WiredWX Hobby Weather ToolsLog in

 


Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

2 posters

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
Hello.
The loading point is removed, is it just one removalable drive you think is infected?

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
Yes it is.

But it wasn't plugged in when we did all the clean process.

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
Please download USBNoRisk to your Desktop and run it by double clicking the program's icon.

  1. Wait a couple of seconds for initial scan to finish.
  2. Connect all of your USB storage devices to the PC, one at a time, and keep each one connected at least for 10 seconds.
  3. If there are more USB storage devices to scan, please take a note about the order in which these were connected.
  4. After all the devices are scanned, right click in the Monitor tab, and choose "Save log". That will open the log in Notepad. Please copy and paste the log into this thread.
Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC, e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras, memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
The log! (I think I didn't do it well Let me think )

I plugged in the (same) Hard Drive (the one it could have the virus inside) on each usb port.

It was that?


USBNoRisk 2.5 (26 July 2009) by bobby

Started at 22/02/2010 22:44:28

Searching for connected USB Mass storage...
----------------------------------------
========================================

Searching for other storage...
----------------------------------------
C: {f5053ce0-ff50-11dc-bcee-806d6172696f}
========================================


Scanning fixed storage...
----------------------------------------

No blocked files found on C:
No Autorun.inf files found on C:
No mountpoint found for C:
No mountpoint found for f5053ce0-ff50-11dc-bcee-806d6172696f
----------------------------------------
Desktop.ini found at C:\i386\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
UICLSID={7BD29E00-76C1-11CF-9DD0-00A0C9034933}
----------------------------------------
HKCR\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\DefaultIcon,@ = C:\WINDOWS\system32\ieframe.dll,-20780
HKCR\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\InProcServer32,@ = C:\WINDOWS\system32\ieframe.dll
HKLM\Software\Classes\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\DefaultIcon,@ = C:\WINDOWS\system32\ieframe.dll,-20780
HKLM\Software\Classes\CLSID\{7BD29E00-76C1-11CF-9DD0-00A0C9034933}\InProcServer32,@ = C:\WINDOWS\system32\ieframe.dll
----------------------------------------

========================================
Initial scan finished!
========================================


New device connected at 22/02/2010 22:44:49

Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------

----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------

No mimics found on drive E:
========================================

========================================
Removed E:
========================================


New device connected at 22/02/2010 22:45:22

Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------

----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------

No mimics found on drive E:
========================================

========================================
Removed E:
========================================


New device connected at 22/02/2010 22:46:09

Scanning for connected USB mass storage...
----------------------------------------
E: {5c290f6d-0874-11dd-bcf4-001e37c4a700}
Added E:
========================================

Scanning USB mass storage for files...
----------------------------------------
No blocked files found on E:
----------------------------------------
No Autorun.inf files found on E:
No mountpoint found for E:
No mountpoint found for 5c290f6d-0874-11dd-bcf4-001e37c4a700
----------------------------------------

----------------------------------------
Desktop.ini found at E:\Recycled\ contains interesting CLSID string
----------------------------------------
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
----------------------------------------
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},InfoTip = @%SystemRoot%\system32\SHELL32.dll,-22915
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},IntroText = @%SystemRoot%\system32\SHELL32.dll,-31748
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E},LocalizedString = @%SystemRoot%\system32\SHELL32.dll,-8964
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,@ = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Empty = %SystemRoot%\System32\shell32.dll,31
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon,Full = %SystemRoot%\System32\shell32.dll,32
HKLM\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\InProcServer32,@ = shell32.dll
----------------------------------------

No mimics found on drive E:
========================================

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
Hello.
Looks good, no autorun file found on the removable media. Smile... It's not infected.

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
Yeah, I read that there isn't any autorun.inf, the one Avast 4.8 warning me about the virus, (before updating to the 5.0).

I see I understood it well Big Grin


I'm going to take a look to all the advices of the previous page.

I hope I don't need to contact you again in the future (but only 'cause that'd mean that I got infected again) LOL Banner

So I think that's all. Thank you very much for your help and your patience


Sanddj

descriptionInfected by Nuqel.E, BankerFox.A, unlimited pop-ups - Page 3 EmptyRe: Infected by Nuqel.E, BankerFox.A, unlimited pop-ups

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum