Hello! After a week of hard work for University, I found the time to care for my PC again today.
So, here are the results of the scans I did last week. For easy reading, I will give a short summary of the scan logs and what I did with the files.
AVG Anti-Rootkit, Panda Anti-Rootkit, Blacklight:
No Rootkits found
AVG Anti-Spyware:
C:\Dokumente und Einstellungen\Jule\Lokale Einstellungen\Temp\BDECache\bde108.tmp/bdeinstallman3.exe → Adware.Altnet E:\WINDOWS\SYSTEM\htmdeng.exe → Adware.Aureate
Einstellungen\Temp\BDECache\bde12F.tmp/bdeviewer.exe → Trojan.Krepper.y
Several times found in different files:
C:\WINDOWS\BDE\mskin\Thumbs.db → Adware.BrilliantDigital HKLM\SOFTWARE\DelFin → Adware.Delfin
HKLM\SOFTWARE\DelFin\PromulGate → Adware.Delfin HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DelFin Media Viewer → Adware.Delfin
HKU.DEFAULT\Software\New.net → Adware.NewDotNet
HKU\S-1-5-18\Software\New.net → Adware.NewDotNet
C:\Dokumente und Einstellungen\Jule\Lokale Einstellungen\Temporary Internet Files\Content.IE5\K1O9INWP\nav[2].htm → Not-A-Virus.Exploit.HTML.Mht :
C:\Dokumente und Einstellungen\Jule\Lokale
All of them: Quarantine
Several Tracking Cookies
All of them: Delete
A-Squared free:
E:\WINDOWS\WELCOME.EXE gefunden: Trojan.Win32.ITIS
Quarantine
Most of the Traces were found several times in different files. For summary, I just give you one example for each trace.
C:\WINDOWS\temp\adware gefunden: Trace.Directory.Claria.CommonComponents
C:\Programme\delfin gefunden: Trace.Directory.DelFinMediaViewer
C:\WINDOWS\temp\adware gefunden: Trace.Directory.Gator
Value: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run → promulgate gefunden: Trace.Registry.DelFinMediaViewer
Key: HKEY_LOCAL_MACHINE\software\tat gefunden: Trace.Registry.DelFinMediaViewer
Value: HKEY_CURRENT_USER\Software\XTTB00001\Toolbar\tb_items → Widthcombo11 gefunden: Trace.Registry.Eqiso Toolbar
Value: HKEY_LOCAL_MACHINE\software\kazaa\bandwidth\in → b0 gefunden: Trace.Registry.KaZaA
Key: HKEY_LOCAL_MACHINE\software\classes\netscape starting gefunden: Trace.Registry.MidnightOil
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\New.net → Changed gefunden: Trace.Registry.NewDotNet
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\New.net → SlowInfoCache gefunden: Trace.Registry.NewDotNet
C:\Programme\icqtoolbar gefunden: Trace.Directory.ICQToolbar
C:\Programme\icqtoolbar\version.txt gefunden: Trace.File.ICQToolbar
Value: HKEY_CURRENT_USER\Software\XTTB00001\Toolbar → #EditWidthcombo# gefunden: Trace.Registry.ICQToolbar
All of them: Quarantine
Ad-Aware 32 Personal Edition:
ALEXA
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=RegValue : .DEFAULT\software\microsoft\internet explorer\extensions\cmdmapping “{c95fe080-8f5d-11d2-a20b-00aa003c157a}”
obj[1]=RegValue : S-1-5-18\software\microsoft\internet explorer\extensions\cmdmapping “{c95fe080-8f5d-11d2-a20b-00aa003c157a}”
WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[2]=RegData : regfile\shell\open\command “”
BRILLIANTDIGITAL
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[7]=Regkey : .s3d
obj[8]=File : C:\WINDOWS\System32\bderastmmx3.dll
All of them: Quarantine
TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Several Tracking Cookies, all of them: Delete
Spybot Search & Destroy:
Microsoft.Windows.Security.InternetExplorer: Einstellungen (Registrierungsdatenbank-Änderung, fixed)
HKEY_USERS\S-1-5-21-823518204-1123561945-839522115-1007\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe!=W=1
Alexa Related: Verknüpfung (Datei austauschen, fixed)
C:\WINDOWS\Web\related.htm
All of them: Fixed
Today, I updated the programs again and let them run. Here the results:
AVG Anti-Spyware:
Three Tracking Cookies, all of them: Delete
A-Squared free:
E:\System Volume Information_restore{5EA6301D-1A37-473F-B471-1EA85C8DD66F}\RP1\A0000001.EXE gefunden: Trojan.Win32.ITIS
Quarantine
Ad-Aware 32 Personal Edition:
TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Several Tracking Cookies, all of them: Delete
Spybot Search & Destroy:
Nothing found
After getting these results, I was quite happy and thought, well, let’s just do another avast! Boot Time Scan, just for security. I expected nothing to be found – but there it went:
Virus found: Win32:Goldun-IF This time, the file is called:
lr86.exe, and there was something written like [UPX] afterwards.
Again! Why? I don’t get this. Last time I scheduled a boot time scan, avast! found some Adware-/Spyware-Gen (as I already wrote). Is there some file left that’s always generating new Trojans on my PC or was this something avast! didn’t detect last time for some reason, but now it’s finally over?
To ask it directly: Am I secure now or do I have to do anything else? Again some boot time scan after having disabled System Restore, for example?
And another question: Since I installed all those Anti-Spyware Programs on my PC, it’s booting very, very slowly. Do I have to keep all of them or is it okay if I uninstall several of them? Which one should I keep?
By the way, I ran HiJackThis again. The log is below.
@Spiritsongs:
No, I didn’t run it in safe mode (that is, if you mean the safe mode you can start when pressing F8 while the PC is booting), but I didn’t have SP2 installed back then. After having installed it, there are many more running processes in the log, as you can see… is this normal? Is this why my PC is booting so slowly? And can I change this somehow?!
