1.

Solve : TR/FakeSpyPro6?

Answer»

SysProt AntiRootkit v1.0.1.0
by swatkat

******************************************************************************************
******************************************************************************************

No Hidden Processes found

******************************************************************************************
******************************************************************************************
Kernel MODULES:
Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
Service Name: ---
Module Base: F3E9C000
Module End: F3EB4000
Hidden: Yes

Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
Service Name: ---
Module Base: F7B37000
Module End: F7B39000
Hidden: Yes

******************************************************************************************
******************************************************************************************
SSDT:
Function Name: ZwCreateKey
Address: F7CBA64E
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwCreateThread
Address: F7CBA644
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwDeleteKey
Address: F7CBA653
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwDeleteValueKey
Address: F7CBA65D
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwEnumerateKey
Address: F74BDC7E
Driver Base: F74B8000
Driver End: F7588000
Driver Name: sptd.sys

Function Name: ZwEnumerateValueKey
Address: F74BDFF6
Driver Base: F74B8000
Driver End: F7588000
Driver Name: sptd.sys

Function Name: ZwLoadKey
Address: F7CBA662
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwOpenKey
Address: F74BDA18
Driver Base: F74B8000
Driver End: F7588000
Driver Name: sptd.sys

Function Name: ZwOpenProcess
Address: F7CBA630
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwOpenThread
Address: F7CBA635
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwQueryKey
Address: F74BE0C0
Driver Base: F74B8000
Driver End: F7588000
Driver Name: sptd.sys

Function Name: ZwQueryValueKey
Address: F74BDF58
Driver Base: F74B8000
Driver End: F7588000
Driver Name: sptd.sys

Function Name: ZwReplaceKey
Address: F7CBA66C
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwRestoreKey
Address: F7CBA667
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

Function Name: ZwSetValueKey
Address: F7CBA658
Driver Base: 0
Driver End: 0
Driver Name: _unknown_

******************************************************************************************
******************************************************************************************
No Kernel Hooks found

******************************************************************************************
******************************************************************************************
Hidden files/folders:
Object: C:\60450fabca005df604\amd64\filterpipelineprintproc.dll
Status: Access denied

Object: C:\60450fabca005df604\amd64\msxpsdrv.cat
Status: Access denied

Object: C:\60450fabca005df604\amd64\msxpsdrv.inf
Status: Access denied

Object: C:\60450fabca005df604\amd64\msxpsinc.gpd
Status: Access denied

Object: C:\60450fabca005df604\amd64\msxpsinc.ppd
Status: Access denied

Object: C:\60450fabca005df604\amd64\mxdwdrv.dll
Status: Access denied

Object: C:\60450fabca005df604\amd64\xpssvcs.dll
Status: Access denied

Object: C:\60450fabca005df604\i386\filterpipelineprintproc.dll
Status: Access denied

Object: C:\60450fabca005df604\i386\msxpsdrv.cat
Status: Access denied

Object: C:\60450fabca005df604\i386\msxpsdrv.inf
Status: Access denied

Object: C:\60450fabca005df604\i386\msxpsinc.gpd
Status: Access denied

Object: C:\60450fabca005df604\i386\msxpsinc.ppd
Status: Access denied

Object: C:\60450fabca005df604\i386\mxdwdrv.dll
Status: Access denied

Object: C:\60450fabca005df604\i386\xpssvcs.dll
Status: Access denied

Object: C:\Documents and Settings\Mike\Favorites\Gabbeh\¦¦¦¦Creampuff?Doki!?BRIBE 400k+?IRL OPEN!!! Forum Gaia Online.url
Status: Hidden

Object: C:\Qoobox\BackEnv\AppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cache.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Cookies.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Desktop.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Favorites.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\History.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Music.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\NetHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Personal.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Pictures.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Programs.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Recent.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SendTo.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SetPath.bat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\StartUp.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\SysPath.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\Templates.folder.dat
Status: Access denied

Object: C:\Qoobox\BackEnv\VikPev00
Status: Access denied

How's your computer working now?

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (MICROSOFT Internet Explorer users can skip these steps)

  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

It's working but i haven't tried IE on that login . Other programs will RUN ok.

C:\Documents and Settings\Mike\Local Settings\Application Data\syssvc.exeWin32/PSW.Delf.NQS trojan
C:\Qoobox\Quarantine\C\WINDOWS\system32\cfbxrttn.ini.virWin32/Adware.Virtumonde.NEO application
C:\Qoobox\Quarantine\C\WINDOWS\system32\qeoroqre.ini.virWin32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP697\A0145270.exeWin32/PSW.Delf.NQS trojan
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146805.iniWin32/Adware.Virtumonde.NEO application
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146806.iniWin32/Adware.Virtumonde.NEO application
Tried Firefox on that login and it wouldn't run. Error message "Set up for proxy server no connection"Please run the ESET scan again and, this time, fix the infections.

Remove the Proxy setting in Internet Explorer and/or in FireFox.
In Internet Explorer
  • Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously
In Firefox
  • Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection > Choose "No Proxy"
  • Click the apply button and restart that computer in normal mode.
Now try FireFox again.When ESET tries to update the virus signature database I get an error that reads.....Cannot get update. Is proxy configured?.......... I disabled avira and the firewall (online Armor) but still no luck. Should I uninstall ESET and retry? I have not changed anything yet as far as IE or Firefox and did not have this problem the first time I ran ESET.OK got ESET running....

Thanks.C:\Qoobox\Quarantine\C\WINDOWS\system32\cfbxrttn.ini.virWin32/Adware.Virtumonde.NEO applicationcleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\WINDOWS\system32\qeoroqre.ini.virWin32/Adware.Virtumonde.NEO applicationcleaned by deleting - quarantined
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP697\A0145270.exeWin32/PSW.Delf.NQS trojancleaned by deleting - quarantined
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146805.iniWin32/Adware.Virtumonde.NEO applicationcleaned by deleting - quarantined
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146806.iniWin32/Adware.Virtumonde.NEO applicationcleaned by deleting - quarantined
C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP703\A0148602.exeWin32/PSW.Delf.NQS trojancleaned by deleting - quarantined
Ok that seems to have everything back to normal. Java updated, firewall installed, Firefox updated, windows messenger removed, recovery console installed, Viewpoint removed..........
Just 1 more question. How many of these new programs should I keep?

Thanks so much for your help.

Mike.Quote
Just 1 more question. How many of these new programs should I keep?
You can uninstall HJT but you may keep SAS and MBAM. Update them and run them regularly.

* Click START then RUN - Vista users press the Windows Key and the R keys together for the Run box.
* Now type commy /uninstall in the runbox
* Make sure there's a space between commy and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
*******************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the CLEANING process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
************************************
Looking over your log it seems you don't have any evidence of a second-party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP CONTAINS a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
*************************************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!Thanks Dave. Will follow your suggestions and I HAVE installed Online Armor Firewall.


Discussion

No Comment Found

Related InterviewSolutions