://v5.windowsupdate.microsoft.com/v5co...t.aspx?ln=en-us
      http://www.microsoft.com/windows/ie/default.asp
      • http://www.securityfocus.com/news/11273
        If you surf to questionable (blockable) parts of the Web, you could encounter sites that compromise your PC without any user interaction. In experiments [reported Aug 2005], Microsoft identified 752 specific addresses owned by 287 Web sites that contain programs able to install themselves on a completely unpatched Windows XP system. Also, be aware that the WinXP Service Pack 2 was an update that focused almost exclusively on security. Also reported was that a fully patched Windows XP SP2 system cannot be compromised by any such discovered rogue Web sites.

    2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching (using a real-time AV tool only one at a time), there are some good free Antivirus programs that are decent, including AVG and Avast!.
      AVG: http://free.grisoft.com/doc/1
      Avast: http://www.avast.com/eng/avast_4_home.html

    3. In addition to using Ad-aware, consider using another free malware scanning/removal program :
      Adaware SE: http://www.download.com/Ad-Aware-SE-Person...ubj=dl&tag=top5
      Spybot S&D: http://www.download.com/Spybot-Search-Dest...tml?tag=lst-0-1
      MS Antispyware beta: http://www.microsoft.com/athome/security/s...re/default.mspx

    4. Consider using a free firewall if you are not already using one (use only one firewall at a time – normally you will need to disable the MS firewall). Some good free ones (for incoming and added outgoing traffic protection) are:
      Kerio Personal Firewall: http://www.sunbelt-software.com/Kerio.cfm
      *** After 30 days, Kerio shuts down selected features, but will continue to run in 'free' mode.
      Zone Alarm: http://www.zonelabs.com/store/content/company/products/znalm/comparison.jsp?lid=ho_za

      It is not a bad idea to also consider using a Router/Hardware firewall device where you have a High-Speed Internet access connection. A software firewall may occasionally need to be disabled or it gets/remains disabled by someone or something. Such an added layer of security consistency has a lot of merit to it.

    5. Consider using an alternate free browser for general web surfing but you must use IE for windows updates.
      Mozilla Firefox: http://www.mozilla.org/products/firefox/

    6. Consider increasing your browser security by using these programs:
      SpywareGuard will help protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
      SpywareBlaster will increase browser protection by blocking access to thousands of known malware sites by adding them to IE's restricted sites zone. It essentially blocks known- bad ActiveX program items from being installed or running on your computer. Download it here: http://www.javacoolsoftware.com/spywareblaster.html
    7. A HOSTS file can block Internet access to thousands of known-bad sites by not allowing you any easy browser access to such sites knowingly or unknowingly. Use HJT to determine if a current HOSTS file exists and any contents therein:
      • Run the HiJackThis tool and select ‘Open the Misc Tools section’.
      • Next select ‘Open host file manager’ button.
      • Use the ‘Open in Notepad’ button in XP/W2K or use WORDPAD if necessary [type wordpad.exe in the RUN box (Start>Run)] and load the FILE PATH identified in HJT.
      • Go to http://www.mvps.org/winhelp2002/hosts.txt . # Read the initial instructions #. Copy and paste (append or replace) the RELEVANT host address entry contents of that file into Notepad or Wordpad and save the updated file contents.

        EXCERPT:
        #start of lines added by WinHelp2002
        # [Misc A - Z]
        127.0.0.1 phpadsnew.abac.com
        127.0.0.1 a.abnad.net
        127.0.0.1 e.abnad.net
        127.0.0.1 www.accoona.com #[Adware-Accoona][Adware.Atoolb][Panda.Accoona]
        .
        .
        .
        #end of lines added by WinHelp2002




    *Remember just like your primary anti-virus software, it is important to:
    • Keep all of these programs up-to-date, and
    • Use them on a regular basis.

+ Reply to Thread