Name: Shlavina Date: October 2, 2007 at 17:32:27 Pacific Subject: Very smart infection? OS: MS Windows XP Home CPU/Ram: P4 2.80 GHz/ 512 MB Ram Model/Manufacturer: Computer World
Comment:
Hi there. I guess I should start by mentioning that I am brand new here and not exactly a hotshot when it comes to IT issues. About three weeks ago my computer started to be very slow when browsing the net. My Noten AV kept showing a window stating that it was waiting for a scan of some file. I ran scans with Norten av, spybot s&d, adaware and a-squared. There were plenty of cookies removed but the problem remained. A system restore to an earlier point didn't make a difference either. Suspecting that something may be imbedded in the Norten AV I uninstalled Norten and then put it on again. The computer is now running at normal speed but when I try to scan the computer with Norten AV I get an error message half way through the scan saying it was unable to complete it. If I scan with a-squared the computer gets to the half way again and then shuts itself down before rebooting. Spybot and adaware keep finding cookies but seem to be unable to fix the problem. I had a look at a log of hijackthis but am not clever enough to tell the goodies from the bad stuff. Any help would be greatly apprciated. Many thanks in advance.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd" Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
Please download and install the latest version of HijackThis v2.0.2:
Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Hi and thank you for the quick reply. I downloaded the SmitFraudFix. When I click on the cmd I am being told that the Fichier Process.exe is absent and a Process.exe file is missing. It is asking me to unzip the archive in a folder. Is that save to do as I have no clue about zip files? Here is the log of Hijackthis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:03:26 AM, on 3/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal
Turn off any of these that you have (they are blocking the tool) then run Smitfraudfix option #1 again please. Leave them off untill we get you clean please.
Temporarily disable any of the following anti-spyware realtime protection programs that you may have Disable Realtime Protection or the fixes will not work. Be sure to turn yout anti-spyware programs back on once the computer is clean.
Turn off Norton's ScriptBlocking:
To disable Norton AntiVirus Script Blocking:
Start Norton AntiVirus. If Norton AntiVirus is installed as part of Norton SystemWorks or Norton Internet Security, then start that program. Click Options. If you see a menu, click Norton AntiVirus. In the left pane, click Script Blocking. In the right pane, uncheck Enable Script Blocking (recommended). Click OK.
I disabled the script blocking. I hope the spybot S&D, adaware and a-squared won't interfere? I tried the SmitFraudFix again and get the same message - do I have to unzip the file first?
Okay, it's done now. Sorry about my poor IT knowledge. Here comes the log:
SmitFraudFix v2.235
Scan done at 12:00:01.92, Wed 03/10/2007 Run from C:\Documents and Settings\Frank\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!!
Done as well - appreciate the time you are putting in for this....
The log: ComboFix 07-10-03.5 - Frank 2007-10-03 12:14:05.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.195 [GMT 10:00] Running from: C:\Documents and Settings\Frank\Desktop\ComboFix.exe . /wow section - STAGE 29
((((((((((((((((((((((((( Files Created from 2007-09-03 to 2007-10-03 ))))))))))))))))))))))))))))))) .
Go to start> run> add/remove programs and uninstall these programs if found:
LimeWire
Please download “Avenger” by swandog46 to your desktop from this link Avenger 1. Click on Avenger.zip to open the file Extract avenger.exe to your desktop
2. Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C): XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Files to delete: C:\WINDOWS\system32\adssite-remove.exe C:\WINDOWS\system32\nsfD1.dll C:\WINDOWS\system32\gzmrotate.dll
Folders to delete: C:\Documents and Settings\Frank\Application Data\LimeWire C:\Program Files\LimeWire
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. 3. Now, start The Avenger program by clicking on its icon on your desktop. Under "Script file to execute" choose "Input Script Manually". Now click on the Magnifying Glass icon which will open a new window titled "View/edit script" Paste the text copied to clipboard into this window by pressing (Ctrl+V). Click Done Now click on the Green Light to begin execution of the script Answer "Yes" twice when prompted. 4. The Avenger will automatically do the following: It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.) On reboot, it will briefly open a black command window on your desktop, this is normal. After the restart, it creates a log file that should open with the results of Avenger's actions. This log file will be located at C:\avenger.txt The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip. 5. Please copy/paste the content of c:\avenger.txt into your reply.
Run Hijack this, close all windows and browsers except Hijack This, place a check to the left of the following items and press "fix checked":
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button.
Restart into normal mode.
Post a new Hijack This log.
Turn any real time protecting that you disabled back on.
Turn scriptblocking back on.
You should consider adding "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.
And this is the Hijackthis log. I might run a Norten or a-square scan to see what happens.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:29:48 PM, on 3/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal
The scan is still running but usually the computer would have turned itself off by now and then restarted. Hopefully this means that whatever there was is now gone. This has been totally amazing and I can't thank you enough. Hard to believe that you managed to explain things in a way that even I could follow and do the required steps. Should I keep all those tools or are they useless for an amateur like me? And what do you think the problem was in the end?
I don't see any other suspect files but we can look a little deeper.
Please download SDFix by AndyManchesta and save it to your desktop.
Please then reboot your computer in Safe Mode by doing the following: Restart your computer. After hearing your computer beep once during startup, but just before the Windows icon appears, tap the F8 key continually. Instead of Windows loading as normal, a menu with options should appear. Select the first option, to run Windows in "Safe Mode", then press "Enter". Choose your usual account.
Once in Safe Mode, please do the following: In Safe Mode, right-click the SDFix.zip folder and choose Extract All. Open the extracted folder and double-click RunThis.bat to start the script. Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. Press any Key and it will restart the PC. Your system will take longer that normal to restart as the fixtool will be running and removing files. When the desktop loads the fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons. Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt
Run this free online scan from Kaspersky http://kaspersky.com/kos/english/kavwebscan.html Click Accept When the updates are finished downloading, click Next, Scan Settings Under Scan using the following antivirus database:, select extended Make sure the Scan Archives and Scan Mail Bases options are selected as well. Click OK Click My Computer and wait for the scan to finish Click Save Report As. Under Save as type:, select Text file. Save this log to your Desktop and post a copy of it here.
And here is the Kaspersy Scan: (It's bedtime now here in Down Under so I will check in again after work tomorrow)
--------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, October 04, 2007 12:45:37 AM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.1 Kaspersky Anti-Virus database last update: 3/10/2007 Kaspersky Anti-Virus database records: 426752 ---------------------
Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true
Scan Statistics: Total number of scanned objects: 59308 Number of viruses found: 1 Number of infected objects: 4 Number of suspicious objects: 0 Duration of the scan process: 00:39:42
Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\call256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\callmember256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chat1024.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chat512.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chatmember256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chatmsg1024.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chatmsg2048.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chatmsg256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\chatmsg512.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\contactgroup256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\dyncontent\bundle.dat Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\index2.dat Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\profile16384.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\transfer256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\user1024.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\user16384.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\user256.dbb Object is locked skipped C:\Documents and Settings\Frank\Application Data\Skype\schlawiner1966\user4096.dbb Object is locked skipped C:\Documents and Settings\Frank\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Frank\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\History\History.IE5\MSHist012007100320071004\index.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Frank\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Frank\My Documents\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Frank\My Documents\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Frank\My Documents\SmitfraudFix.zip ZIP: infected - 1 skipped C:\Documents and Settings\Frank\ntuser.dat Object is locked skipped C:\Documents and Settings\Frank\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Common Files\Symantec Shared\Antispam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsys.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{F1DB2795-5675-408F-827B-3537E4DE4343}\RP2\A0000030.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\System Volume Information\_restore{F1DB2795-5675-408F-827B-3537E4DE4343}\RP2\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped
By the way - when I run Norton Live Update it doesn't install the Internet Security URL Update and tells me that a program that was part of this update failed when it ran so that the update was not applied. When I try to click on more information on this error I just get a blank windows explorer page. Not sure whether this may have something to do with the problem.
The information on Computing.Net is the opinions of its users. Such
opinions may not be accurate and they are to be used at your own risk.
Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net, LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE
Version Tracker Pro
Driver Agent