Ok, I did a virus scan and set all my settings to high… I even scanned my archive files…thorough scan. I also did a boot scan and set it to scan archive files- Now, I detected I had multiple virus…most were Frauder-F Trojan Horse. I also had another two that were like adware or something…Now I am on the first steps of curing this and I read another topic posted by another member last year about Frauder- F virus and did a Rootkit scan with Avast Anti-Rootkit… Here is the scan log for that:
avast! Antirootkit, version 0.9.6
Scan started: Sunday, February 01, 2009 9:10:37 PM
The only thing I have not done so far is the system restore item, maybe somebody could give me advice on that aspect of it… Am I supposed to restore to a previous date, am I to do a scan in safe mode or something? Clarification would be nice…
As you can see I found nothing here. I also cannot delete these items, any suggestions you have would be very appreciated…thank you.
Please download HijackThis from the link below. Do not download HJT to the desktop but instead download it into it’s own folder on the hard drive.
Run the program but do not make any fixes and then post the log results using the “copy & paste” method. It will probably take more than one post to be able to get the complete log posted.
OR, you can post it as an attachment to your post by clicking on “Additional Options…” below left of the posting box. Someone will review your log and then offer help.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:18:02 PM, on 2/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
You don’t appear to have an active firewall - It should be capable of blocking unauthorised outbound Internet Connections. - What is your firewall ?
You still have AVG8 or remnants on your system (two resident AVs is a no no) uninstall AVG8 using add remove programs and then run - AVG Remover, download tool from here, http://www.grisoft.com/ww.download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.
Fix:
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
This is related to Yahoo Companion but if it works leave it, if you no longer use it, fix.
This is associated with Bonjour which is normally installed with iTunes or other Apple software, some consider this adware.
C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
I don’t use any Apple software so I don’t know if this can be uninstalled and the other Apple stuff still works.
I have attached a new log file, this time, I removed a lot of programs I am not using anymore, so many of them aren’t showing anymore. (I am doing this all with system restore off, and just want to make sure this is correct) I also did some research and was looking at the “023-service” processes. I found this one and wanted to know more:
The idea of the Prevx link was more informative than curative, to show why I felt it should be fixed and you could look and see if any of the other associated stuff (file names, aliases, etc) might have been present.
The O9 Extra button should be able to have been fixed/removed in HiJackThis, but you would have had to have closed all windows other than HJT, especially browsers as the HJT entries would effectively be live so couldn’t be fixed.
Well I haven’t the slightest idea what it does other than it checks out as a legitimate file (though a file name means very little as it could be anything), so I cant say how it got to be on your system. http://www.threatexpert.com/files/mccicmservice.exe.html
Motive digital life management software is helping wireline, wireless, cable and satellite operators worldwide deliver next generation IP-based services that seamlessly integrate voice, video and data into a single connected experience.
Plus
More than half of the world’s leading communications service providers rely on Motive software including AT&T, Bell Canada, BT, Deutsche Telekom, Telecom Italia, Softbank BB and Verizon.
So from this I can only assume (not good) that it is installed for communication purposes.
You also still have this one a remnant of AVG:
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
So at the fear of repeating myself did you run the AVG removal tool that I suggested, obviously not.
Should consider the Info at www.raymond.cc/blog/archives/2008/02/10/how-to-uninstall-or-remove-bonjour-mdnsresponderexe/ and seriously
consider uninstalling it by using the “Removal Instructions” there .
Info on the raymond.cc Site says an unnecessary “port” is opened on
your computer that malware could come through and AFTER Bonjour is
completely removed, that “port” is closed .
As far as “removing” Bonjour is concerned, you MAY want to consider the Info in the “Update” on the Raymond Site that recommends a wizard tool
available at www.serophos.net/au-revoir-bonjour !?
Hi :