We’d like to remind Forumites to please avoid political debate on the Forum.

This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.

📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide

hijack this please

kduffy101
kduffy101 Posts: 399 Forumite
in Techie Stuff
Malwarebytes' Anti-Malware 1.42
Database version: 3344
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
11/12/2009 11:49:43
mbam-log-2009-12-11 (11-49-43).txt
Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 229346
Time elapsed: 1 hour(s), 32 minute(s), 57 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 36
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP211\A0035168.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP219\A0035802.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP223\A0036657.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP224\A0037260.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP224\A0037618.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP230\A0038367.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP230\A0038792.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP230\A0039044.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP230\A0039296.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP230\A0039457.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0039586.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0039653.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040073.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040413.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040470.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040812.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040759.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040932.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0042222.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0042539.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0042592.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0042881.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0042936.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043077.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043129.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043287.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043337.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043404.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043473.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043593.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043646.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043931.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0043984.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0044104.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0044157.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP235\A0044381.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

user_online.gifpost_thanks.gif

Comments

  • kduffy101
    kduffy101 Posts: 399 Forumite
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:54:11, on 11/12/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler. exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
    C:\WINDOWS\system32\sistray.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\s wg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
    O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
    O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
    O4 - HKLM\..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe"
    O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Update Service (gupdate1c9f971741070e8) (gupdate1c9f971741070e8) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    --
    End of file - 6200 bytes
  • andy2004
    andy2004 Posts: 1,309 Forumite
    ok. first disable system restore, then reboot, then turn it back on. This will remove these files you had in the malwarebytes log.

    C:\System Volume Information\_restore{56E88B42-6CED-4EE1-8E38-FF4999432132}\RP231\A0040470.sys (Rootkit.Agent) -> Quarantined and deleted successfully. These files,

    Method 2: Manual steps to turn off or turn on System RestoreSteps to turn off System Restore

    1. Click Start, right-click My Computer, and then click Properties.
    2. In the System Properties dialog box, click the System Restore tab.
    3. Click to select the Turn off System Restore check box. Or, click to select the Turn off System Restore on all drives check box.
    4. Click OK.
    5. When you receive the following message, click Yes to confirm that you want to turn off System Restore:You have chosen to turn off System Restore. If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer.

      Do you want to turn off System Restore?
      After a few moments, the System Properties dialog box closes.
    Steps to turn on System Restore

    1. Click Start, right-click My Computer, and then click Properties.
    2. In the System Properties dialog box, click the System Restore tab.
    3. Click to clear the Turn off System Restore check box. Or, click the Turn off System Restore on all drives check box.
    4. Click OK.

      After a few moments, the System Properties dialog box closes.
    On the second log file. dont really see anything there.
    personally though i would remove the google toolbar, spybot, windows defender and just have malwarebytes installed.
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 353.5K Banking & Borrowing
  • 254.1K Reduce Debt & Boost Income
  • 455K Spending & Discounts
  • 246.6K Work, Benefits & Business
  • 602.9K Mortgages, Homes & Bills
  • 178.1K Life & Family
  • 260.6K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture