http://malwareremoval.com/forum/viewtop ... 12&t=52241
Heres what Norton has grabbed lately. I thought qoobox came in with combofix, why would norton go after it?
Date Filename Threat Threat Type Action Taken Computer User Original Location Status Current Location Primary Action Secondary Action Scan Type Action Description
7/23/2010 1:26 A0005331.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/23/2010 1:26 A0005303.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/23/2010 1:26 A0005302.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/23/2010 1:26 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/23/2010 1:25 kbdhid.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\Qoobox\32788R22FWJFW\ Infected C:\Qoobox\32788R22FWJFW\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 12:47 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 SYSTEM C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 11:47 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 SYSTEM C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 11:20 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 SYSTEM C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 9:15 A0005303.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP3\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 9:15 A0005302.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 9:15 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 9:13 kbdhid.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\Qoobox\32788R22FWJFW\ Infected C:\Qoobox\32788R22FWJFW\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 3:31 A0005302.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 3:31 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/22/2010 3:29 kbdhid.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\Qoobox\32788R22FWJFW\ Infected C:\Qoobox\32788R22FWJFW\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/20/2010 13:36 A0001260.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Infected C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP2\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/20/2010 13:36 A0001176.dll Trojan.Zefarch!gen File Deleted USER-6CEBA5E1E4 user C:\System Volume Information\_restore{E4613FD2-0163-4BBB-BFCA-53DDD7ABC36C}\RP1\ Deleted Deleted Clean virus from file Quarantine infected file Auto-Protect scan The file was deleted successfully.
7/20/2010 13:36 nsap50.dll.vir Trojan.Zefarch!gen File Deleted USER-6CEBA5E1E4 user C:\Qoobox\Quarantine\C\WINDOWS\ Deleted Deleted Clean virus from file Quarantine infected file Auto-Protect scan The file was deleted successfully.
7/20/2010 13:36 kbdhid.sys Backdoor.Tidserv!inf File Left alone USER-6CEBA5E1E4 user C:\Qoobox\32788R22FWJFW\ Infected C:\Qoobox\32788R22FWJFW\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
7/8/2010 22:14 hzGhTnnrxM.exe Trojan.FakeAV!gen27 File Deleted USER-6CEBA5E1E4 SYSTEM C:\WINDOWS\TEMP\ Deleted Deleted Clean virus from file Quarantine infected file Auto-Protect scan The file was deleted successfully.
7/8/2010 22:14 setup[1].exe Trojan.FakeAV!gen27 File Left alone USER-6CEBA5E1E4 SYSTEM C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\F477XOLR\ Infected C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\F477XOLR\ Clean virus from file Quarantine infected file Auto-Protect scan The file was left unchanged.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:47:11 AM, on 7/23/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\NETGEAR\WG311v3\WG311v3.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://myportal.hcc.mass.edu/site/index_page.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb11.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = C:\Program Files\NETGEAR\WG311v3\WG311v3.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 2815210062
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\hpbpro.exe
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\hpboid.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
--
End of file - 7294 bytes