I figured that Malwarebytes would find something. I must confess however. A long time ago I had purposely infected my PC with an AIM trojan so that I could learn how to remove it. I did this because a friend of mine had gotten it, but I didn't use AIM. Of course it did nothing on my PC but perhaps one of these are its remnants:
Mirar
Adware.Mirar attempts to find Web pages that are related to the Web page currently being viewed. It also displays advertisements based on the URLs and search terms used while navigating the Internet. It will also attempt to download and install the Mirar toolbar from a predetermined Web site. This toolbar is also detected as Adware.Mirar.
My current settings block all domains unless I say so, especially scripts. This being present doesn't cause a security breach for me. You may have noticed I have IE as my default browser, however, I only use it to display local files and my website, nothing else.
Netmon.exe
netmon.exe is a process which is registered mass-mailing worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open its hostile attachment. The worm has it's own SMTP mailing engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. This process is a security risk and should be removed from your system.
With exception to the Microsoft tools of the same name (sneaky they are eh) but I have not installed netmon on this computer. Alas, STMP port is blocked by the hardware firewall, and even so, I have no default Email client anyways. But from its own log, you can see it hasn't run in a while:
06-09-28 11.23.13: *** WAITING 240 SECS ***
06-09-28 11.27.13: *** FETCHING ***
06-09-28 11.27.14: *** SKIPPING POST ***
06-09-28 11.27.14: *** WAITING 240 SECS ***
06-09-28 11.31.14: *** FETCHING ***
06-09-28 11.31.14: *** SKIPPING POST ***
06-09-28 11.31.14: *** WAITING 240 SECS ***
06-09-28 11.35.14: *** FETCHING ***
06-09-28 11.35.15: *** SKIPPING POST ***
06-09-28 11.35.15: *** WAITING 240 SECS ***
06-09-28 11.39.15: *** FETCHING ***
06-09-28 11.39.15: *** SKIPPING POST ***
06-09-28 11.39.15: *** WAITING 240 SECS ***
06-09-28 11.43.15: *** FETCHING ***
06-09-28 11.43.16: *** SKIPPING POST ***
06-09-28 11.43.16: *** WAITING 240 SECS ***
06-09-28 11.47.16: *** FETCHING ***
06-09-28 11.47.16: *** SKIPPING POST ***
06-09-28 11.47.16: *** WAITING 240 SECS ***
06-09-28 11.51.16: *** FETCHING ***
06-09-28 11.51.17: *** SKIPPING POST ***
06-09-28 11.51.17: *** WAITING 240 SECS ***
06-09-28 11.55.17: *** FETCHING ***
06-09-28 11.55.18: *** SKIPPING POST ***
06-09-28 11.55.18: *** WAITING 240 SECS ***
06-09-28 11.59.18: *** FETCHING ***
06-09-28 11.59.19: *** SKIPPING POST ***
06-09-28 11.59.19: *** WAITING 240 SECS ***
06-09-28 12.03.19: *** FETCHING ***
06-09-28 12.03.20: *** SKIPPING POST ***
06-09-28 12.03.20: *** WAITING 240 SECS ***
06-09-28 12.07.20: *** FETCHING ***
06-09-28 12.07.21: *** SKIPPING POST ***
06-09-28 12.07.21: *** WAITING 240 SECS ***
06-09-28 12.11.21: *** FETCHING ***
06-09-28 12.11.21: *** SKIPPING POST ***
06-09-28 12.11.21: *** WAITING 240 SECS ***
This makes sense, if you ever look in your spam folder. You get a lot of emails with the wrong year on them. Probably coming from trojans like this. Too bad they are still out there. Only makes sense for Tbird, and OE/Outlook clients, perhaps others. Webmail clients (as I exclusively use besides at work) automatically sort these incorrect year emails into the spam/bulk folder. Pretty stupid for the worm to log that info tho.
atmtd.dll
cmdService, also known as Command Service, is adware that displays commercial advertisements and opens annoying pop-ups. The parasite is usually installed through drive-by downloads. Its makers are able to partially control the compromised system by disabling or removing any other advertising-supported programs installed. cmdService runs a service on every Windows startup.
This malware also appears to be non-functional.
idt0.dll
This is a "Quake" variant! HA I think I'll keep it.
MShosts.exe
Looks bad, I think I'll remove it.
http://www.bleepingcomputer.com/startups/m....exe-23825.html
Unist1.htm and Uninst2.htm
Source
<html>
<title>SearchB</title>
<body bgcolor='#eeeeee'>
<font size=+2><b>Search The Web</b></font>
<form method=post action='http://www.openforum.com/search.php'>
<input name=searchTerms value=''> <input type=submit value='Search'>
</form>
<br>
<br>
Type The Letters Below To Verify You Wish To Uninstall
<table bgcolor=#FFFFFF><tr><td><font size=+3>X475Q</font></td></tr></table>
<form action=Uninst2.htm Method=GET>
<input type=text name=verifyText>
<input type=submit value='uninstall'>
</form>
Source
<html>
<title>SearchB</title>
<body bgcolor='#eeeeee'>
<center>
<table width=60% border=0>
<tr>
<td colspan=3><font size=+1>Do you want to continue to enhance your internet?</font>
</td>
</tr>
<tr>
<td>
<form method=Get action='java script:window.close();'>
<input type=submit value='YES'>
</form>
</td>
<td width=100%> </td>
<td>
<form method=Get action="uni_eh.exe">
<input type=submit value='no'>
</form>
</td>
</table>
</center>
</body>
</html>
I think I'll remove this also.
... oh noes Vundo...
Last few things from Security Center, those are my doing.
All in all, it isn't as bad as I thought. But that is all for tonight, I make decide to try more things tomorrow night if you are interested.
Frontpage
Forums
Tutorials
Members
Calendar
Subscription
Donate
Links
Contact 
Help
Back to top
