Help

Start a discussion
UNSOLVED

Disposition89

updated

20 years ago

D

Disposition89

1 Rookie

•

65 Posts

0

7323

May 11th, 2007 19:00

Win32.SillyDl.LC

Good Day,

   I think I have been infected by this trojan my antivirus software recently picked this pest up and deleted it or so I thought. Till the very next day I loaded up my computer and no more then an hour later eTrust picked it up again and again deleted it. How can I be for sure that the trojan has been token care of? I ran ad-aware SE, Spybot S&D, eTrust PestPatrol and eTrust EZ Antivirus and for the time being have not picked it up again.
  • 1

    1972vet

    3305 Posts

    569

    0

    Posted May 16th, 2007 02:00

    Scan Here.

    1) Scroll down to the bottom of the page and click the "Accept" button.

    2) Wait while the Active X control needed to run the scan is downloaded.

    3) When the installation and update completes click the "Next" button
    at the bottom then click "My Computer" to start the scan.

    4) When the scan completes, click "Save as Text" and note the location in the save box. Name the file "Kaspersky scan" and click "save".

    5) Navigate to the location where you just saved the report and copy the contents of the .txt file. Paste those contents in this thread on your next
    reply.
  • D

    Disposition89

    1 Rookie

    •

    65 Posts

    569

    0

    Posted May 16th, 2007 06:00

    -------------------------------------------------------------------------------
     KASPERSKY ONLINE SCANNER REPORT
     Wednesday, May 16, 2007 3:39:04 AM
     Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
     Kaspersky Online Scanner version: 5.0.93.0
     Kaspersky Anti-Virus database last update: 16/05/2007
     Kaspersky Anti-Virus database records: 321324
    -------------------------------------------------------------------------------
    Scan Settings:
     Scan using the following antivirus database: extended
     Scan Archives: true
     Scan Mail Bases: true
    Scan Target - My Computer:
     C:\
     D:\
    Scan Statistics:
     Total number of scanned objects: 126672
     Number of viruses found: 1
     Number of infected objects: 4
     Number of suspicious objects: 0
     Duration of the scan process: 00:52:54
    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Local Settings\History\History.IE5\MSHist012007051620070517\index.dat Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Ryan Cornett\ntuser.dat.LOG Object is locked skipped
    C:\Downloads\UTCSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{4AE70DEB-5AC4-4878-8A1C-E82A8024E7BC}\RP109\change.log Object is locked skipped
    C:\System Volume Information\_restore{4AE70DEB-5AC4-4878-8A1C-E82A8024E7BC}\RP69\A0011734.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
    C:\System Volume Information\_restore{4AE70DEB-5AC4-4878-8A1C-E82A8024E7BC}\RP69\A0011744.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
    C:\System Volume Information\_restore{4AE70DEB-5AC4-4878-8A1C-E82A8024E7BC}\RP69\A0011810.exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    Scan process completed.
  • 1

    1972vet

    3305 Posts

    569

    0

    Posted May 16th, 2007 14:00

    According to that log, the only remaining infection is in your restore points. You can purge those and create a new clean restore point after you post your hjt log in the forum.

    You should also find this:
    C:\Downloads\UTCSetup-dm[1].exe
    ...and delete it.
  • D

    Disposition89

    1 Rookie

    •

    65 Posts

    569

    0

    Posted May 16th, 2007 16:00

    Thank you so much for your help. I deleted the C:\Downloads\UTCSetup-dm[1].exe and my system restore points and im currently doing another virus scan with Kaspersky and so far it has yet to find anything. Here is my HJT log if your interested in viewing it.
    ---------------------------------------------------------------------------
    Logfile of HijackThis v1.99.1
    Scan saved at 1:04:06 PM, on 5/16/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    C:\WINDOWS\system32\RunDLL32.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\CA\eTrust EZ Armor\eTrust PestPatrol\PPActiveDetection.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Ryan Cornett\Desktop\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.rr.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe"
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Firewall\ca.exe"
    O4 - HKLM\..\Run: [eTrustPPAP] "C:\Program Files\CA\eTrust EZ Armor\eTrust PestPatrol\PPActiveDetection.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\RRIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://rfinder.asalink.net
    O15 - Trusted Zone: http://forums.avsim.net
    O15 - Trusted Zone: http://www.break.com
    O15 - Trusted Zone: http://www.captainsim.com
    O15 - Trusted Zone: http://www.dell.com
    O15 - Trusted Zone: http://www.dellcommunity.com
    O15 - Trusted Zone: http://www.dogpile.com
    O15 - Trusted Zone: http://www.flytampa.com
    O15 - Trusted Zone: http://www.flytampa.org
    O15 - Trusted Zone: www.fsroute.com
    O15 - Trusted Zone: http://www.fsroute.com
    O15 - Trusted Zone: http://www.myairplane.com
    O15 - Trusted Zone: http://www.navdata.at
    O15 - Trusted Zone: http://quantum.rr.com
    O15 - Trusted Zone: http://www.rr.com
    O15 - Trusted Zone: http://www.simairline.net
    O15 - Trusted Zone: http://www.vatsim.net
    O15 - Trusted Zone: http://www.world-of-ai.com
    O15 - Trusted Zone: http://www.youtube.com
    O15 - Trusted IP range: http://192.168.1.1
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM_ca.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
     
  • 1

    1972vet

    3305 Posts

    569

    0

    Posted May 17th, 2007 02:00

    Sorry...the hjt forum is Here.

Dell Support Resources

Latest Solutions

View More