Go here to download HJT:
http://www.trendsecure.com
Click on "Install", accept the EULA, and select "Do a System Scan and Save a Logfile"
Post the scan log here.
Main Topics
Browse All Topics
Loading Advertisement...
Question
XTEMP1.EXE process detected - apparent trojan, no antivirus is picking it up, how do I remove it?
I've recently bought a new laptop. To transfer some of my backup files to this new laptop, I've been using my external USB hard drive. After doing so, I've noticed a strange process appearing, 'XTEMP1.EXE'. After doing some googling, f-secure has reported this as a trojan downloader. I noticed that this same process was also running on my PREVIOUS computer as well, where my backups came from, so I'm assuming that the trojan/virus has replicated itself or infected this new computer via the USB hard drive.
I've tried killing the process, searching for *XTEMP* and deleting them all, but the problem keeps coming back. I've downloaded the trial version of F-Secure in hopes of scanning, then removal/quarantine, but I've done that and the process is still there.
I'm pretty sure I'm going to need to run a HJT log, but it's been years since I've done so, can anyone give me the link, and the options I need to select? I'll gladly post the HJT log asap. Thanks for any further information and help you can provide.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Subscribe now for full access to Experts Exchange and get
Instant Access to this Solution
- Plus...
- 30 Day FREE access, no risk, no obligation
- Collaborate with the world's top tech experts
- Unlimited access to our exclusive solution database
- Never be left without tech help again
Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.
- "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
- "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
- "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.
See what Experts Exchange can do for you.
Got a question?
We've got the answer.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
Need individual assistance?
Our experts are ready to help.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Want to learn from the best?
Read articles from industry experts.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Working on a long term project?
Store your work and research.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
What Makes Experts Exchange Unique?
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Trusted by the world's most respected brands.
Faithfully serving IT professionals since 1996.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Free Tech Articles
-
WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
-
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
-
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
-
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
-
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
-
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...
Cloud Class Webinars
- Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
- Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
- IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
- Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
- Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
- How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...
Join the Community
Give a Little. Get a Lot.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Answers
Thanks for the replies everyone. Firstly, the 1st link for xtemp removal was downloaded, ran, but problem still exists. And the 2nd link doesn't work at all.
Here's my HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:58:32 PM, on 7/14/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtr
C:\WINDOWS\system32\hkcmd.
C:\WINDOWS\system32\igfxpe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\igfxsr
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EX
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.e
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.ex
C:\Program Files\Hewlett-Packard\Shar
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsa
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdf
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsu
C:\WINDOWS\system32\xtemp1
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32
C:\WINDOWS\system32\wuaucl
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKCU\Software\Microsoft\In
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Pac
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSecti
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsa
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdf
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shar
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.e
--
End of file - 6131 bytes
I noticed there's a bunch of lines regarding Internet Explorer homepage or something, is that possible ad-ware as well? In either case, any help would be appreciated, thanks!!
C:\WINDOWS\system32\xtemp1
The bad files is still running in your processes.
Probably started up as a flashdrive infection.
Download and run this tool and follow the prompts:
http://www.techsupportforu
You can also try ComboFix by sUBs:
http://download.bleepingco
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
This link tells you How to use Combofix as well as installing RC if you haven't yet.
http://www.bleepingcompute
>>>I noticed there's a bunch of lines regarding Internet Explorer homepage or something, is that possible ad-ware as well?<<<
Those R's entries are not malicious, they're just the MS default entries, you can fix those safely if you want, except for the starpage if you set it yourself to -->
google.net-studio.org
You can fix any redundant entries in Hijackthis,
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
and any 04 lines of a program that you don't want to start at bootup.
Thank you very much for the help and replies. Here's my HJT log after running both USB Disinfector as well as ComboFix:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:00 PM, on 7/14/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtr
C:\WINDOWS\system32\hkcmd.
C:\WINDOWS\system32\igfxpe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\igfxsr
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Hewlett-Packard\Shar
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EX
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.e
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.ex
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsa
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdf
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsu
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32
C:\WINDOWS\system32\wuaucl
C:\Program Files\Trend Micro\HijackThis\HijackThi
R0 - HKCU\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-B
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Pac
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE"
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSecti
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsa
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdf
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shar
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.e
--
End of file - 5769 bytes
When you say I should install RC, what is RC?
Is my problem solved? Are there any unnecessary or problematic processes still running?
I'm pretty sure my other computer is infected with xtemp as well, what program should I run to disinfect that one?
For future safety, how would I prevent this from happening? I loathe anti virus programs because of the insane amount of resource usage, are there any that are highly recommended?
Thanks everyone!
>>>When you say I should install RC, what is RC?<<<
RC stands for Recovery Console, sorry for abbreviation. don't worry about it for now if things looks ok with combofix you don't have ti install it.
xtemp1.exe <-- is no longer showing in your Hijackthis running processes, but we still need to see the combofix log.
Can you please attach the combofix log here, thanks.
Here's the ComboFix log:
ComboFix 08-07-14.2 - jlieu 2008-07-14 22:26:23.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.
Running from: C:\Documents and Settings\jlieu\Desktop\Com
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((
.
F:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 ))))))))))))))))))))))))))
.
2008-07-14 14:55 . 2008-07-14 14:55 32,768 --a------ C:\WINDOWS\system32\xtemp1
2008-07-14 14:53 . 2008-07-14 14:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-14 12:39 . 2008-07-14 14:55 77,824 ---hs---- C:\WINDOWS\system32\dx6vcl
2008-07-13 23:07 . 2008-07-13 23:07 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 23:04 . 2008-07-13 23:05 <DIR> d-------- C:\Program Files\F-Secure Internet Security
2008-07-13 23:04 . 2008-07-13 23:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-13 23:04 . 2008-04-04 12:08 57,856 --a------ C:\WINDOWS\system32\driver
2008-07-13 23:04 . 2008-04-04 12:08 36,736 --a------ C:\WINDOWS\system32\driver
2008-07-13 23:03 . 2008-07-13 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\fssg
2008-07-13 19:44 . 2008-07-13 19:44 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 19:11 . 2008-07-13 19:12 <DIR> d-------- C:\Program Files\Winamp
2008-07-13 19:11 . 2008-07-13 19:12 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 18:34 . 2008-07-13 18:34 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-13 17:03 . 2008-07-13 17:03 <DIR> d-------- C:\Program Files\TDelta
2008-07-11 21:32 . 2008-07-11 21:32 268 --ah----- C:\sqmdata01.sqm
2008-07-11 21:32 . 2008-07-11 21:32 244 --ah----- C:\sqmnoopt01.sqm
2008-07-11 17:44 . 2008-07-11 17:44 268 --ah----- C:\sqmdata00.sqm
2008-07-11 17:44 . 2008-07-11 17:44 244 --ah----- C:\sqmnoopt00.sqm
2008-07-11 17:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltu
2008-07-11 17:43 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.
2008-07-11 17:43 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltu
2008-07-11 02:18 . 2008-07-14 18:23 <DIR> d-------- C:\Program Files\Windower
2008-07-11 02:14 . 2008-07-11 02:14 <DIR> d-------- C:\Program Files\Superjoy Box Pro
2008-07-11 02:14 . 2006-05-05 16:24 12,160 --a------ C:\WINDOWS\system32\driver
2008-07-11 02:12 . 2005-09-13 20:14 290,816 --a------ C:\WINDOWS\system32\Projoy
2008-07-11 02:08 . 2005-09-03 15:58 430,080 --a------ C:\WINDOWS\system32\Mpjoyc
2008-07-11 02:08 . 2004-10-21 17:22 49,152 --a------ C:\WINDOWS\system32\ffdrv1
2008-07-11 02:02 . 2008-07-11 02:02 <DIR> d-------- C:\Program Files\EMS USB2
2008-07-11 02:02 . 2008-07-11 02:04 272,384 --a------ C:\WINDOWS\system32\UsbPad
2008-07-11 02:02 . 2008-07-11 02:04 36,864 --a------ C:\WINDOWS\system32\UsbPad
2008-07-11 02:02 . 2008-07-11 02:04 6,704 --a------ C:\WINDOWS\system32\driver
2008-07-11 02:02 . 2008-07-11 02:04 3,536 --a------ C:\WINDOWS\system32\driver
2008-07-11 01:43 . 2008-07-11 01:43 <DIR> d-------- C:\Documents and Settings\jlieu\Contacts
2008-07-11 01:34 . 2008-07-11 01:42 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-11 01:33 . 2008-07-11 01:42 <DIR> d-------- C:\Program Files\Windows Live
2008-07-11 01:33 . 2008-07-11 01:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-11 01:31 . 2008-07-11 01:31 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-07-11 01:18 . 2007-11-30 17:31 10,368 --a------ C:\WINDOWS\system32\driver
2008-07-11 01:18 . 2007-11-30 17:31 10,368 --a--c--- C:\WINDOWS\system32\dllcac
2008-07-11 00:28 . 2008-07-11 00:28 <DIR> d-------- C:\Program Files\FFXiBench3
2008-07-11 00:09 . 2008-07-13 19:11 <DIR> d-------- C:\Program Files\Winamp3
2008-07-11 00:09 . 2008-07-11 00:09 50 --a------ C:\WINDOWS\Winamp.ini
2008-07-11 00:09 . 2008-07-11 00:09 41 --a------ C:\WINDOWS\winampa.ini
2008-07-11 00:03 . 2008-07-11 00:03 <DIR> d-------- C:\Program Files\PlayOnline
2008-07-10 23:51 . 2008-07-10 23:51 <DIR> d-------- C:\Program Files\Real Alternative
2008-07-10 23:51 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\msvcp7
2008-07-10 23:51 . 2004-01-11 16:00 348,160 --a------ C:\WINDOWS\system32\msvcr7
2008-07-10 23:50 . 2008-07-10 23:50 <DIR> d-------- C:\WINDOWS\WinRAR
2008-07-10 23:50 . 2008-07-10 23:50 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-07-10 23:24 . 2008-07-10 23:24 <DIR> d-------- C:\Program Files\uTorrent
2008-07-10 23:24 . 2008-07-14 10:01 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-10 22:47 . 2008-07-10 22:47 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-10 22:36 . 2008-06-13 05:05 272,128 --------- C:\WINDOWS\system32\driver
2008-07-10 22:36 . 2008-06-13 05:05 272,128 -----c--- C:\WINDOWS\system32\dllcac
2008-07-10 22:33 . 2008-07-10 22:55 <DIR> d-------- C:\SWSetup
2008-07-10 22:28 . 2008-07-10 23:11 <DIR> d-------- C:\Program Files\CONEXANT
2008-07-10 22:09 . 2008-07-10 22:09 <DIR> d-------- C:\WINDOWS\system32\ENU
2008-07-10 22:09 . 2008-07-10 22:09 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-10 22:09 . 2008-05-23 15:26 1,034,776 --a------ C:\WINDOWS\system32\imsmud
2008-06-20 05:51 . 2008-06-20 05:51 361,600 -----c--- C:\WINDOWS\system32\dllcac
.
((((((((((((((((((((((((((
.
2008-07-11 08:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-11 06:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-11 04:26 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-11 04:09 --------- d-----w C:\Program Files\Intel
2008-07-11 02:42 --------- d-----w C:\Program Files\Apoint2K
2008-07-11 02:42 --------- d-----w C:\Documents and Settings\jlieu\Application
2008-07-11 02:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-11 02:27 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsoc
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\driver
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\driver
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\driver
2008-06-04 19:40 920,088 ----a-w C:\WINDOWS\system32\igxpun
2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext
2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscri
2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj
2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscrip
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscrip
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz
.
------- Sigcheck -------
2007-12-29 08:43 2185216 cc19a7cffda996438ae11b33ac
2007-12-29 08:00 2306560 8ee730c805814e5db4e3aabce2
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWAR
"ctfmon.exe"="C:\WINDOWS\s
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
[HKEY_LOCAL_MACHINE\SOFTWA
"IgfxTray"="C:\WINDOWS\sys
"HotKeysCmds"="C:\WINDOWS\
"Persistence"="C:\WINDOWS\
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe"
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 17:41 178712]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 15:33 36352]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE"
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe
[HKEY_USERS\.DEFAULT\Softw
"nltide_2"="shell32" [X]
[HKEY_CURRENT_USER\softwar
"NoLogOff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\softwa
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filte
[HKEY_LOCAL_MACHINE\system
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
[HKEY_LOCAL_MACHINE\softwa
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
"%windir%\\system32\\sessm
"C:\\Program Files\\uTorrent\\uTorrent.
