WiredWX Hobby Weather ToolsLog in

 


please help me remove BankerFox.A, Win32/Nuqel.E

3 posters

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
goodnight. and yes i already have noticed the difference. thank you very much. i don't know what the new DDS log is but here are the other 2

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
GooredFix v1.9 by jpshortstuff
Log created at 21:17 on 10/02/2009 running Option #2 (Tom)
Firefox version 3.0.5 (en-US)

=====Goored Deletions=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{A231DEC6-4D7F-4533-B282-B606EAB2192E}"="C:\Documents and Settings\Tom\Local Settings\Application Data\{A231DEC6-4D7F-4533-B282-B606EAB2192E}"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Tom\Local Settings\Application Data\{A231DEC6-4D7F-4533-B282-B606EAB2192E}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
Malwarebytes' Anti-Malware 1.33
Database version: 1747
Windows 5.1.2600 Service Pack 2

2/10/2009 10:07:39 PM
mbam-log-2009-02-10 (22-07-39).txt

Scan type: Quick Scan
Objects scanned: 53728
Time elapsed: 10 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d5bf4552-94f1-42bd-f434-3604812c807d} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Explorer.exe (Security.Hijack) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xmutibebax (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\Microsoft Common (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\Temp\rdl4.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdl11.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdl1F.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdl23.tmp (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\WINDOWS\efufeyuz.dll (Trojan.Agent) -> Delete on reboot.

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
i found the DDS here is the new log



DDS (Ver_09-02-01.01) - NTFSx86
Run by Tom at 22:17:45.96 on Tue 02/10/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.309 [GMT -5:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aim toolbar\aimtbServer.exe
C:\Documents and Settings\Tom\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.myspace.com/
uWindow Title = Windows Internet Explorer provided by MySpace
uDefault_Page_URL = hxxp://www.myspace.com/
mDefault_Page_URL = hxxp://www.myspace.com/
mStart Page = hxxp://www.myspace.com/
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Diner%20Dash%20-%20Hometown%20Hero/Images/armhelper.ocx
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\l7szotge.default\
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: XUL Cache: {21222C22-ABB2-4504-AF39-6A7DB9A9E4DA} - c:\documents and settings\tom\local settings\application data\{21222c22-abb2-4504-af39-6a7db9a9e4da}\

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2009-2-10 11840]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2009-2-10 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2009-2-10 151297]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2009-2-10 52032]

=============== Created Last 30 ================

2009-02-10 21:51 --d----- c:\docume~1\tom\applic~1\Malwarebytes
2009-02-10 21:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-10 21:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 21:51 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-10 21:51 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-10 19:47 --d----- c:\program files\Avira
2009-02-10 19:47 --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-02-10 18:16 15,000 a------- c:\windows\system32\rah3b8ffdnd.dll
2009-02-10 18:15 43,008 a------- c:\windows\Ynebupise.dll
2009-02-08 10:57 --d----- c:\documents and settings\Tom
2009-02-01 16:39 --d----- c:\program files\ValuSoft
2009-01-30 12:44 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-01-30 12:44 15,464 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-30 12:43 --d----- c:\program files\iPod
2009-01-30 12:43 --d----- c:\program files\iTunes
2009-01-30 12:43 --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-30 12:43 --d----- c:\program files\Bonjour
2009-01-30 12:40 32,000 a------- c:\windows\system32\drivers\usbaapl.sys
2009-01-19 11:51 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-19 11:51 73,728 a------- c:\windows\system32\javacpl.cpl
2009-01-19 11:48 --d----- c:\windows\system32\CatRoot_bak
2009-01-19 11:48 --d----- c:\program files\LimeWire
2009-01-19 11:47 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-01-19 11:47 272,128 -------- c:\windows\system32\drivers\bthport.sys

==================== Find3M ====================


============= FINISH: 22:18:17.50 ===============

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
well i have to go to school so i'll be back in about 8 hours. i don't if we're done but everything seems to be fine. thank you for everything you really saved my butt Thank You!

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
Hello.
This looks so much better.

Need you ro run option 2 in Gooredfix again, the goored infection managed to sneak back in while we were removing it.

Refer to my other post if you need the Gooredfix instructions.
http://www.geekpolice.net/virus-spyware-malware-removal-f11/please-help-me-remove-bankerfoxa-win32-nuqele-t6613.htm#40792

Once you have done that, there's a few more files to remove.

Please download the OTMoveIt3 by OldTimer.

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


    :files
    c:\windows\system32\rah3b8ffdnd.dll
    c:\windows\Ynebupise.dll
    c:\program files\LimeWire


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log, along with the NEW Gooredfix log.

I also need to see a new DDS log, you may have a new variant of Goored.

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
alright im back. so are we done or is there something else i have to do? i just want to know because the computer is my friends and i was just borrowing it for the night so i want to make sure that everything is good.
thanks again

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
o i didnt know there was another page so nvm my last post

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
GooredFix v1.9 by jpshortstuff
Log created at 15:07 on 11/02/2009 running Option #2 (Tom)
Firefox version 3.0.5 (en-US)
(Subsequent Run)

=====Goored Deletions=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{21222C22-ABB2-4504-AF39-6A7DB9A9E4DA}"="C:\Documents and Settings\Tom\Local Settings\Application Data\{21222C22-ABB2-4504-AF39-6A7DB9A9E4DA}\"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Tom\Local Settings\Application Data\{21222C22-ABB2-4504-AF39-6A7DB9A9E4DA}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.5\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"



========== FILES ==========
c:\windows\system32\rah3b8ffdnd.dll NOT unregistered.
c:\windows\system32\rah3b8ffdnd.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\Ynebupise.dll
c:\windows\Ynebupise.dll NOT unregistered.
c:\windows\Ynebupise.dll moved successfully.
c:\program files\LimeWire\root\magnet10 moved successfully.
c:\program files\LimeWire\root moved successfully.
c:\program files\LimeWire\lib moved successfully.
c:\program files\LimeWire\.NetworkShare moved successfully.
Folder move failed. c:\program files\LimeWire scheduled to be moved on reboot.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02112009_150922

Files moved on Reboot...
Folder move failed. c:\program files\LimeWire scheduled to be moved on reboot.



DDS (Ver_09-02-01.01) - NTFSx86
Run by Tom at 15:15:42.78 on Wed 02/11/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.301 [GMT -5:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\program files\aim toolbar\aimtbServer.exe
C:\Documents and Settings\Tom\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.myspace.com/
uWindow Title = Windows Internet Explorer provided by MySpace
uDefault_Page_URL = hxxp://www.myspace.com/
mDefault_Page_URL = hxxp://www.myspace.com/
mStart Page = hxxp://www.myspace.com/
uURLSearchHooks: AOLSearchHook Class: {54eb34ea-e6be-4cfd-9f4f-c4a0c2eafa22} - c:\program files\aim search\AOLSearch.dll
mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll
TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ATIModeChange] Ati2mdxx.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [RealTray] c:\program files\real\realplayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0b83c99c-1efa-4259-858f-bcb33e007a5b} - {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file:///C:/Program%20Files/Diner%20Dash%20-%20Hometown%20Hero/Images/armhelper.ocx
Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\tom\applic~1\mozilla\firefox\profiles\l7szotge.default\
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2009-2-10 11840]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2009-2-10 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2009-2-10 151297]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2009-2-10 52032]

=============== Created Last 30 ================

2009-02-11 15:09 --d----- C:\_OTMoveIt
2009-02-10 21:51 --d----- c:\docume~1\tom\applic~1\Malwarebytes
2009-02-10 21:51 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-10 21:51 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-10 21:51 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-10 21:51 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-10 19:47 --d----- c:\program files\Avira
2009-02-10 19:47 --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-02-08 10:57 --d----- c:\documents and settings\Tom
2009-02-01 16:39 --d----- c:\program files\ValuSoft
2009-01-30 12:44 107,368 a------- c:\windows\system32\GEARAspi.dll
2009-01-30 12:44 15,464 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-01-30 12:43 --d----- c:\program files\iPod
2009-01-30 12:43 --d----- c:\program files\iTunes
2009-01-30 12:43 --d----- c:\docume~1\alluse~1\applic~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-30 12:43 --d----- c:\program files\Bonjour
2009-01-30 12:40 32,000 a------- c:\windows\system32\drivers\usbaapl.sys
2009-01-19 11:51 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-19 11:51 73,728 a------- c:\windows\system32\javacpl.cpl
2009-01-19 11:48 --d----- c:\windows\system32\CatRoot_bak
2009-01-19 11:48 --d----- c:\program files\LimeWire
2009-01-19 11:47 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-01-19 11:47 272,128 -------- c:\windows\system32\drivers\bthport.sys

==================== Find3M ====================


============= FINISH: 15:16:14.90 ===============

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
Hello.
This looks so much better now.

Click Start >> Run and then copy/paste the following into the box and hit Enter:
"%userprofile%\Desktop\GooredFix.exe" /uninstall
note the space between " and /
If any of your security programs query a new Registry/AutoStart value being added please allow the changes.

  • Please double-click OTMoveIt3.exe to run it again one final time.
  • Press the green CleanUp! button.
  • Press Yes cleanup process prompt.
  • It will start cleaning now, and will want to reboot after, please allow it to do so.
  • It will make a log of what it has removed, but I don't need to see the log.

How is the machine now?

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
hi, i pasted that into the run box and when i hit enter it just opens gooredfix
is there another way to uninstall it?

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
nvm it was just the security warning LOL Banner

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
Hello.
Once you've done that, Gooredfix and OTMoveIt will be gone, but DDS hasn't been included in the CleanUp! routine, so delete it manually.

Please let me know how the machine is running now.

Note:
I see your start page is MySpace. Be careful around MySpace, there are a lot of malware writers that hang around sites like MySpce and Facebook.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck. Big Grin

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
Since this issue has been addressed, a "solved" tag will be added and this topic will be closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.

descriptionSolvedRe: please help me remove BankerFox.A, Win32/Nuqel.E

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum