Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed ForumsSystem AdministrationAntivirus Protection

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old November 1st, 2010, 07:01 AM
Olivio Olivio is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Mar 2008
Posts: 10 Olivio User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 2 h 41 m 23 sec
Reputation Power: 0
Koobface infection, trying to confirm it's gone

My computer was infected with this and maybe something else. I cleaned it with Avast but there have been traces of the virus found on mbam. I'm not sure if I still have an infection of this or something else because my system is still choppy. Scan logs below:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5002

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/30/2010 7:59:33 PM
mbam-log-2010-10-30 (19-59-33).txt

Scan type: Quick scan
Objects scanned: 133913
Time elapsed: 8 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntiVirus) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\User\Local Settings\Application Data\048102515610049.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Application Data\05010255539799.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Application Data\0535049569854.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Application Data\053521001005699.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\WINDOWS\bk23567.dat (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\fdgg34353edfgdfdf (KoobFace.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\lgo (Koobface.Trace) -> Quarantined and deleted successfully.
---------------------------------------------

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 10/31/2010 at 05:40 PM

Application Version : 4.45.1000

Core Rules Database Version : 5788
Trace Rules Database Version: 3600

Scan type : Complete Scan
Total Scan Time : 00:59:25

Memory items scanned : 465
Memory threats detected : 0
Registry items scanned : 7166
Registry threats detected : 0
File items scanned : 23714
File threats detected : 53

Adware.Tracking Cookie
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.doubleclick.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.collective-media.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.atdmt.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.legolas-media.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.apmebf.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.mediaplex.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.tribalfusion.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.content.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
ad.yieldmanager.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
pixel.invitemedia.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.advertising.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.yieldmanager.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.a1.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.interclick.com [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
.revsci.net [ C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\by9x6wbr.default\cookies.sqlite ]
-------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:39:37 PM, on 10/31/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\DOCUME~1\User\LOCALS~1\Temp\IHU2.tmp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Google Update Service (gupdate1c9b3b0185648f6) (gupdate1c9b3b0185648f6) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5984 bytes
---------------------------------------------

I also did the BitDefender online scan and it didn't turn up any virus.

Thanks for taking a look.

Reply With Quote
  #2  
Old November 22nd, 2010, 12:39 AM
SofiaBrown SofiaBrown is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Nov 2010
Posts: 1 SofiaBrown User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 12 m 6 sec
Reputation Power: 0
RE: Koobface infection, trying to confirm it's gone

Download Malwarebytes' Anti-Malware to your desktop and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
Make sure that you restart the computer.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Reply With Quote
Reply

Viewing: Dev Shed ForumsSystem AdministrationAntivirus Protection > Koobface infection, trying to confirm it's gone

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap