Search:

jdc2000: I am able to delete the .php and .txt files. On a couple of sites that I've deleted all these files from, sometimes new .php files (with different titles, again just random letters) have...

Yes, I see an empty ftp folder when I click your link.

I also opened up one of the sites I know has a dodgy .php file in it, this time in some online ftp software, and the dodgy file is visible...

Thanks -- I ran that scan, it didn't show me a log, but said no threats were found.

G

Thanks for moving the thread, Fink.

Train: I used this TrendMicro online av: http://www.trendmicro.co.uk/infographics/manic-mobile/index.html

I don't have an AV installed (I know!)

G

Hi,

I have noticed that a lot of the sites that I access through my FTP client (Filezilla) have been infected with files. These files are of two types: .php files (with titles like kocyqsx.php),...

I just wanted to check -- this result in the ESET scan I posted above:


C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip...

Thanks for all your efforts Broni. One last question though, in my Add/Remove Programs, the only listed item for Java is Java(TM) 6 Update 24, no update 7 is listed...

ESET Scan:

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinMuollo1.zip Win32/Bagle.gen.zip worm

SecurityCheck log:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 6 Out of date! ...

That's great Broni, thanks a lot! Here's the OTL log:

All processes killed
========== OTL ==========
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\SET29.tmp deleted...

OTL Extras logfile created on: 24/02/2011 18:39:47 - Run 1
OTL by OldTimer - Version 3.2.21.0 Folder = C:\Documents and Settings\gdansk\Desktop
Windows XP Professional Edition Service Pack 2...

========== LOP Check ==========

[2010/09/29 18:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\gdansk\Application Data\.minecraft
[2010/03/28 04:21:23 | 000,000,000 | ---D | M] --...

Thanks a million broni, it works fine now! What was that thing, a virus? Anyway, thanks for your help, much appreciated.

Here's the OTL.txt log (in 2 posts):

OTL logfile created on: 24/02/2011...

Here it is:

ComboFix 11-02-23.01 - gdansk 23/02/2011 18:08:16.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1485 [GMT 0:00]
Running from: c:\documents and...

Thanks Broni -- here's combofix2.txt:

ComboFix 11-02-19.02 - gdansk 20/02/2011 12:39:45.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1627 [GMT 0:00]
Running from:...

Combofix report:

ComboFix 11-02-22.01 - gdansk 22/02/2011 21:29:30.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1505 [GMT 0:00]
Running from: c:\documents and...

Rootkit Unhooker report:

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 2)
Number of processors #2...

Thanks! I forgot to mention GMER produced a warning after the full scan. Anyway, here's the TDSS report:

2011/02/21 23:17:27.0515 5088 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08...

DDS logs:


DDS (Ver_10-12-12.02) - NTFSx86
Run by gdansk at 9:22:49.81 on 21/02/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional ...

MBRcheck log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 2 (build 2600)
Logical Drives...

Gmer log:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-02-21 09:04:15
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 STM32503 rev.CC37
Running:...

Thanks fink -- as you suggested I ran those scans, here's the anti-malware log:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5817

Windows 5.1.2600 Service...

Hi,

I think I have a virus problem - I'm not able to access microsoft.com or several anti-virus sites (e.g. symantec.com, trendmicro.com). I've run spybot and anti-malware and combofix, to no...