Infostealer.gampass!! Need help please.

Hey,

I was on ultimate-guitar.com looking at an article on guitar lessons when before I could finish the first paragraph, norton pops up notification that i've downloaded this infostealer.gampass virus. Norton deleted the file 123.dll
That was last friday. Monday morning i booted up the pc again and it pops ups the same message, and again on Tuesday.

In essence Norton has done nothing it seems to be helpful.

This is a work pc, its a Dell with Windows Xp as the OS

I've included the requested scans and log files below, and hopefully I've done all that correctly.

Some other notes, somewhere along the way in my attempt to download the Malwarebyte's program, I ended up getting a Malware Removal Bot instead. Not sure if its connected to this same infostealer or not, but may be possible. I redled Malwarebytes via your site, changed the .exe name and once installed it brought up the proper progam.

Antispyware returned no direct hits. Malwarebytes returned the Malware removal bot along with some other files as infected, so those were repaired/deleted. (I also unistalled the MRB using add/remove programs). Not sure what combo fix or the 4th tool found.

Combo fix did stall on me after installing the recovery tool, i rebooted the pc, ran combofix again and it went smoothly.

After running combofix though, i had a couple of new norton messages pop up, both I think were related to the MRB.

If you guys needa norton log let me know, and instructions on how to go about that would be helpful.

Thanks for your help, let me know how to remove this and any other corrupted files.

Couple of other questions on topic. 1. This is a networked work pc, is that a problem for the other network pc's/network in light of this virus? 2. I've changed my major passwords such as email and bank accounts, but are there any other things I need to address in regards to possible "info stolen?"

 

Hey Chaslang,

Thank you for the reply and the help. Sorry it has taken me a few days to reply.

The other two notices that Norton displayed (after combo fix) were Dc4.exe and A0112873.exe

Both were deleted by norton.

After running all the programs and submitting that to this forum, one of the office IT's showed up..finally. After he ran a cold boot up, we received one other notification from window's firewall requesting to unblock a program. I believe it was related to xc24bgts.exe

He left it blocked, and I believe made a couple adjustments in the registry as well.

Since that day though, I have not had any futher notifications, and if my logs look clean already to you, it sounds like its taken care of. Let me know though if you feel otherwise.

I will be changing the password on my login today, as well as my office email through lotus notes, and I will discuss with the IT here if we need to worry about adjusting the VPN. I had waited, because if there was still an issue, I'd just have to change it again anyway, since I cant do that from a different clean computer.

Thank you very much for your help!

Thorn.

 

Done! Thank you!