Malware 32 blaster worm- please help:(

stilltheone

Download, install, update and run a Full Scan with Malwarebytes' AntiMalware. When complete, choose 'Remove Selected' if there is anything to remove and Reboot your computer.

After restart, open the program again and go to 'Logs'. Double click on the log produced for today and post the contents here.

schofy

I'm not sure how much you wanted me to post so i cut and pasted it all:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6507
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
04/05/2011 22:20:33
mbam-log-2011-05-04 (22-20-33).txt
Scan type: Full scan (C:\|)
Objects scanned: 223233
Time elapsed: 1 hour(s), 38 minute(s), 57 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 31
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 15
Files Infected: 15
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{D518921A-4A03-425E-9873-B9A71756821E} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45dd-9B68-D6A12C30E5D7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48dd-9B6D-7A13A3E42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40fd-8DAE-FF14757F60C7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
c:\documents and settings\chris schofield\application data\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\funwebproducts\Data (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\funwebproducts\Data\chris schofield (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Settings (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\program files\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\screensaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\screensaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\funwebproducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\spywarebot (Rogue.SpywareBot) -> Quarantined and deleted successfully.
Files Infected:
c:\program files\windows live\messenger\msimg32.dll (PUP.FunWebProducts) -> Not selected for removal.
c:\program files\windows live\messenger\riched20.dll (PUP.FunWebProducts) -> Not selected for removal.
c:\documents and settings\chris schofield\application data\funwebproducts\Data\chris schofield\avatar.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\funwebproducts\Data\chris schofield\outfit.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\funwebproducts\Data\chris schofield\zbucks.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\rs.dat (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Log\2008 jan 14 - 11_22_51 pm_937.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Log\2008 jan 14 - 11_22_57 pm_578.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Log\2008 jan 15 - 03_00_00 am_078.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Log\2008 jan 15 - 03_00_00 am_187.log (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\documents and settings\chris schofield\application data\spywarebot\Settings\scanresults.pie (Rogue.SpywareBot) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
c:\program files\mywebsearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.

GunJack

I'd highly recommend you remove avg (uninstall, then run the avg removal tool from avg website at least twice), install avira or avast antivirus (get either from filehippo), and run combofix (from bleepingcomputer.com) on that machine... then post the combofix log back here.

RussJK

Well done on getting safe mode working and fixing things. In addition to the AVG removal tool, Appremover also has an option to "check for failed uninstall" which can help cleanup (https://www.appremover.com).

If you install Avira, make sure you select it to scan for "fraudulent software" when it shows the threat categories, so it will protect against the kinds of threats you just removed. I would also set the heuristics to high whether you install Avira or Avast, and use something like virustotal.com to help decide if a threat is a false positive of a true positive.

schofy

Cheers guys, Why do I remove Avg exactly, Is it pants when it comes to free anti virus programs.
What is the Avira one? Again I really am glad for all assistance

RussJK

schofy wrote: »

Cheers guys, Why do I remove Avg exactly, Is it pants when it comes to free anti virus programs.
What is the Avira one? Again I really am glad for all assistance

AVG isn't terrible, but it is quite inconsistent and not as good as the others in performance or effectiveness. Avast is a good easy package for the average user, and nearly a full suite for free. It is considered to be one of the lightest antivirus programs in terms of resource usage. Avira Antivir free is a superior antivirus to the others, but the free version doesn't include a webfilter (but still scans for files downloaded) and it features a nag screen which has to be manually disabled (easy to search for how to do this though). It is the best out of the three for detecting unknown malware, but the price of this is the occasional false positive.

http://www.avast.com/en-gb/index > Avast free
http://www.avira.com/en/avira-free-antivirus > Avira Antivir Free

schofy

would it benefit having more than one anti virus software or would they conflict each other?

RussJK

schofy wrote: »

would it benefit having more than one anti virus software or would they conflict each other?

Traditional antivirus programs will conflict with each other.

Something like Malwarebytes Pro with the realtime guard will work happily alongside an antivirus, and catch the kind of threats that antivirus programs easily miss (http://forum.moneysavingexpert.com/showthread.php?t=3168692).

The other approach is using a web filter of some kind:

• Hosts protection, using something like MVPS (http://www.mvps.org/winhelp2002/hosts.htm) or the more frequently updated MalwareDomainList (http://www.malwaredomainlist.com/) - or use Hostsman to automate the process of joining both lists together (http://www.abelhadigital.com/hostsman). You just have to remember to update the list every so often.
• a web filter using an alternate DNS server like ClearCloudDNS (http://www.clearclouddns.com/). Can potentially slow down browsing, but is very fast for me - the best test is a streaming site like youtube. The advantage is you never have to update the filter list yourself.
• Adblock Plus in Firefox with Easylist (to stop ads, including malware infected ads), and MalwareDomains list to block content from known malware sites (https://adblockplus.org/en/subscriptions).

aliEnRIK

Youve had/have trojans

As jack suggested -
Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out

If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
(If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)