Computing.Net - amvo.dll virus

Subject: amvo.dll virus

Original Message

Name: saurabhthelord
Date: March 31, 2008 at 11:00:22 Pacific
Subject: amvo.dll virus
OS: xp sp2
CPU/Ram: 1.7ghz/1gb
Model/Manufacturer: hp pavilion 5000

Comment:

trojan horse psw.onlinegames.x
trojan horse psw.onlinegames.t
trojan horse psw.onlinegames.agsq
trojan horse psw.onlinegames.agwa
trojan horse psw.onlinegames.ae
worm/generic.eza
worm/autorun.y
trojan horse generic10.bje
obfustat.aedw
trojan horse delf.doq
these viruses and trojans are also there in my pc .i just re-installed my windows today only.
please help me a way to remove virus from my data.because of other partition i wasn't able to remove the virus from root.
saurabhthelord

Report Offensive Message For Removal

Response Number 1

Name: Adii
Date: March 31, 2008 at 19:08:24 Pacific
Subject: amvo.dll virus

Reply: (edit)

Download the "HijackThis" Installer from this link:
http://www.trendsecure.com/portal/e...

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Post Hijackthis Log in your next reply.
*Do Safe Computing*

Report Offensive Follow Up For Removal

Response Number 2

Name: saurabhthelord
Date: March 31, 2008 at 23:29:46 Pacific
Subject: amvo.dll virus

Reply: (edit)

Logfile of HijackThis v1.99.1
Scan saved at 11:58:54 AM, on 4/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
F:\Program Files\uTorrent\uTorrent.exe
F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
F:\Program Files\Spyware Terminator\sp_rsser.exe
F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
F:\Program Files\Grisoft\AVG7\avgcc.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\PROGRA~1\Crawler\CToolbar.exe
F:\Program Files\Hijackthis\HijackThis.exe
R3 - URLSearchHook: SrchHook Class - {F4F10C1D-87C7-404A-B4B3-000000000000} - F:\PROGRA~1\DAP\SBSearch.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - F:\PROGRA~1\Crawler\ctbr.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - F:\PROGRA~1\Crawler\ctbr.dll
O4 - HKLM\..\Run: [AVG7_CC] F:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SpywareTerminator] "F:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [µTorrent] "F:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "F:\Program Files\uTorrent\uTorrent.exe"
O8 - Extra context menu item: &Clean Traces - F:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{508DEFAA-FD1B-44A9-B82F-931C1476DC96}: NameServer = 202.56.215.6,202.56.230.6
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - F:\PROGRA~1\Crawler\ctbr.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - F:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - F:\Program Files\Spyware Terminator\sp_rsser.exe
saurabhthelord

Report Offensive Follow Up For Removal

Response Number 3

Name: Adii
Date: April 1, 2008 at 00:02:00 Pacific
Subject: amvo.dll virus

Reply: (edit)

Please do an online scan with Kaspersky WebScanner.
online scanner: http://www.kaspersky.com/virusscanner

1.Click on "Kaspersky Online Scanner".
2.You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
3.The program will launch and then begin downloading the latest definition files.
4.Once the files have been downloaded click on "NEXT".
5.Now click on "Scan Settings".
6.In the scan settings make that the following are selected:
7.Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
8.Scan Options:
Scan Archives
Scan Mail Bases
9.Click OK.
10.Under select a target to scan, select "My Computer".
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Upon completion, click on the "Save as Text" button.
Save the file to your desktop.
Copy and paste that information in your next reply.
*Do Safe Computing*

Report Offensive Follow Up For Removal