CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

TR/XPassLogger

 
Post new topic   Reply to topic       All -> FavForums -> AntiVir Personal Edition Classic [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
P7755

Mozilla Host
Premium Member

Joined: Aug 02, 2004
Posts: 801

Premium

PostPosted: Thu Jan 27, 2005 10:39 pm    Post subject: TR/XPassLogger
Reply with quote

Hey just updated and ran AVPE. It found an infected file:A0001829. It said infected files in archives will not be deleted or repaired. The detection was TR/XPassLogger. I searched around with ways to remove it but didnt find any. I think this virus is farley new. Just wondering how to rid myself of this baddy. I'm working on the problem now, and by the time you respond I may have the problem fixed, yet If I can't find a solution I want one asap to fix my system. I ran a full scan 3 days ago, no viruses. And I attached a summary of the scan. It looks like I have some other bad stuff too, I see the word gator. Also in my log is the ebay toolbar. I installed this and then uninstalled it, so why is there still stuff about it on my system? Thanks!


_________________
Get Firefox
Get Paypal for Business
Get Love
Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger
P7755

Mozilla Host
Premium Member

Joined: Aug 02, 2004
Posts: 801

Premium

PostPosted: Thu Jan 27, 2005 10:45 pm    Post subject:
Reply with quote

I see I cant attatch a note pad document, so here it is. Downsised as much as possible. I didnt know if any thing below might be important.
Start of scan: Thursday, January 27, 2005 16:36
Memory test OK
Master boot record of hard disk HD0 OK
Master boot record of hard disk HD1 OK
Boot record of drive C: OK
Boot record of drive E: OK
C:\
pagefile.sys
Access denied! Error during file opening!
This is a Windows swap file. This file is locked by Windows.
Error code: 0x000D
WARNING! Access error/file locked!
C:\WINDOWS\SYSTEM32\config
DEFAULT
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SECURITY
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SOFTWARE
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SYSTEM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
SAM
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\WINDOWS\SoftwareDistribution\EventCache
{8D2F84D6-DAF9-4AFC-88A9-517B6E2C01E3}.bin
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
{65DDB753-1B62-4C36-9D97-2F5C3E77F02B}.bin
Access denied! Error during file opening!
Error code: 0x000D
WARNING! Access error/file locked!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
DSSAgent3.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent6.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
AlexaRelated.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent7.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent8.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent9.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit16.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit17.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit18.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit19.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit3.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit20.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar20.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit4.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar21.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar22.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSSAgent.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar23.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSSAgent1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit21.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSSAgent2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit22.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit23.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit24.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit25.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar24.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar25.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar26.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar3.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar27.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar28.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar4.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar29.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar30.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar5.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar31.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit26.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar6.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit27.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit28.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar7.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit29.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit30.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar8.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar32.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar33.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar9.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar34.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar35.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
GAINDashBar.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit31.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit32.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
GAINGator.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit33.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit34.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
GAINGator1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit35.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar36.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar37.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent1.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar38.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent2.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar39.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent3.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit36.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar10.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit37.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit38.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar11.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit39.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit40.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar12.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit41.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar40.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar13.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar41.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar42.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar14.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar43.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar44.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar15.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit42.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit43.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit5.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit44.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit45.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit6.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit46.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit7.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit8.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit9.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar16.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar17.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar18.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
eBayToolbar19.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit10.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit11.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit12.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit13.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit14.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
DSOExploit15.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent4.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
WildTangent5.zip
ArchiveType: ZIP
NOTE! The whole archive is password protected
C:\System Volume Information\_restore{FEE25E78-77A4-4CEF-A579-D28B072043C1}\RP10
A0001829.exe
ArchiveType: RAR SFX (self extracting)
--> kbfiltr.sys
[DETECTION] The Trojan horse TR/XPassLogger
End of scan: Thursday, January 27, 2005 17:29
Time taken: 53:23 min
4260 directories were scanned
54827 files were scanned
8 warning messages were issued
0 files were deleted
0 files were repaired
1 detection


_________________
Get Firefox
Get Paypal for Business
Get Love
Back to top
View users profile Send private message Visit posters website AIM Address Yahoo Messenger
mrrockford

News Admin
News Admin
AVPE Host
AVPE Host

Joined: Apr 24, 2004
Posts: 3010

Forums Admin MVP Premium Team F@H

PostPosted: Fri Jan 28, 2005 1:58 am    Post subject:
Reply with quote

Howdy,

Post an HJT log in the HJT forum with a link back here. You have/had active wildtangent and that what you mentioned although it was found in restore. Let the experts look over your HJT log and then get back to me.


_________________
"Anyone who considers protocol unimportant has never dealt with a cat."

L. Long
Back to top
View users profile Send private message Visit posters website
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> AntiVir Personal Edition Classic All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer