Trojan.small.fb need help [Solved]

Unknown
edited August 2006 in Spyware & Virus Removal
read about how to fix on the forum but need help in what files to delete and here are my reports from Fixwareout and Hijackthis


Fixwareout ver 1.003
Last edited 8/11/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\}A577B97D81A6-550B-7D34-58C0-852A6005{
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\gajmd
...

Microsoft (R) Windows Script Host Version 5.6
Random Runs removed from HKLM
...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...
* csr.exe C:\WINDOWS\System32\CSTQB.EXE

»»»»»
Search five digit cs, dm and jb files.
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSTQB.EXE 51,285 2006-08-15
C:\WINDOWS\SYSTEM32\DMJAG.EXE 62,029 2004-08-04

Other suspects.
Directory of C:\WINDOWS\system32

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.


Logfile of HijackThis v1.99.1
Scan saved at 2:07:34 PM, on 8/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\BigB\Desktop\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [dmmge.exe] C:\WINDOWS\system32\dmmge.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1E0D069B-6075-414F-B110-884CDDE3C3AE}: NameServer = 85.255.113.94,85.255.112.225
O17 - HKLM\System\CCS\Services\Tcpip\..\{ED04BBFB-997C-4FE2-A483-8AE863ACE54C}: NameServer = 85.255.113.94,85.255.112.225
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.94 85.255.112.225
O17 - HKLM\System\CS1\Services\Tcpip\..\{1E0D069B-6075-414F-B110-884CDDE3C3AE}: NameServer = 85.255.113.94,85.255.112.225
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.94 85.255.112.225
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe

Comments

  • jmoney3457jmoney3457 Maine
    edited August 2006
    hi billy, welcome, goodjob on the wareout just a few more things to take care of 1st please do a system scan only in HJT and fix *check* the following items (also make sure NO windows especially browsers are open during the fix):O17 - HKLM\System\CCS\Services\Tcpip\..\{1E0D069B-6075-414F-B110-884CDDE3C3AE}: NameServer = 85.255.113.94,85.255.112.225
    O17 - HKLM\System\CCS\Services\Tcpip\..\{ED04BBFB-997C-4FE2-A483-8AE863ACE54C}: NameServer = 85.255.113.94,85.255.112.225
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.94 85.255.112.225
    O17 - HKLM\System\CS1\Services\Tcpip\..\{1E0D069B-6075-414F-B110-884CDDE3C3AE}: NameServer = 85.255.113.94,85.255.112.225
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.94 85.255.112.225
    reboot and do the following-->First download ewido anti-spyware from HERE and save that file to your desktop.
    This is a 30 day trial of the program
    1. Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
    2. Once the setup is complete you will need run ewido and update the definition files.
    3. On the main screen select the icon "Update" then select the "Update now" link.
      • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
    4. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
    5. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
    6. Under "Reports"
      • Select "Automatically generate report after every scan"
      • Un-Select "Only if threats were found"
    Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
    1. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
      IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
    2. Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
    3. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
    4. ewido will now begin the scanning process, be patient this may take a little time.
      Once the scan is complete do the following:
    5. If you have any infections you will prompted, then select "Apply all actions"
    6. Next select the "Reports" icon at the top.
    7. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
    8. Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan & new Hjt log please:)
  • BillyBob2k3
    edited August 2006
    ewido anti-spyware - Scan Report

    + Created at: 3:38:00 AM 8/18/2006

    + Scan result:



    [180] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning.
    [320] VM_00390000 -> Downloader.Agent.uj : Error during cleaning.
    [332] VM_008A0000 -> Downloader.Agent.uj : Error during cleaning.
    [352] VM_00880000 -> Downloader.Agent.uj : Error during cleaning.
    [364] VM_00880000 -> Downloader.Agent.uj : Error during cleaning.
    [744] VM_00D70000 -> Downloader.Agent.uj : Error during cleaning.
    [772] VM_00F20000 -> Downloader.Agent.uj : Error during cleaning.


