The hijackthis log is appended. Please help me to interpret it about what needs to be deleted. I will then attempt the PD as this is the 2nd time infected as a result of a 2nd email from the suspect malware domain. I have since blocked future emails from the 'bad guys' and have asked the ISP to block them too.
The HijackThis logfile is appended. Also, please recommend a reliable firewall to id and block the malware from entering my XP system from unopened emails. They came through my D-Link router DI-624 and through the firewall on my PC with no warning. Empty registery keys reoccur within seconds of my iding and deleting them with Regcure, Superantispyware, etc.
Also please advise of any other suggested AV protection. I have PCTOOLS AV software running.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Malwarebytes' Anti-Malware
http://www.malwarebytes.or
spybot
http://www.safer-networkin
or try
Write Rescue Cd and boot from it and scan ur system
Kaspersky Rescue CD
http://dnl-eu10.kaspersky-
or
BitDefender Rescue CD
http://download.bitdefende
or
F-Secure Rescue CD:
http://www.f-secure.com/li
or
AVG Rescue CD:
http://www.grisoft.com/ww.
or
avast! Rescue CD:
http://www.avast.com/eng/a
For more rescue cd refer to this site
http://www.askvg.com/downl
And for free antivirus for windows (GUI version)
Avira
http://www.free-av.com/
Avg
http://free.avg.com/
And paid version
Eset nod32
http://www.eset.com/
Kaspersky
http://www.kaspersky.com/
I'd suggest you to do a manual fix first.
1. First run a hijack log, and go to hijackthis.de
2. Paste your results and you can see that there are a lot of applications that could be causing the problem. I looked at it and a lot of ? are there.
3. With the same hijackthis tool, you can fix it line by line.
Cheers,
Rajesh
rsivanandan - I hope to follow your manual fix process after running regmon per the xp inside out book, page 1328 using the syntax fc /u before.reg after.reg > regcomp.txt (where I substitute the actual names of my snapshot files for before.reg and after.reg)
According to the xp pro inside out book Regmon can be downloaded from http://www.sysinternals.co
Thanks.
I appreciate your direction, rsivanandan:.
I will review the log and post it as soon as my xp pc pastes the.de results and sends an email to this PC.
I tend to think that the 'unknown service "O23" may be the culprit as all other unknown services look to be from my ISP but I must check into the last 2 characters on the ISP domain name - looks suspicious - as, under pressure from my past boss last Monday I purchased from a known malware site, to maintain my job, and gave the bad guys a comcast domain in my email registration. So I may delete those suspicious entries after I research the suspicious domain that is tied to an unidentified process and application in 6 entries in my registry.
Thanks. I respond further after I do the deletes and test my xp PC response, etc.
I alsp appended the code snippet.
It seems that you don't use an anti-virus scanner or your scanner is not active. Only an anti-virus scanner can protect you against new viruses. (I do but it may have been compromised. - I'll check. rljack01) You can look here for a good anti-virus scanner. We didn't detect any active process of a firewall on your system. Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don't use any firewall at all.
We recommend you to use a firewall. Download and install one or activate windows xp´s own one. In case you got questions or you want us to add the firewall you use to our database, contact us at our forum. Actions Entry Kind Visitor's assessment Information Logfile of Trend Micro HijackThis v2.0.2
This should be the newest version. Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
This should be the newest version. Boot mode: Normal
Very safe This entry was classified from our visitors as good. C:\WINDOWS\System32\smss.e
Very safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\csrss.
Safe
Systemprozess - Client Server Runtime C:\WINDOWS\system32\winlog
Very safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\servic
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\lsass.
Very safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\System32\svchos
Very safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\spools
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\msdtc.
Safe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDev
Very safe
Apple Mobile Device Support C:\Program Files\Bonjour\mDNSResponde
Neutral
Part of Apple iTunes 5 C:\WINDOWS\system32\cisvc.
Safe
Microsoft Index Service Helper C:\Program Files\Spyware Doctor\pctsAuxs.exe
Very safe Safe (4.34 / 5.00) C:\Program Files\Spyware Doctor\pctsSvc.exe
Very safe Safe (4.28 / 5.00) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
Neutral Safe (3.55 / 5.00) C:\WINDOWS\System32\snmp.e
Safe
C:\WINDOWS\system32\svchos
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\mqsvc.
Neutral
C:\WINDOWS\system32\mqtgsv
Safe
C:\WINDOWS\System32\alg.ex
Very safe This service is unnecessary if you do not use ICS.
This entry was classified from our visitors as good. C:\Program Files\Spyware Doctor\TFEngine\TFService.
