A computer in my house has a virus. At least one virus, anyway. audp. Avast is not only unable to detect it, but is unable to scan the file during a boot scan (access denied)
file name: sysvcs.exe
audp is the name this virus uses in the registry under run.
There’s two more files that it gets access denied for, I don’t know if they are viral: gccg.exe and fkpg.exe (I think… It ended too quickly for me to read that last one properly).
Ideas? The virus supposedly downloads other viruses from the internet, so I’ve had to keep the computer offline for some time now. (which reminds me, the offline virus database updates were EXTREMELY hard to find, not being linked to from the web site at all, I had to do alot of very thorough google searches.)
EDIT: The virus also has a file named symsvcsa.exe. This is the one that previously mentioned registry key points to.
Oh, and Avast! deletes the system’s page file every time it does a boot scan.
edit again: there’s also some more software on there that looks suspicious:
winsysban10.exe
winsysupd9.exe
mwinnsai.exe
mdsregm.exe
gimmemygames10.exe
dwdsregt.exe
mpp2pl.exe
Oh, and I just noticed, audp virus has a second key in there, leading to same file, but the key is named ntdll.dll
I’ve done my google searching quite thorough google searching, in fact.
The computer is running Windows 2000 Professional.
It has all those programs installed, as well as AVG Free. None of which can even detect the virus, much less remove it.
EDIT: A new update for AVG has removed:
winsysban10.exe
winsysupd9.exe
gimmemygames10.exe
symsvcsa.exe
Well having two resident AVs installed at the same time isn’t recommended, rather than twice the protection you get twice the potential for conflict. One AV scans a file or extracts the contents of and archive, the other might well detect something and lock the file so the other can’t deal with it.
So make a decision and get rid of one of the resident AVs and reboot.
Then schedule a boot-time scan from within avast, after that try running Ewido again.
I’m sure that your googling will have shown much of this is adware and spyware.
Sorry I didn’t make it clear enough before, but I have not installed that Windows XP program because Windows 2000 Professional (NT 5.0) != Windows XP (NT 5.1).
As per your instructions, I have uninstalled AVG, and did another boot scan with Avast. It found nothing at all, didn’t alert me of anything at all, despite having the latest definitions and a bunch of mal-programs still there. It did however, delete the system’s page file once again, causing the usual couple of errors in Windows telling me how to re-create the page file…
My googling showed all kinds of things, but not how to remove any of the mal-programs that are and have been there.
I can’t see how avast is deleting the pagefile, avast must first detect a problem/infection in the pagefile and then ask what action you want taken, it doesn’t act autonomously and delete files without your interaction. So how can you identify that it was avast deleted the pagefile ? Have you got your OS setup to delete the pagefile on exit/shutdown ?
So I’m a little baffled by the deletion of the pagefile.
It might be possible that Avast is not running correctly (or was a bad install) IF you had AVG on the computer first. Well, it may not matter which one was there first for this to happen.
I do not remember if you can do an Avast repair with W2000 Pro or not. Perhaps David or someone can answer that and give directions if so. If there is no repair option with 2000, then you might need to … uninstall avast > restart > re-install avast > restart again … in order to “set things straight.”
Restarting the computer without doing a boot scan does not cause the page file to be deleted. The only error that windows gives me after any startup, is the one saying the network connection cannot be established blah blah (network drive stuff).
Well, I’m definitely going to need some help interpreting the result of hijackthis:
I have done that repair option for Avast (I didn’t even know it existed.), did another boot scan, and Windows once again told me while logging in that the page file has been deleted.
Two important points from this:
A newer version of service pack is available. Service packs increase the safety of your system. Visit Microsoft’s windowsupdate site to download the newest version of the service pack.
No active firewall was found on your system or the firewall you use is unknown to us. If you don´t use a firewall you should download and install one. If you have a router/firewall this may not provide outbound protection.
For the TSC package to be effective, you must download and use the latest pattern file. Place the pattern file in the same folder as the Trend Micro System Cleaner Package.
(EDIT: Hmm. Anyone know what that minisearch.startnow.com is? It doesn’t look like a good thing. And just when I thought it was clean…)
Installed that Ewido program, as it has been pointed ot to me that it DOES in fact work on NT 5.0. It found, and fixed, lots of things (edit: about 30 something). Silly program considering each file as 0.001 objects. Since when is a file a thousandth of an object…
Anyway, I kept scanning with every scanner on there (not AVG, as it has been uninstalled), until none of the scanners could find anything. I have put a firewall, Zone Alarm Pro on there. I will be putting the computer back online later today and update everything, including windows update.
If you didn’t intentionally put the minisearch.startnow.com search on your system, I wouldn’t waste time trying to find out what it is rather, have HJT fix it.
I don’t like the R0 or R1 entries even if they are marked safe, they just don’t seem right.
Are you using a proxy, which would require these R1 entries
I suggest that you try a different browser, IE is like a magnet to browser hijack and other adware/spyware (BHOs, activeX controls). Firefox, Opera, in fact any that doesn’t use the IE core.
From your HijackThis log, it appears you have NO
antiSPYWARE program on your computer; the
MessengerPlus 3 program is considered to be the LOP
spyware. You really should seek help from HijackThis
Experts; the ONLY one on this site is "doc_esb";
otherwise, I recommend you go to www.landzdown.com
and get their guidance .
Get rid of those about:blank entries as David mentioned and check to make sure they don’t reappear: I’m pretty confident one of the programs you ran will have removed the dll that is responsible for about:blank, but it’s worth a double check.
The proxy server stuff is all something I intentionally put in there some time ago while troubleshooting another problem. Internet Explorer isn’t even set to use the proxy any more, I don’t think it will be a problem to leave those.
Messenger Plus is not spyware, but software bundled with it is spyware. They have a cleverly hidden option to choose NOT to install the spyware when installing Messenger Plus, and I used said option. No spyware from that.
Thanks for the help everyone, I still haven’t put it online yet. With the okay (or lack of any word) I shall a bit later today (and update everything right away when it gets online)
When I see something with no button, no name it make me squirm, why would it want to hide it purpose.
O9 - Extra button: (no name) - {9E248641-0E24-4DDB-9A1F-705087832AD6} - (no file)
Other than that I can’t see anything obvious, thought I don’t use win2k so some of the things like.
O4 - HKLM..\Run: [SystemTray] SysTray.Exe
They aren’t on my XP Pro system.
quite thorough google searching, in fact.
