XP Antivirus 2009

cuberfreak · Oct 29, 2008

Hi thanks major geeks for this great forum

I was infected by the XP Antivirus 2009 with its dreaded white x in the red circle that alwas gave me a very anoying popup. I completed all the scans and steps in the READ & RUN ME FIRST. Malware Removal Guide and the Windows XP Cleaning Procedure. the anoying popup is gone but I still don't know if i'm safe so I've atached the logs from SAS, mbam, combofix and
mgtools

Heres the combofix log

Code:

ComboFix 08-10-29.06 - Robert 2008-10-29 15:32:31.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1031.18.709 [GMT 1:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Robert\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS)
-------\Service_TDSSserv.sys
-------\Service_TDSSserv.sys)


(((((((((((((((((((((((   Dateien erstellt von 2008-09-28 bis 2008-10-29  ))))))))))))))))))))))))))))))
.

2008-10-27 21:53 . 2008-10-27 21:53	<DIR>	d--------	C:\Programme\Malwarebytes' Anti-Malware
2008-10-27 21:53 . 2008-10-27 21:53	<DIR>	d--------	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Malwarebytes
2008-10-27 21:53 . 2008-10-27 21:53	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2008-10-27 21:53 . 2008-10-22 16:28	38,496	--a------	C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-27 21:53 . 2008-10-22 16:28	15,504	--a------	C:\WINDOWS\system32\drivers\mbam.sys
2008-10-27 20:18 . 2008-10-27 20:18	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2008-10-27 20:16 . 2008-10-27 20:18	<DIR>	d--------	C:\Programme\SUPERAntiSpyware
2008-10-27 20:16 . 2008-10-27 20:16	<DIR>	d--------	C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-10-27 20:16 . 2008-10-27 20:16	<DIR>	d--------	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\SUPERAntiSpyware.com
2008-10-27 19:16 . 2008-10-27 19:16	1,312,578	--a------	C:\MGtools.exe
2008-10-27 18:25 . 2008-10-27 18:25	<DIR>	d--------	C:\Programme\CCleaner
2008-10-27 18:17 . 2008-10-27 18:17	410,976	--a------	C:\WINDOWS\system32\deploytk.dll
2008-10-27 18:17 . 2008-10-27 18:17	73,728	--a------	C:\WINDOWS\system32\javacpl.cpl
2008-10-26 23:21 . 2008-10-26 23:21	164	--a------	C:\WINDOWS\system32\TDSSosvd.dat
2008-10-24 23:40 . 2008-10-15 17:35	337,408	-----c---	C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-22 13:54 . 2004-02-22 09:11	719,872	--a------	C:\WINDOWS\system32\devil.dll
2008-10-22 13:54 . 2006-10-07 16:43	502,784	--a------	C:\WINDOWS\x2.64.exe
2008-10-22 13:54 . 2007-05-17 16:30	318,976	--a------	C:\WINDOWS\system32\avisynth.dll
2008-10-22 13:54 . 2005-02-28 12:16	240,128	--a------	C:\WINDOWS\system32\x.264.exe
2008-10-22 13:54 . 2006-04-12 08:47	217,073	--a------	C:\WINDOWS\meta4.exe
2008-10-22 13:54 . 2004-01-24 23:00	70,656	--a------	C:\WINDOWS\system32\i420vfw.dll
2008-10-22 13:54 . 2006-04-05 07:09	66,560	--a------	C:\WINDOWS\MOTA113.exe
2008-10-22 13:54 . 2005-07-14 11:31	27,648	--a------	C:\WINDOWS\system32\AVSredirect.dll
2008-10-22 13:51 . 2008-10-22 13:51	<DIR>	d--------	C:\Programme\eRightSoft
2008-10-15 17:32 . 2008-10-15 17:32	<DIR>	d--------	C:\Programme\iTunes
2008-10-15 17:32 . 2008-10-15 17:32	<DIR>	d--------	C:\Programme\iPod
2008-10-15 17:32 . 2008-10-15 17:32	<DIR>	d--------	C:\Programme\Bonjour
2008-10-15 17:32 . 2008-10-15 17:32	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-15 17:32 . 2008-04-17 12:12	107,368	--a------	C:\WINDOWS\system32\GEARAspi.dll
2008-10-15 17:32 . 2008-10-01 12:01	32,000	--a------	C:\WINDOWS\system32\drivers\usbaapl.sys
2008-10-15 17:32 . 2008-04-17 12:12	15,464	--a------	C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-10-15 12:13 . 2008-08-14 14:19	2,191,488	-----c---	C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 12:13 . 2008-08-14 14:19	2,147,840	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 12:13 . 2008-08-14 14:19	2,068,352	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 12:13 . 2008-08-14 14:19	2,026,496	-----c---	C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 12:13 . 2008-09-15 16:24	1,846,528	-----c---	C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 12:13 . 2008-09-08 11:41	333,824	-----c---	C:\WINDOWS\system32\dllcache\srv.sys
2008-10-07 17:22 . 2008-10-07 17:23	<DIR>	d--------	C:\Programme\QuickTime
2008-10-07 17:22 . 2008-10-15 17:31	<DIR>	d--------	C:\Programme\Gemeinsame Dateien\Apple
2008-10-07 17:22 . 2008-10-07 17:22	<DIR>	d--------	C:\Programme\Apple Software Update
2008-10-07 17:22 . 2008-10-15 17:32	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2008-10-07 17:22 . 2008-10-07 17:22	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2008-10-06 18:11 . 2008-10-06 18:11	<DIR>	d--------	C:\Dokumente und Einstellungen\all users.windows.3\dokumente
2008-10-06 18:11 . 2008-10-06 18:11	<DIR>	d--------	C:\Dokumente und Einstellungen\all users.windows.3
2008-10-02 15:22 . 2008-10-02 15:23	<DIR>	d--------	C:\Programme\Google
2008-10-02 15:22 . 2008-10-28 19:12	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2008-09-30 18:10 . 2008-09-30 18:10	<DIR>	d--------	C:\Programme\Microsoft Works
2008-09-30 18:10 . 2006-10-26 18:56	32,592	--a------	C:\WINDOWS\system32\msonpmon.dll
2008-09-30 18:09 . 2008-09-30 18:09	<DIR>	d--------	C:\Programme\Microsoft.NET
2008-09-30 18:05 . 2008-09-30 18:06	<DIR>	d--------	C:\WINDOWS\SHELLNEW
2008-09-30 18:05 . 2008-09-30 18:10	<DIR>	d--------	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft Help
2008-09-30 18:04 . 2008-09-30 18:04	<DIR>	dr-h-----	C:\MSOCache