Safe (4.39 / 5.00) C:\Program Files\RegCure\RegCure.exe
Safe Safe (4.17 / 5.00) C:\WINDOWS\Explorer.EXE
Very safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\ctfmon
Very safe
This entry was classified from our visitors as good. C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
Safe
This entry was classified from our visitors as good. C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
Safe
Possibly nasty! According to our database this process runs normally in c:\programme\roxio\easy cd creator 6\dragtodisc\! Check if you know this process and arrange a viruscheck where required. Roxio Easy CD Creator DragToDisc C:\Program Files\Spyware Doctor\pctsTray.exe
Very safe Safe (4.42 / 5.00) C:\WINDOWS\System32\svchos
Very safe
This entry was classified from our visitors as good. C:\Program Files\Registry Mechanic\RegMech.exe
Safe
This entry was classified from our visitors as good. C:\Program Files\SUPERAntiSpyware\SUP
Very safe
This entry was classified from our visitors as good. C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Very safe
HP Digital Imaging C:\Program Files\Windows Desktop Search\WindowsSearch.exe
Safe
Windows Desktop Search (WDS) C:\Program Files\Microsoft Office\Office12\ONENOTEM.E
Very safe
ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2003. Its required for the side note windows to work. C:\WINDOWS\system32\Search
Safe
This entry was classified from our visitors as good. C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
Safe
Hewlett-Packard C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
Very safe
Hewlett-Packard Digital Imaging C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe
Neutral
Hewlett-Packard Printer related C:\Program Files\CA\PPRT\bin\ITMRTSVC
Safe
Possibly nasty! According to our database this process runs normally in c:\programme\ca\sharedcomp
This is a unknown process.
C:\Program Files\comcasttb\ComcastSpy
This is a unknown process.
C:\Program Files\Trend Micro\HijackThis\HijackThi
Safe Remember that Hijackthis must be run in an own folder. Only if Hijackthis run in an own folder it will create backups! This entry was classified from our visitors as good. C:\WINDOWS\system32\NOTEPA
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\notepa
Very safe
In Windows integriertes Schreibprogramm. C:\WINDOWS\system32\cidaem
Safe
This entry was classified from our visitors as good. C:\PROGRA~1\MICROS~2\Offic
Possibly nasty! According to our database this process runs normally in c:\programme\microsoft office\office11\! Check if you know this process and arrange a viruscheck where required. E-Mail Client für Windows. C:\Program Files\Internet Explorer\IEXPLORE.EXE
Very safe
This entry was classified from our visitors as good. C:\Program Files\Windows Live\Toolbar\wltuser.exe
Safe Safe (3.7 / 5.00) C:\Program Files\comcasttb\CIDGlobalL
This is a unknown process.
C:\WINDOWS\system32\HPZipm
Very safe
HP Taskbar Utility C:\WINDOWS\system32\HPZinw
Neutral
Hewlett-Packard WLAN-Printer related C:\Program Files\Spyware Doctor\pctsGui.exe
Safe (4.25 / 5.00) C:\Program Files\Internet Explorer\iexplore.exe
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\Search
Safe
This entry was classified from our visitors as good. C:\WINDOWS\system32\Search
Safe
Microsoft Windows Search related process R1 - HKLM\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R1 - HKLM\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R1 - HKLM\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R0 - HKLM\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R0 - HKCU\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R0 - HKLM\Software\Microsoft\In
Safe This entry was classified from our visitors as good. R1 - HKCU\Software\Microsoft\Wi
Safe This entry was classified from our visitors as good. O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-F
Safe Unknown application. This entry was classified from our visitors as good. O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B
Windows Live Toolbar beta Search Enhancement Pack O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0
Very safe GrooveShellExtensions.dll Groove Virtual Office O2 - BHO: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-5
Unknown application. O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5
Very safe This entry was classified from our visitors as good. O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
Safe googletoolbar.dll, googletoolbar*.dll (* = number), googletoolbar_en_*.**-big.
swg.dll - Google Toolbar Notifier, http://googlesystem.blogsp
Neutral Safe (3.92 / 5.00) O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9
Safe jp2ssv.dll - Sun_Java, http://java.sun.com/javase
Neutral Safe (3.55 / 5.00) O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-E
Very safe jqs_plugin.dll - Java Quick Starter, https://jdk6.dev.java.net/
Safe googletoolbar.dll, googletoolbar*.dll (* = digit), googlenav.dll, googlenav*.dll, googletoolbar_en_*.**-big.
Safe Safe (3.55 / 5.00) O3 - Toolbar: Comcast Toolbar - {79CEEA4E-C231-4614-9E3B-5
Unknown application. O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Safe Not dangerous, but unnecessary. Speeds up the time it takes to load the Adobe Reader application. Your choice O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
Very safe Not dangerous, but unnecessary. HP software updates. If a shortcut doesn't exist O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
Not dangerous, but unnecessary. Part of Roxio EasyCD Creator 6.0 - places the Roxio Drag-to-Disc icon in you system tray. "Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically". Not required for Roxio to work properly O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
Safe Unknown application. This entry was classified from our visitors as good. O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusche
Safe Java von Sun O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
Neutral Associated with GoogleToolbarNotifier from Google Inc. O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
Safe This entry was classified from our visitors as good. O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
Very safe Registry Mechanic for Windows - "you can safely clean and repair Windows registry problems with a few simple mouse clicks! Problems with the Windows registry are a common cause of Windows crashes and error messages" O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUP
Safe This entry was classified from our visitors as good. O4 - HKCU\..\Run: [ComcastAntispyClient] "C:\Program Files\comcasttb\ComcastSpy
Unknown application. O4 - HKUS\S-1-5-21-1715567821-4
Office related O4 - HKUS\S-1-5-21-1715567821-4
Not dangerous, but unnecessary. QuickTime O4 - HKUS\S-1-5-21-1715567821-4
Associated with GoogleToolbarNotifier from Google Inc. O4 - S-1-5-21-1715567821-412668
Safe (4.14 / 5.00) O4 - S-1-5-21-1715567821-412668
Safe (4.14 / 5.00) O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.E
Safe ONENOTEM.EXE is a part of the note taking program that ships with Microsoft Office 2003. Its required for the side note windows to work. O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Safe Not dangerous, but unnecessary. HP digital imaging monitor; can apparently be launched manually. O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
Neutral HP Scanner related O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
Safe Microsofts Windows Desktop Search (WDS) O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
Very safe The entry E&xport to Microsoft Excel has been identified as safe. O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D
Very safe Safe (4.14 / 5.00) O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D
Very safe Safe (4.14 / 5.00) O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5
The entry Send to OneNote has been identified as safe. O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5
The entry S&end to OneNote has been identified as safe. O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
The entry Research has been identified as safe. O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
Safe This entry was classified from our visitors as good. O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
Safe This entry was classified from our visitors as good. O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
Safe This entry was classified from our visitors as good. O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
Neutral The entry Windows Messenger has been identified as safe. O16 - DPF: {4871A87A-BFDD-4106-8153-F
Safe Check if you know this site and fix it if you do not. This entry was classified from our visitors as good. O16 - DPF: {6E32070A-766D-4EE6-879C-D
This entry has been identified as safe. O16 - DPF: {73ECB3AA-4717-450C-A2AB-D
Neutral Safe (3.67 / 5.00) O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0
This entry has been identified as safe. O16 - DPF: {8BBDC81D-81B3-49EE-87E8-4
Safe Check if you know this site and fix it if you do not. Unknown ActiveX-Objects, or ActiveX-Objects from unknown sites should always be fixed. If the name of the ActiveX-Object or the URL contains the words 'dialer', 'casino', 'free plugin' etc, it should be fixed! O16 - DPF: {AE563720-B4F5-11D4-A415-0
This entry has been identified as safe. O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-4
Safe This entry has been identified as safe. O16 - DPF: {C6637286-300D-11D4-AE0A-0
Safe (3.97 / 5.00) O16 - DPF: {E2883E8F-472F-4FB0-9522-A
Very safe Check if you know this site and fix it if you do not. This entry was classified from our visitors as good. O16 - DPF: {F281A59C-7B65-11D3-8617-0
This entry has been identified as safe. O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3
Very safe This entry has been identified as safe. O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B
Neutral Safe (3.92 / 5.00) O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SAS
Very safe This entry was classified from our visitors as good. O23 - Service: Comcast AntiSpyware (AntiSpywareService) - Unknown owner - C:\Program Files\comcasttb\ComcastSpy
Neutral Unknown service. (ComcastAntiSpyService.exe
Safe This service (AppleMobileDeviceService.
Neutral This service (mDNSResponder.exe) was identified as a good one. O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google
Safe This service (GoogleUpdaterService.exe)
Very safe This service (HPBPRO.EXE) was identified as a good one. O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\
Safe Unknown service. (HPBOID.EXE) This entry was classified from our visitors as good. O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService
Very safe This service (iPodService.exe) was identified as a good one. O23 - Service: Pest Patrol Realtime Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC
This service (ITMRTSVC.exe) was identified as a good one. O23 - Service: Java Quick Starter (JavaQuickStarterService) - CA, Inc. - (no file)
Unknown service. () O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm
Safe This service (HPZipm12.exe) was identified as a good one. This entry was classified from our visitors as good. O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
Very safe Unknown service. (pctsAuxs.exe) This entry was classified from our visitors as good. O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
Very safe Unknown service. (pctsSvc.exe) This entry was classified from our visitors as good. O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.
Safe (4.39 / 5.00) member --- RLJACK01
Short analysis
Use these tips at your own risk! © 2004 - 2009 Mathias Mattner | Contact
I did a google search for cox antispyware but looks like many people don't like it.
Looks like this antivirus is nothing but rebranded mcafee at least from one site;
http://en.community.dell.c
I'd suggest go down the other road, I used to like AVG a lot and still use it.
Cheers,
Rajesh
I just edited the registry and did a reboot.
I'll check performance. However I did a regcure scan and clean just prior to shutdown.
After reboot I immediately did a registry scan with Regscan. 57 registry errors were found by regcure. and cleaned. (I have removed the PC from the internet during this process so it seems that there is still an infection resident.) Also at reboot an app started to self-install itself. I stopped it but it may have caused the registry issues also my reg checker told me that the registry had been chgd 2xs.
I just did another regcure scan and found 27 empty reg keys. So since I am not connected to the internet applications from the bad guys on the internet coupled with internal PC spyware cause a greater # of empty registy keys and other registry errors together than when not connected to the internet.
Therefore it seems that I have to take 2 actions:
1- change my IP address
2- id and remove the internal PC malware
Please advise how I do item # 1. (I have blocked the email domain of the predator but they are likely transmitting in other ways perhaps by piggybacking another transmission.
(These are my personal machines and I fired my customer on the last project that I was doing. OK, I admit that I was dumb for having order (but never downloaded) software demanded by the employer (because of cost) that I later id'd as a known malware site of which I was suspicious in the 1st place.)
If the infection could've come from a different source, viruses in an unopened email doesn't usually infect without it being opened or activated.
Unless the user using OE is in "preview pane" which can allow to execute the malicoius code, you can turn it off so any unopened email with viruses can't enter the system.
Also a lot of nasties can hide from a Hijackthis scan, so it's no longer the best diagnostic tool.
Also try scanning with Combofix and we'll see what it finds.
Please download ComboFix by sUBs:
http://download.bleep
(If it doesn't run re-download but rename before saving to your desktop)
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepin
I had selected the search for hidden files option in Spyware Doctor with antivirus and found and removed 120 infections not found prior.
a- fn: trojan.general
b- filename: application.nircmd (116 infections)
c- filename: trojan.general
Also just now my XP PC (the subject of these posts) did an auto shutdown.
There is still a bad guy in there that I hope to eradicate soon.
"catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit
LOCATION IN LOG FILE: 1:25
"catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit
See http://msdn.microsoft.com/
This, it seems, is the reason for reoccurrence of deleted files (by superantispyware and regcure).
It looks like handles remain open or database pointers remain active which disallows closure by ZwClose.
The problem remains about how to id and totally delete the malware that, it seems, remains in my XP PC s l o w i n g processing to a crawl.
Next I'll look in my XPPC for a file called "jqp.exe", malware that slows XP to a crawl and try to id the source of any other malware invoked process.
I still need the help of rpggamergirl.
The file name I'm looking for is 'jqs.exe' and not jqp.exe.
See http://search.microsoft.co
This is as I found this file in the Java directory and deleted it earlier.
Has it returned?
Hi,
Sorry for late reply. Have you also tried updating your java to the latest version?
Combofix did remove 3 files but nothing else showing in the log.
Can you please run Gmer's rootkit scanner, the catchme integrated in Combofix only detects userland rootkits.
Also run RootRepeal.
1. Download RootRepeal from the following location and save it to your desktop.
Zip Mirrors (Recommended)
Primary Mirror
http://rootrepeal.go
Se
http://ad13.geekstog
Rar Mirrors - Only if you know what a RAR is and can extract it.
Primary Mirror:
http://ad13.geeksto
Secondary
http://ad13.geeksto
Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.
Click the "Report" tab.
Click the "Scan" button.
Check all seven boxes:
o Drivers
o Files
o Processes
o SSDT
o Stealth Objects
o Hidden Services
o Shadow SSDT
Push Yes
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the "Save Report" button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.
2. Download GMER from here:
http://www.geekstogo.
Unzip it to the desktop.
Open the program and click on the Rootkit tab.
Make sure all the boxes on the right of the screen are checked, EXCEPT for Show All.
Click on Scan.
When the scan has run click Copy and paste the results (if any) into this thread.
Business Accounts
Answer for Membership
by: atlas_shudderedPosted on 2009-08-20 at 14:05:46ID: 25147134
What is the actual malware that you are showing as being infected with?
Have you shut down the system restore service and rebooted into safe mode prior to deleting the suspected malware?
Check out Kaspersky and try to limit the number of applications to one per objective. Running multiples can lead to conflicts, etc.