Ramsy
June 21, 2009, 1:17am
1
Recently my son had his MMO account comprimised so I have been checking for viruses on our computer. After reading several posts I did have a MBAM log and here it is. Any help would be greatly appreciated -- Thank you !!
Malwarebytes' Anti-Malware 1.38
6/20/2009 7:54:51 PM
Scan type: Full Scan (C:\|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Ramsy
June 21, 2009, 2:18am
2
Hmm I have Norton's 360 running - I just installed it yesterday but ran that log today.
Ramsy
June 21, 2009, 2:24am
3
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
Can you send the rest of the log in another post?
Ramsy
June 21, 2009, 3:11am
5
Sorry I ran another scan I hope this is the entire thing this time - sorry about the last one . Thanks again for your help!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.ietoolexpress.com/redirect.php (file missing)http://www.ietoolexpress.com/redirect.php (file missing)https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab http://aolcc.aol.com/computercheckup/qdiagcc.cab https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146302543578 http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab http://www.popcap.com/games/popcaploader_v6.cab http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
--
Hi Ramsy:
Got her that time. I have requested someone much more skilled than I am to look at your log. There may be some other software that we will ask you to run later. There may be some hidden files that need to be identified that will not show up in most antimalware scans.
Ramsy
June 21, 2009, 3:50am
7
Thank you again for your help with this, it is greatly appreciated !!
Ramsy
June 21, 2009, 1:17am
8
Recently my son had his MMO account comprimised so I have been checking for viruses on our computer. After reading several posts I did have a MBAM log and here it is. Any help would be greatly appreciated -- Thank you !!
Malwarebytes' Anti-Malware 1.38
6/20/2009 7:54:51 PM
Scan type: Full Scan (C:\|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Ramsy,
Please go back into HJT and check the following and delete them:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1http://www.ietoolexpress.com/redirect.php (file missing)http://www.ietoolexpress.com/redirect.php (file missing)http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,96/mcinsctl.cab http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
When you get through with that please follow the directions on this page to remove this entry; do not try to do this in HiJackThis
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
After you have done all these, please follow the Safe Mode scanning in these steps and report the log file back here. Thanks.
Boot into Safe Mode:
Quads
June 21, 2009, 4:02am
10
"O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll" is actually OK
Quads
Only if using Netware which they are not.
Ramsy
June 21, 2009, 5:31am
12
Ok I deleted what you had said to delete and ran another MBAM log. Thanks again for all your help!
Malwarebytes' Anti-Malware 1.38
6/21/2009 12:20:57 AM
Scan type: Full Scan (C:\|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Ramsy
June 21, 2009, 5:33am
13
Here is also the new HIJACK this log
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab http://aolcc.aol.com/computercheckup/qdiagcc.cab https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146302543578 http://www.popcap.com/games/popcaploader_v6.cab http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
--
The logs look clean. From here, run a manual Live Update for N360 until it tells you there are no more updates available for it. Then restart your system and enter Safe Mode. Double click on the N360 desktop icon. A message box will appear that states "N360 can not run in safe mode. Would you like to run a full scan?" Answer Yes and then let us know if it finds anything other than tracking cookies.
Other than that, just keep the programs updated (you will have to manually do that for MBAM) and run a scan every now and then with MBAM to keep a double check.
Ramsy
June 21, 2009, 11:59am
15
Thanks for all your help – We have another PC which is networked together with the one I ran the scans on here. Should I post those scans here or start another post?
Post the HJT log for the second computer here, so that the name is easily located.
Ramsy
June 21, 2009, 7:32pm
17
Here is the HJT log for the second computer. Thanks!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0061215 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://dev.srtest.com/srl_bin/sysreqlab3.cab http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
--
I will see if I can get hold of one of our analysts for a look. These logs make my eyes cross.
Ramsy -
In HJT, check and delete / fix the following:
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
Other than that it looks very clean. You could run the Malwarebytes AntiMalware Safe Mode scan on it and the N360 Safe Mode scan also but I would say this system was spared.
If the scans come up clean, then you should be in good shape on your systems. If the MMO account was compromised, you may want to check on changing the account passwords or setting up a new account entirely.
delphinium -
Cross-eyed fish are usually not a good thing as they swim into rocks and coral (ouch). Glad to help out here and keep everyone on the 'straight and narrow'.
Message Edited by dbrisendine on 06-21-2009 05:09 PM
Ramsy
June 21, 2009, 11:47pm
20
Thanks again for everything and taking the time to help me out this weekend !!