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-29 14:26	---------	d-----w	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\uTorrent
2008-10-29 13:23	---------	d-----w	C:\Programme\Mozilla Thunderbird
2008-10-28 17:49	---------	d-----w	C:\Programme\Spybot - Search & Destroy
2008-10-27 20:18	---------	d-----w	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-10-27 17:17	---------	d-----w	C:\Programme\Java
2008-10-04 22:18	---------	d-----w	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\OpenOffice.org2
2008-09-29 18:39	---------	d-----w	C:\Programme\Gemeinsame Dateien\Nero
2008-09-29 18:38	---------	d-----w	C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nero
2008-09-29 17:35	---------	d-----w	C:\Programme\Winamp
2008-09-29 17:27	---------	d-----w	C:\Programme\Nero
2008-09-19 17:29	---------	d-----w	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\SPORE
2008-09-18 18:47	---------	d-----w	C:\Programme\OpenOffice.org 2.4
2008-09-10 19:08	---------	d-----w	C:\Programme\Windows Media Connect 2
2008-09-09 16:45	---------	d--h--w	C:\Programme\InstallShield Installation Information
2008-09-08 16:20	---------	d-----w	C:\Programme\Electronic Arts
2008-09-08 10:41	333,824	----a-w	C:\WINDOWS\system32\drivers\srv.sys
2008-04-12 19:36	22,328	----a-w	C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\PnkBstrK.sys
2006-05-03 09:06	163,328	--sh--r	C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47	31,232	--sh--r	C:\WINDOWS\system32\msfDX.dll
2008-03-16 12:30	216,064	--sh--r	C:\WINDOWS\system32\nbDX.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"amd_dc_opt"="C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 8523776]
"NeroFilterCheck"="C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe" [2008-06-19 570664]
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"SunJavaUpdateSched"="C:\Programme\Java\jre6\bin\jusched.exe" [2008-10-27 136600]
"SoundMan"="SOUNDMAN.EXE" [2006-08-03 C:\WINDOWS\soundman.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Dokumente und Einstellungen\All Users\Startmen\Programme\Autostart\
Logitech SetPoint.lnk - C:\Programme\Logitech\SetPoint\SetPoint.exe [2008-03-22 434176]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Programme\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.I420"= i420vfw.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Programme\\ICQ6\\ICQ.exe"=
"C:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=

R2 JavaQuickStarterService;Java Quick Starter;C:\Programme\Java\jre6\bin\jqs.exe [2008-10-27 152984]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\setup.exe
.
Inhalt des "geplante Tasks" Ordners

2008-10-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Zusätzlicher Suchlauf -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\Mozilla\Firefox\Profiles\x5xxpwxt.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.com
FF -: plugin - C:\Programme\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll
FF -: plugin - C:\Programme\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Programme\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - C:\Programme\Mozilla Firefox\plugins\npdeploytk.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-29 15:36:18
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Weitere laufende Prozesse ------------------------
.
C:\WINDOWS\system32\savedump.exe
C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Programme\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-10-29 15:40:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2008-10-29 14:40:49

Vor Suchlauf: 8.557.301.760 Bytes frei
Nach Suchlauf: 8,473,038,848 Bytes frei

190	--- E O F ---	2008-10-24 22:51:49

Heres the SAS log

Code:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/27/2008 at 08:45 PM

Application Version : 4.21.1004

Core Rules Database Version : 3610
Trace Rules Database Version: 1596

Scan type       : Complete Scan
Total Scan Time : 00:20:44

Memory items scanned      : 388
Memory threats detected   : 1
Registry items scanned    : 5854
Registry threats detected : 6
File items scanned        : 16389
File threats detected     : 7

Trojan.Dropper/SVCHost-Fake
	C:\WINDOWS\SYSTEM32\DRIVERS\SVCHOST.EXE
	C:\WINDOWS\SYSTEM32\DRIVERS\SVCHOST.EXE
	[SVCHOST.EXE] C:\WINDOWS\SYSTEM32\DRIVERS\SVCHOST.EXE
	C:\WINDOWS\Prefetch\SVCHOST.EXE-0EB47E31.pf

Trojan.Dropper/Gen-NV
	[brastk] C:\WINDOWS\SYSTEM32\BRASTK.EXE
	C:\WINDOWS\SYSTEM32\BRASTK.EXE
	[brastk] C:\WINDOWS\SYSTEM32\BRASTK.EXE
	C:\WINDOWS\BRASTK.EXE

Rogue.XP AntiSpyware2009-Trace
	C:\WINDOWS\karna.dat
	C:\WINDOWS\system32\karna.dat

Trojan.Downloader-Gen
	HKLM\Software\Microsoft\Windows\CurrentVersion\Run#brastk [ brastk.exe ]
	HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run#brastk [ C:\WINDOWS\system32\brastk.exe ]
	HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run#brastk [ C:\WINDOWS\system32\brastk.exe ]

Trojan.FakeAlert/Variant
	C:\WINDOWS\SYSTEM32\LPHCPL5J0EE47.EXE

Heres the mbam log

Code:

Malwarebytes' Anti-Malware 1.30
Database version: 1329
Windows 5.1.2600 Service Pack 3

28.10.2008 18:58:02
mbam-log-2008-10-28 (18-58-02).txt

Scan type: Quick Scan
Objects scanned: 44796
Time elapsed: 2 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 11
Files Infected: 13

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\ -> Quarantined and deleted successfully.

Folders Infected:
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Anwendungsdaten\shcvl5j0ee47\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\ (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\wini10801.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Dokumente und Einstellungen\Robert\Lokale Einstellungen\Temp\wrdwn2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\TDSSbrsr.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSbubx.log (Trojan.TDSS) -> Delete on reboot.
C:\WINDOWS\system32\TDSSlxwp.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSnrse.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSoiqh.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSosvn.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSrhym.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSriqp.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\TDSSxfum.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\TDSSmqlt.sys (Rootkit.Agent) -> Delete on reboot.

I hope some of you experts can tell me if my computer is clean now or not
thanks in advance

TimW · Oct 29, 2008

I the future, please follow our instructions to ATTACH your logs.

Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Log in or Sign up

XP Antivirus 2009

cuberfreak Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member