Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: TR/FakeSpyPro6  (Read 11452 times)

0 Members and 1 Guest are viewing this topic.

Mikex79

    Topic Starter


    Rookie

    • Computer: Specs
    • Experience: Familiar
    • OS: Windows XP
    Re: TR/FakeSpyPro6
    « Reply #15 on: November 26, 2010, 08:04:05 PM »
    SysProt AntiRootkit v1.0.1.0
    by swatkat

    ******************************************************************************************
    ******************************************************************************************

    No Hidden Processes found

    ******************************************************************************************
    ******************************************************************************************
    Kernel Modules:
    Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys
    Service Name: ---
    Module Base: F3E9C000
    Module End: F3EB4000
    Hidden: Yes

    Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS
    Service Name: ---
    Module Base: F7B37000
    Module End: F7B39000
    Hidden: Yes

    ******************************************************************************************
    ******************************************************************************************
    SSDT:
    Function Name: ZwCreateKey
    Address: F7CBA64E
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwCreateThread
    Address: F7CBA644
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwDeleteKey
    Address: F7CBA653
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwDeleteValueKey
    Address: F7CBA65D
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwEnumerateKey
    Address: F74BDC7E
    Driver Base: F74B8000
    Driver End: F7588000
    Driver Name: sptd.sys

    Function Name: ZwEnumerateValueKey
    Address: F74BDFF6
    Driver Base: F74B8000
    Driver End: F7588000
    Driver Name: sptd.sys

    Function Name: ZwLoadKey
    Address: F7CBA662
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwOpenKey
    Address: F74BDA18
    Driver Base: F74B8000
    Driver End: F7588000
    Driver Name: sptd.sys

    Function Name: ZwOpenProcess
    Address: F7CBA630
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwOpenThread
    Address: F7CBA635
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwQueryKey
    Address: F74BE0C0
    Driver Base: F74B8000
    Driver End: F7588000
    Driver Name: sptd.sys

    Function Name: ZwQueryValueKey
    Address: F74BDF58
    Driver Base: F74B8000
    Driver End: F7588000
    Driver Name: sptd.sys

    Function Name: ZwReplaceKey
    Address: F7CBA66C
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwRestoreKey
    Address: F7CBA667
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    Function Name: ZwSetValueKey
    Address: F7CBA658
    Driver Base: 0
    Driver End: 0
    Driver Name: _unknown_

    ******************************************************************************************
    ******************************************************************************************
    No Kernel Hooks found

    ******************************************************************************************
    ******************************************************************************************
    Hidden files/folders:
    Object: C:\60450fabca005df604\amd64\filterpipelineprintproc.dll
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\msxpsdrv.cat
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\msxpsdrv.inf
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\msxpsinc.gpd
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\msxpsinc.ppd
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\mxdwdrv.dll
    Status: Access denied

    Object: C:\60450fabca005df604\amd64\xpssvcs.dll
    Status: Access denied

    Object: C:\60450fabca005df604\i386\filterpipelineprintproc.dll
    Status: Access denied

    Object: C:\60450fabca005df604\i386\msxpsdrv.cat
    Status: Access denied

    Object: C:\60450fabca005df604\i386\msxpsdrv.inf
    Status: Access denied

    Object: C:\60450fabca005df604\i386\msxpsinc.gpd
    Status: Access denied

    Object: C:\60450fabca005df604\i386\msxpsinc.ppd
    Status: Access denied

    Object: C:\60450fabca005df604\i386\mxdwdrv.dll
    Status: Access denied

    Object: C:\60450fabca005df604\i386\xpssvcs.dll
    Status: Access denied

    Object: C:\Documents and Settings\Mike\Favorites\Gabbeh\¦¦¦¦Creampuff?Doki!?BRIBE 400k+?IRL OPEN!!!  Forum  Gaia Online.url
    Status: Hidden

    Object: C:\Qoobox\BackEnv\AppData.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Cache.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Cookies.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Desktop.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Favorites.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\History.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\LocalAppData.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\LocalSettings.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Music.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\NetHood.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Personal.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Pictures.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\PrintHood.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Profiles.Folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Profiles.Folder.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Programs.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Recent.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SendTo.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SetPath.bat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\StartMenu.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\StartUp.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\SysPath.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\Templates.folder.dat
    Status: Access denied

    Object: C:\Qoobox\BackEnv\VikPev00
    Status: Access denied


    SuperDave

    • Malware Removal Specialist


    • Genius
    • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: TR/FakeSpyPro6
    « Reply #16 on: November 27, 2010, 12:26:18 PM »
    How's your computer working now?

    I'd like to scan your machine with ESET OnlineScan

    •Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
    •Click the button.
    •For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the icon on your desktop.
    •Check
    •Click the button.
    •Accept any security warnings from your browser.
    •Check
    •Push the Start button.
    •ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    •When the scan completes, push
    •Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    •Push the button.
    •Push
    A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

    Windows 8 and Windows 10 dual boot with two SSD's

    Mikex79

      Topic Starter


      Rookie

      • Computer: Specs
      • Experience: Familiar
      • OS: Windows XP
      Re: TR/FakeSpyPro6
      « Reply #17 on: November 27, 2010, 11:18:27 PM »
      It's working but i haven't tried IE on that login . Other programs will run ok.

      C:\Documents and Settings\Mike\Local Settings\Application Data\syssvc.exe   Win32/PSW.Delf.NQS trojan
      C:\Qoobox\Quarantine\C\WINDOWS\system32\cfbxrttn.ini.vir   Win32/Adware.Virtumonde.NEO application
      C:\Qoobox\Quarantine\C\WINDOWS\system32\qeoroqre.ini.vir   Win32/Adware.Virtumonde.NEO application
      C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP697\A0145270.exe   Win32/PSW.Delf.NQS trojan
      C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146805.ini   Win32/Adware.Virtumonde.NEO application
      C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146806.ini   Win32/Adware.Virtumonde.NEO application

      Mikex79

        Topic Starter


        Rookie

        • Computer: Specs
        • Experience: Familiar
        • OS: Windows XP
        Re: TR/FakeSpyPro6
        « Reply #18 on: November 28, 2010, 12:08:15 AM »
        Tried Firefox on that login and it wouldn't run. Error message "Set up for proxy server no connection"

        SuperDave

        • Malware Removal Specialist


        • Genius
        • Thanked: 1020
        • Certifications: List
        • Experience: Expert
        • OS: Windows 10
        Re: TR/FakeSpyPro6
        « Reply #19 on: November 28, 2010, 11:55:05 AM »
        Please run the ESET scan again and, this time, fix the infections.

        Remove the Proxy setting in Internet Explorer and/or in FireFox.
        In Internet Explorer
        • Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously
        In Firefox
        • Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection > Choose "No Proxy"
        • Click the apply button and restart that computer in normal mode.
        Now try FireFox again.
        Windows 8 and Windows 10 dual boot with two SSD's

        Mikex79

          Topic Starter


          Rookie

          • Computer: Specs
          • Experience: Familiar
          • OS: Windows XP
          Re: TR/FakeSpyPro6
          « Reply #20 on: November 28, 2010, 01:37:20 PM »
          When ESET tries to update the virus signature database I get an error that reads.....Cannot get update. Is proxy configured?.......... I disabled avira and the firewall (online Armor) but still no luck. Should I uninstall ESET and retry? I have not changed anything yet as far as IE or Firefox and did not have this problem the first time I ran ESET.
          « Last Edit: November 28, 2010, 01:49:04 PM by Mikex79 »

          Mikex79

            Topic Starter


            Rookie

            • Computer: Specs
            • Experience: Familiar
            • OS: Windows XP
            Re: TR/FakeSpyPro6
            « Reply #21 on: November 28, 2010, 03:00:51 PM »
            OK got ESET running....

            Thanks.

            Mikex79

              Topic Starter


              Rookie

              • Computer: Specs
              • Experience: Familiar
              • OS: Windows XP
              Re: TR/FakeSpyPro6
              « Reply #22 on: November 28, 2010, 07:47:13 PM »
              C:\Qoobox\Quarantine\C\WINDOWS\system32\cfbxrttn.ini.vir   Win32/Adware.Virtumonde.NEO application   cleaned by deleting - quarantined
              C:\Qoobox\Quarantine\C\WINDOWS\system32\qeoroqre.ini.vir   Win32/Adware.Virtumonde.NEO application   cleaned by deleting - quarantined
              C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP697\A0145270.exe   Win32/PSW.Delf.NQS trojan   cleaned by deleting - quarantined
              C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146805.ini   Win32/Adware.Virtumonde.NEO application   cleaned by deleting - quarantined
              C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP699\A0146806.ini   Win32/Adware.Virtumonde.NEO application   cleaned by deleting - quarantined
              C:\System Volume Information\_restore{8D4B012C-17CB-4D5E-B44D-75EF458DEC16}\RP703\A0148602.exe   Win32/PSW.Delf.NQS trojan   cleaned by deleting - quarantined

              Mikex79

                Topic Starter


                Rookie

                • Computer: Specs
                • Experience: Familiar
                • OS: Windows XP
                Re: TR/FakeSpyPro6
                « Reply #23 on: November 28, 2010, 08:26:26 PM »
                Ok that seems to have everything back to normal. Java updated, firewall installed, Firefox updated, windows messenger removed, recovery console installed, Viewpoint removed..........
                Just 1 more question. How many of these new programs should I keep?

                Thanks so much for your help.

                Mike.

                SuperDave

                • Malware Removal Specialist


                • Genius
                • Thanked: 1020
                • Certifications: List
                • Experience: Expert
                • OS: Windows 10
                Re: TR/FakeSpyPro6
                « Reply #24 on: November 29, 2010, 03:58:46 PM »
                Quote
                Just 1 more question. How many of these new programs should I keep?
                You can uninstall HJT but you may keep SAS and MBAM. Update them and run them regularly.

                * Click START then RUN - Vista users press the Windows Key and the R keys together for the Run box.
                * Now type commy /uninstall in the runbox
                * Make sure there's a space between commy and /Uninstall
                * Then hit Enter

                * The above procedure will:
                * Delete the following:
                * ComboFix and its associated files and folders.
                * Reset the clock settings.
                * Hide file extensions, if required.
                * Hide System/Hidden files, if required.
                * Set a new, clean Restore Point.
                *******************************
                Clean out your temporary internet files and temp files.

                Download TFC by OldTimer to your desktop.

                Double-click TFC.exe to run it.

                Note: If you are running on Vista, right-click on the file and choose Run As Administrator

                TFC will close all programs when run, so make sure you have saved all your work before you begin.

                * Click the Start button to begin the cleaning process.
                * Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
                * Please let TFC run uninterrupted until it is finished.

                Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
                ************************************
                Looking over your log it seems you don't have any evidence of a second-party firewall.

                Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

                Remember only install ONE firewall

                1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
                2) Online Armor
                3) Agnitum Outpost
                4) PC Tools Firewall Plus

                If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
                *************************************************************
                Use the Secunia Software Inspector to check for out of date software.

                •Click Start Now

                •Check the box next to Enable thorough system inspection.

                •Click Start

                •Allow the scan to finish and scroll down to see if any updates are needed.
                •Update anything listed.
                .
                ----------

                Go to Microsoft Windows Update and get all critical updates.

                ----------

                I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

                SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
                * Using SpywareBlaster to protect your computer from Spyware and Malware
                * If you don't know what ActiveX controls are, see here

                Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

                Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

                Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
                Safe Surfing!
                Windows 8 and Windows 10 dual boot with two SSD's

                Mikex79

                  Topic Starter


                  Rookie

                  • Computer: Specs
                  • Experience: Familiar
                  • OS: Windows XP
                  Re: TR/FakeSpyPro6
                  « Reply #25 on: November 30, 2010, 01:40:57 AM »
                  Thanks Dave. Will follow your suggestions and I HAVE installed Online Armor Firewall.