Spybot has asked for a boot time scan, so I’ll do that first, and then an avast one (That’ll be 5+ hours)
I have uninstalled Java to eliminate that as a possible attack… hopefully. Unfortunately I removed Java before trying to analyze for out of date software… which uses Java. D’oh.
As for the firewall situation. XP says that its firewall is running and I have a DLink router as a hardware firewall. I am now running peer guardian 2 to block some ip’s, but I have no idea if it will work.
Mirar is in my add/remove programs. I think thats the software launching the popups but nothing has uninstalled it yet. Is there a tool to specifically remove this?
I have also noticed Vundo on the machine.
Malware bytes latest log:
Malwarebytes’ Anti-Malware 1.30
Database version: 1454
Windows 5.1.2600 Service Pack 3
12/3/2008 1:35:28 PM
mbam-log-2008-12-03 (13-35-28).txt
Scan type: Quick Scan
Objects scanned: 60041
Time elapsed: 5 minute(s), 42 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{
f77bbe3b-9c38-47f6-99d7-b79b453d0f50} (Trojan.Vundo) → Quarantined and
deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{
371ee1ef-f177-1390-7807-08525dc0e55c} (Trojan.Vundo) → Quarantined and
deleted successfully.
HKEY_CLASSES_ROOT\CLSID{55fcbb52-741c-489d-9931-94cc4c4dabc8}
(Trojan.Vundo) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instbndlkeyldr (Trojan.Vundo) →
Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) →
Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\fbxrqtwn.exe (Trojan.FakeAlert) → Quarantined and deleted
successfully.
C:\WINDOWS\system32\tlprbo.dll (Trojan.Vundo) → Quarantined and
deleted successfully.
C:\WINDOWS\system32\iidwiqnq.dll (Trojan.Vundo) → Quarantined and
deleted successfully.
C:\Documents and Settings\Neil\Application Data\TmpRecentIcons\Micro
Antivirus 2009.lnk (Rogue.Link) → Quarantined and deleted
successfully.