    ::Report end


    Logfile of HijackThis v1.99.1
    Scan saved at 8:58:03 PM, on 8/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\BigB\Desktop\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [dmpry.exe] C:\WINDOWS\system32\dmpry.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
  • jmoney3457jmoney3457 Maine
    edited August 2006
    error during cleaning? hmm that's weird never had that happen before...lets try this please fix the following in hjt then reboot and post new hjt log-->O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dll
    also please do this for me-->Please do an online scan with Kaspersky WebScanner
    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    The program will launch and then begin downloading the latest definition files:
    Once the files have been downloaded click on NEXT

    Now click on Scan Settings
    In the scan settings make that the following are selected:
    Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)
    Scan Options:
    Scan Archives
    Scan Mail Bases
    Click OK
    Now under select a target to scan:
    Select My Computer
    The program will start and scan your system.
    The scan will take a while so be patient and let it run.
    Once the scan is complete it will display if your system has been infected.
    Now click on the Save as Text button:
    Save the file to your desktop.
    Copy and paste that information in your next post.
  • BillyBob2k3
    edited August 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 10:02:02 PM, on 8/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\BigB\Desktop\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O4 - HKLM\..\Run: [dmkve.exe] C:\WINDOWS\system32\dmkve.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe

    KASPERSKY ONLINE SCANNER REPORT
    Saturday, August 19, 2006 9:53:45 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.83.0
    Kaspersky Anti-Virus database last update: 20/08/2006
    Kaspersky Anti-Virus database records: 216469

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\

    Scan Statistics:
    Total number of scanned objects: 36536
    Number of viruses found: 8
    Number of infected objects: 19 / 0
    Number of suspicious objects: 0
    Duration of the scan process: 00:12:56

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-15c412cd.zip/Counter.class Infected: Trojan.Java.ClassLoader.i skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-15c412cd.zip/VerifierBug.class Infected: Trojan.Java.ClassLoader.k skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-15c412cd.zip/Beyond.class Infected: Trojan.Java.ClassLoader.k skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\arr3.jar-44f46a26-15c412cd.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5ad4da67-7ffef231.zip/BlackBox.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5ad4da67-7ffef231.zip/VerifierBug.class Infected: Exploit.Java.ByteVerify skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5ad4da67-7ffef231.zip/Beyond.class Infected: Trojan-Downloader.Java.OpenConnection.aa skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\count.jar-5ad4da67-7ffef231.zip ZIP: infected - 3 skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-13f47401-635f3aed.zip/TakePrivileges.class Infected: Trojan.Java.ClassLoader.an skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-13f47401-635f3aed.zip/Installer.class Infected: Trojan-Downloader.Java.Agent.a skipped
    C:\Documents and Settings\BigB\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\ms0311.jar-13f47401-635f3aed.zip ZIP: infected - 2 skipped
    C:\Documents and Settings\BigB\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\BigB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\BigB\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\BigB\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\BigB\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\BigB\ntuser.dat Object is locked skipped
    C:\Documents and Settings\BigB\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009560.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009565.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009582.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009599.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009604.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009610.exe Infected: Trojan-Downloader.Win32.Agent.uj skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009615.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\A0009623.exe Infected: Trojan.Win32.Small.fb skipped
    C:\System Volume Information\_restore{3A4B2611-DB27-4211-AB0B-0692A6EA1C79}\RP55\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{B084F21A-FB67-4389-BCD6-7459F988D7C7}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\dmmxr.exe Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

    Scan process completed.
  • jmoney3457jmoney3457 Maine
    edited August 2006
    ok please clear out the java cache by doing the following:click start>control panel>java icon>general tab>delete files (leave all 3 boxes checked)>click ok then click the update tab>update now>allow it to download and install the newest update reboot then uninstall all previous versions of java via add/remove programs but leave the java version 8 alone that's the newest version after doing all this post back with new hjt log and how the java venture went :)
  • BillyBob2k3
    edited August 2006
    I got all the old Java gone and here is my new HJT log

    Logfile of HijackThis v1.99.1
    Scan saved at 10:37:57 PM, on 8/19/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\BigB\Desktop\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O4 - HKLM\..\Run: [dmqfz.exe] C:\WINDOWS\system32\dmqfz.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: NICSer_WMP11 - Unknown owner - C:\Program Files\Linksys\Wireless-B PCI Adapter\NICServ.exe
  • jmoney3457jmoney3457 Maine
    edited August 2006
    ok, did you also clear out java cache? just making sure as it's important... but now please run this spyware scanner, it basically scans for spyware A-Z and when/if it detects spyware it'll prompt you to either ignore or remove it obviously click remove, let me know if/what it finds-->http://www.xblock.com/download/xclean_micro.exe
  • BillyBob2k3
    edited August 2006
    All it found was something about Gamespyarcade which was already supposed to be deleted and Viewpoint manager toolbar I removed both but the virus is still there. :scratch:
  • jmoney3457jmoney3457 Maine
    edited August 2006
    please go here-->http://virusscan.jotti.org/ and submit these two (2) files for scanning and post back with results for both files:C:\WINDOWS\SYSTEM32\CSTQB.EXE
    C:\WINDOWS\SYSTEM32\DMJAG.EXE
  • BillyBob2k3
    edited August 2006
    The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

    It said that for both of those files
  • jmoney3457jmoney3457 Maine
    edited August 2006
    hmm, try doing it here-->http://www.virustotal.com/en/indexf.html
  • BillyBob2k3
    edited August 2006
    Your file "CSTQB.EXE" is queued in position: 94. Estimated start time is between 8 and 13 minutes.

    Your file "DMJAG.EXE" is queued in position: 99. Estimated start time is between 9 and 14 minutes.

    thats all it said for both
  • jmoney3457jmoney3457 Maine
    edited August 2006
    lets do this billy please send me an email with both of those files as attachments to jmoney3457 AT yahoo dot com obviously replacing the AT with @ and dot with . (can't type it out coz of spammers) :)
  • BillyBob2k3
    edited August 2006
    When I try and attach the files it is saying there is no file of that name available and I went to try to find it and could not locate. I even searched for it and there is no files of that name on my computer. I dont know whats goin on
  • jmoney3457jmoney3457 Maine
    edited August 2006
    try enabling hidden folders/files by going here and following instructions by your OS (xp i assume it is) and then try to locate them again-->http://www.bleepingcomputer.com/tutorials/tutorial62.html
  • BillyBob2k3
    edited August 2006
    Still not there and I have made all files visible.
  • jmoney3457jmoney3457 Maine
    edited August 2006
    is anything in your ewido quarentine?
  • BillyBob2k3
    edited August 2006
    Yea I found the CSTQB.exe in the quarentine thats the Downloader.agent.uj so that one is gone but this Trojan.small.fb is still here and I still dont see that other file name.
  • BillyBob2k3
    edited August 2006
    Thanks for all your help I finally got this thing off my computer I really dont know how I did it but its gone and I appreciate everything this forum is awesome.:respect:
  • jmoney3457jmoney3457 Maine
    edited August 2006
    thank you, are you satisified with the performance of your PC? if so I'll go to the cleanup/prevention part and we'll be done :)
  • BillyBob2k3
    edited August 2006
    Yes very satisfied!!!! Thanks again.:clap:
  • jmoney3457jmoney3457 Maine
    edited August 2006
    your welcome:)-->Your log is clean! Great job!

    Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and enable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Renable system restore with instructions from tutorial above


    Next,

    This process will clean out your Temp files and your Temporary Internet Files. Please do both steps:

    Step 1: Delete Temp Files
    To clean out your temp files, click on Start and then run, and type %temp% and press the ok button.

    This should open up the temp directory that your machine uses. Please delete all files that are found there. If you get an error when deleting a file, skip that file and delete all the others. If you had trouble deleting a file, reboot into Safe Mode and follow this step again. You should now be able to delete all the files.

    Step 2: Delete Temporary Internet Files
    Now I want you to open up Internet Explorer, and click on the Tools menu and then Internet Options. At the General tab, which should be the first tab you are currently on, click on the Delete Files button and put a checkmark in Delete offline content. Then press the OK button. This may take quite a while, so do not be alarmed with how long it takes. When it is done, your Temporary Internet Files will now be deleted.

    Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:
    Simple and easy ways to keep your computer safe and secure on the Internet
This discussion has been closed.