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.e
"C:\\Program Files\\Windows Live\\Messenger\\livecall.
"C:\\Program Files\\PlayOnline\\SquareE
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-04-04 12:09]
R3 CnxtHdAudAddService;Micros
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifi
S3 EMSUSB2;EMSUSB2;C:\WINDOWS
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\
*Newly Created Service* - CATCHME
.
**************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-14 22:27:15
Windows 5.1.2600 Service Pack 3, v.3264 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
.
Completion time: 2008-07-14 22:27:44
ComboFix-quarantined-files
Pre-Run: 82,504,355,840 bytes free
Post-Run: 82,851,524,608 bytes free
158 --- E O F --- 2008-07-14 18:36:57
If possible, could you address the above concerns as well?
Is my problem solved? Are there any unnecessary or problematic processes still running?
I'm pretty sure my other computer is infected with xtemp as well, what program should I run to disinfect that one?
For future safety, how would I prevent this from happening? I loathe anti virus programs because of the insane amount of resource usage, are there any that are highly recommended?
Yes it is still there. I'm using Avast antivirus it's free and it's not a resource hog, and I only have 512mb RAM.
1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
--------------------------
File::
C:\WINDOWS\system32\xtemp1
C:\WINDOWS\system32\dx6vcl
--------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.
Also do an online scan with Kaspersky and save the logfile.
Using Internet Explorer, run Kaspersky Online Scanner
http://www.kaspersky.com/v
* Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As...' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.
ComboFix log:
ComboFix 08-07-14.2 - jlieu 2008-07-15 8:07:08.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.
Running from: C:\Documents and Settings\jlieu\Desktop\Com
Command switches used :: C:\Documents and Settings\jlieu\Desktop\CFS
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\WINDOWS\system32\dx6vcl
C:\WINDOWS\system32\xtemp1
.
((((((((((((((((((((((((((
.
C:\WINDOWS\system32\dx6vcl
C:\WINDOWS\system32\xtemp1
.
((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 ))))))))))))))))))))))))))
.
2008-07-14 14:53 . 2008-07-14 14:53 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-13 23:07 . 2008-07-13 23:07 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 23:04 . 2008-07-14 23:52 <DIR> d-------- C:\Program Files\F-Secure Internet Security
2008-07-13 23:04 . 2008-07-14 23:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-13 23:03 . 2008-07-13 23:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\fssg
2008-07-13 19:44 . 2008-07-13 19:44 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 19:11 . 2008-07-13 19:12 <DIR> d-------- C:\Program Files\Winamp
2008-07-13 19:11 . 2008-07-13 19:12 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-13 18:34 . 2008-07-13 18:34 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-13 17:03 . 2008-07-13 17:03 <DIR> d-------- C:\Program Files\TDelta
2008-07-11 21:32 . 2008-07-11 21:32 268 --ah----- C:\sqmdata01.sqm
2008-07-11 21:32 . 2008-07-11 21:32 244 --ah----- C:\sqmnoopt01.sqm
2008-07-11 17:44 . 2008-07-11 17:44 268 --ah----- C:\sqmdata00.sqm
2008-07-11 17:44 . 2008-07-11 17:44 244 --ah----- C:\sqmnoopt00.sqm
2008-07-11 17:43 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltu
2008-07-11 17:43 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.
2008-07-11 17:43 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltu
2008-07-11 02:18 . 2008-07-14 18:23 <DIR> d-------- C:\Program Files\Windower
2008-07-11 02:14 . 2008-07-11 02:14 <DIR> d-------- C:\Program Files\Superjoy Box Pro
2008-07-11 02:14 . 2006-05-05 16:24 12,160 --a------ C:\WINDOWS\system32\driver
2008-07-11 02:12 . 2005-09-13 20:14 290,816 --a------ C:\WINDOWS\system32\Projoy
2008-07-11 02:08 . 2005-09-03 15:58 430,080 --a------ C:\WINDOWS\system32\Mpjoyc
2008-07-11 02:08 . 2004-10-21 17:22 49,152 --a------ C:\WINDOWS\system32\ffdrv1
2008-07-11 02:02 . 2008-07-11 02:02 <DIR> d-------- C:\Program Files\EMS USB2
2008-07-11 02:02 . 2008-07-11 02:04 272,384 --a------ C:\WINDOWS\system32\UsbPad
2008-07-11 02:02 . 2008-07-11 02:04 36,864 --a------ C:\WINDOWS\system32\UsbPad
2008-07-11 02:02 . 2008-07-11 02:04 6,704 --a------ C:\WINDOWS\system32\driver
2008-07-11 02:02 . 2008-07-11 02:04 3,536 --a------ C:\WINDOWS\system32\driver
2008-07-11 01:43 . 2008-07-11 01:43 <DIR> d-------- C:\Documents and Settings\jlieu\Contacts
2008-07-11 01:34 . 2008-07-11 01:42 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-11 01:33 . 2008-07-11 01:42 <DIR> d-------- C:\Program Files\Windows Live
2008-07-11 01:33 . 2008-07-11 01:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-11 01:31 . 2008-07-11 01:31 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-07-11 01:18 . 2007-11-30 17:31 10,368 --a------ C:\WINDOWS\system32\driver
2008-07-11 01:18 . 2007-11-30 17:31 10,368 --a--c--- C:\WINDOWS\system32\dllcac
2008-07-11 00:28 . 2008-07-11 00:28 <DIR> d-------- C:\Program Files\FFXiBench3
2008-07-11 00:09 . 2008-07-13 19:11 <DIR> d-------- C:\Program Files\Winamp3
2008-07-11 00:09 . 2008-07-11 00:09 50 --a------ C:\WINDOWS\Winamp.ini
2008-07-11 00:09 . 2008-07-11 00:09 41 --a------ C:\WINDOWS\winampa.ini
2008-07-11 00:03 . 2008-07-11 00:03 <DIR> d-------- C:\Program Files\PlayOnline
2008-07-10 23:51 . 2008-07-10 23:51 <DIR> d-------- C:\Program Files\Real Alternative
2008-07-10 23:51 . 2003-03-18 21:14 499,712 --a------ C:\WINDOWS\system32\msvcp7
2008-07-10 23:51 . 2004-01-11 16:00 348,160 --a------ C:\WINDOWS\system32\msvcr7
2008-07-10 23:50 . 2008-07-10 23:50 <DIR> d-------- C:\WINDOWS\WinRAR
2008-07-10 23:50 . 2008-07-10 23:50 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-07-10 23:24 . 2008-07-10 23:24 <DIR> d-------- C:\Program Files\uTorrent
2008-07-10 23:24 . 2008-07-15 08:07 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-10 22:47 . 2008-07-10 22:47 0 --a------ C:\WINDOWS\nsreg.dat
2008-07-10 22:36 . 2008-06-13 05:05 272,128 --------- C:\WINDOWS\system32\driver
2008-07-10 22:36 . 2008-06-13 05:05 272,128 -----c--- C:\WINDOWS\system32\dllcac
2008-07-10 22:33 . 2008-07-10 22:55 <DIR> d-------- C:\SWSetup
2008-07-10 22:28 . 2008-07-10 23:11 <DIR> d-------- C:\Program Files\CONEXANT
2008-07-10 22:09 . 2008-07-10 22:09 <DIR> d-------- C:\WINDOWS\system32\ENU
2008-07-10 22:09 . 2008-07-10 22:09 <DIR> d-------- C:\Documents and Settings\jlieu\Application
2008-07-10 22:09 . 2008-05-23 15:26 1,034,776 --a------ C:\WINDOWS\system32\imsmud
2008-06-20 05:51 . 2008-06-20 05:51 361,600 -----c--- C:\WINDOWS\system32\dllcac
.
((((((((((((((((((((((((((
.
2008-07-11 08:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-11 06:23 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-11 04:26 --------- d-----w C:\Program Files\Hewlett-Packard
2008-07-11 04:09 --------- d-----w C:\Program Files\Intel
2008-07-11 02:42 --------- d-----w C:\Program Files\Apoint2K
2008-07-11 02:42 --------- d-----w C:\Documents and Settings\jlieu\Application
2008-07-11 02:28 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-11 02:27 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsoc
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\driver
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\driver
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\driver
2008-06-04 19:40 920,088 ----a-w C:\WINDOWS\system32\igxpun
2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext
2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscri
2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj
2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscrip
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscrip
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz
.
------- Sigcheck -------
2007-12-29 08:43 2185216 cc19a7cffda996438ae11b33ac
2007-12-29 08:00 2306560 8ee730c805814e5db4e3aabce2
.
((((((((((((((((((((((((((
.
- 2008-07-14 20:56:44 61,642 ----a-w C:\WINDOWS\system32\perfc0
+ 2008-07-15 05:51:54 59,872 ----a-w C:\WINDOWS\system32\perfc0
- 2008-07-14 20:56:44 398,572 ----a-w C:\WINDOWS\system32\perfh0
+ 2008-07-15 05:51:54 394,498 ----a-w C:\WINDOWS\system32\perfh0
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWAR
"ctfmon.exe"="C:\WINDOWS\s
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
[HKEY_LOCAL_MACHINE\SOFTWA
"IgfxTray"="C:\WINDOWS\sys
"HotKeysCmds"="C:\WINDOWS\
"Persistence"="C:\WINDOWS\
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe"
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 17:41 178712]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 15:33 36352]
[HKEY_USERS\.DEFAULT\Softw
"nltide_2"="shell32" [X]
[HKEY_CURRENT_USER\softwar
"NoLogOff"= 0 (0x0)
[HKEY_LOCAL_MACHINE\softwa
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filte
[HKEY_LOCAL_MACHINE\system
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll
[HKEY_LOCAL_MACHINE\softwa
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
"%windir%\\system32\\sessm
"C:\\Program Files\\uTorrent\\uTorrent.
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.e
"C:\\Program Files\\Windows Live\\Messenger\\livecall.
"C:\\Program Files\\PlayOnline\\SquareE
R3 CnxtHdAudAddService;Micros
R4 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32
S3 EMSUSB2;EMSUSB2;C:\WINDOWS
.
**************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 08:08:14
Windows 5.1.2600 Service Pack 3, v.3264 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
.
Completion time: 2008-07-15 8:08:49
ComboFix-quarantined-files
ComboFix2.txt 2008-07-15 04:27:45
Pre-Run: 81,649,143,808 bytes free
Post-Run: 81,641,062,400 bytes free
160 --- E O F --- 2008-07-14 18:36:57
Kaspersky Scan Report:
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, July 15, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3, v.3264 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 15, 2008 15:17:15
Records in database: 956074
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
C:\
D:\
E:\
Scan statistics
Files scanned 58691
Threat name 2
Infected objects 3
Suspicious objects 0
Duration of the scan 02:32:15
File name Threat name Threats count
C:\QooBox\Quarantine\C\WIN
C:\WINDOWS\system32\dx6vcl
C:\WINDOWS\system32\notepo
The selected area was scanned.
Kaspersky found 2 trojans, delete them using combofix script.
1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
-------------------
File::
C
C:\WINDOWS\system32\notepo
--------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.
How's the pc going?
With your other infected pc, scan with the same scanners, use combofix and we'll check the logfile, then run Flash_Disinfector to stop the creation of bad autorun.inf, and run Kaspersky to check if it finds bad files the doesn't show up in the combofix scan and delete if it finds trojans.
3 Ways to Join
Business Accounts
- Perfect for organizations
- Multiple users
- Save over 36%
- Create a Business Account
Answer for Membership
- Earn free access
- Showcase your knowledge
- No credit card required
- Sign Up to Answer
Loading Advertisement...
by: namolPosted on 2008-07-14 at 11:41:46ID: 22000757
Link to download HJT:
http://www.download.com/Tr
Links for Removal of the Xtemp1.exe trojan:
http://net-studio.org/appl
http://www.pcprivacysoluti