Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:24:06 AM, on 12/17/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Wait…i found it… It’s comodo BOClean detected it. Sorry for the mistake.
12/17/2008 00:41:34: RSK-NIRCMD.SAA VARIANT STOPPED BY BOCLEAN!
Trojan horse was found in memory.
C:\32788R22FWJFW\NIRCMD.COM contained the trojan.
Active trojan horse WAS shut down. System safe.
Logged in user: Owner
12/17/2008 00:42:00: RSK-NIRCMD.SAA VARIANT STOPPED BY BOCLEAN!
Trojan horse was found in memory.
C:\COMBOFIX\NIRCMD.COM contained the trojan.
Active trojan horse WAS shut down. System safe.
Logged in user: Owner
12/17/2008 00:42:06: RSK-NIRCMD.SAA VARIANT STOPPED BY BOCLEAN!
Trojan horse was found in memory.
C:\COMBOFIX\NIRCMD.CFEXE contained the trojan.
Active trojan horse WAS shut down. System safe.
Logged in user: Owner
12/17/2008 00:43:22: RSK-NIRCMD.SAA VARIANT STOPPED BY BOCLEAN!
Trojan horse was found in memory.
C:\WINDOWS\NIRCMD.EXE contained the trojan.
Active trojan horse WAS shut down. System safe.
Logged in user: Owner
A question,should i post Hijack this Log while in safe mode without networking and command prompt?
Ok i see,that’s means that previous Hijack this log in normal mode is alright? ,back to the topic.
Then since Comodo BOClean detected it,and the log is safe so my computer is safe?
There could be an element of doubt in the detection as there are some hits which show this might be a tool being detected as malicious because of what it does/can do (not unusual for tools like this to get pinged).
Firstly thank you,really appreciated it. Secondly i found this post at bleeping computer forum.
''NirCmd is a command-line utility that allows writing to and deletion of values and keys in the registry. BOClean targets nircmd.exe while CF is unpacking, and while it’s trying to run. Panda, Sophos and others target NirSoft tools as well.
Certain files that are part of the combofix tool such as nircmd.exe may at times be detected by some anti-virus as a “RiskTool”, "Hacking tool, “Potentially unwanted tool” or even “Spyware-Adware”. Anti-virus programs cannot distinguish between “good” and “malicious” use of such programs, therefore they may alert the user or even remove them.
Such programs may have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. Potentially unwanted does not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others.‘’
Is it true? reliable? i don’t know much about this since this is the first time i use ComboFix.
That is one similar to on I read in the google search I posted, hence my comment about tools.
Combofix is a valued tool and it comes with tools to help it do its job, the problem really lies with BoClean a HIPS which is looking at behaviour and this behaviour could be deemed at least suspicious. But a tool in the hands of a craftsman does a lot of good but in the hands of a vandal does a lot of damage. It is hard for security applications to tell who is using the tool and for what purpose.
Well firstly I haven’t run the SDFix tool, so I don’t know what reason your feel that you need to use it for, if it is merely to clean up combofix I’m not even sure it does that.
Combofix is a powerfull tool and does sometimes have false positives, which if you do not know how the programme works, you will not know how to restore any files. For a general clean use Malwarebytes Anti Malware. Specialist tools can sometimes go wrong so I would recommend only using them under supervision
