Avast stopped working, virus?

Lisandro · 2007-08-23T12:49:07.000Z

BJS post:139:

I did find the chksdk in the c:\windows\system32\dllcache
Does it look like I missed something ???

C:\WINDOWS\system32\chkdsk.exe (and not chksdk.exe as you’ve posted).

system · 2007-08-23T17:32:28.000Z

Tech™ post:138:

Maybe this is left behind…

O11 - Options group: [INTERNATIONAL] International: Currently only the ‘CommonName’ hijacker uses this Extra group in IE ‘Advanced Options’ window.

That’s OK I think - its International Domain Name Support for IE7. BJS has IE6 now but used to have IE7.

BJS post:139:

[Does it look like I missed something ???

Well, no, I don’t think you missed anything but my registry fix didn’t do what I had hoped.

Open Add/Remove Programs in the Control Panel and see if you find ISTBar. If its present, uninstall it.

Then upload c:\windows\system32\dllcache\chkdsk.exe to Virus Total so we can make sure its clean. If it is clean and the spellling is correct we’ll copy that to c:\windows\system32

system · 2007-08-23T17:36:19.000Z

oldman post:129:

As to not being able update, I would say the product key is already registered on another computer that doesn’t match the system you are trying to run it on now. Yeah, MS has tied the os to the system, you can make only gradual changes to the system over time before you have to call MS and have a new key issued. This applies to retail versions, oem’s are a totally different story. This info is just basic, there is a bit more to it then that.

I don’t have to worry about the Windows Installer now. I have switched from IE to Firefox. I have been meaning to do this for awhile and not being able to get security updates from Microsoft was the last straw.
I actually like Firefox quite a bit. It may just be in my mind, but I think it is faster and from what I gather from the internet and people I know, it is actually more secure.

system · 2007-08-23T17:38:24.000Z

[/quote]
Open Add/Remove Programs in the Control Panel and see if you find ISTBar. If its present, uninstall it.

Then upload c:\windows\system32\dllcache\chkdsk.exe to Virus Total so we can make sure its clean. If it is clean and the spellling is correct we’ll copy that to c:\windows\system32
[/quote]
OK will do…

system · 2007-08-23T18:05:26.000Z

Virus Total results for chkdsk.exe

File chkdsk.exe received on 08.23.2007 19:57:14 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2007.8.22.0 2007.08.23 -
AntiVir 7.4.1.63 2007.08.23 -
Authentium 4.93.8 2007.08.23 -
Avast 4.7.1029.0 2007.08.23 -
AVG 7.5.0.484 2007.08.23 -
BitDefender 7.2 2007.08.23 -
CAT-QuickHeal 9.00 2007.08.23 -
ClamAV 0.91 2007.08.23 -
DrWeb 4.33 2007.08.23 -
eSafe 7.0.15.0 2007.08.23 -
eTrust-Vet 31.1.5082 2007.08.23 -
Ewido 4.0 2007.08.23 -
FileAdvisor 1 2007.08.23 -
Fortinet 2.91.0.0 2007.08.23 -
F-Prot 4.3.2.48 2007.08.23 -
F-Secure 6.70.13030.0 2007.08.23 -
Ikarus T3.1.1.12 2007.08.23 -
Kaspersky 4.0.2.24 2007.08.23 -
McAfee 5104 2007.08.23 -
Microsoft 1.2803 2007.08.23 -
NOD32v2 2480 2007.08.23 -
Norman 5.80.02 2007.08.23 -
Panda 9.0.0.4 2007.08.23 -
Prevx1 V2 2007.08.23 -
Rising 19.37.32.00 2007.08.23 -
Sophos 4.20.0 2007.08.23 -
Sunbelt 2.2.907.0 2007.08.23 -
Symantec 10 2007.08.23 -
TheHacker 6.1.8.171 2007.08.23 -
VBA32 3.12.2.3 2007.08.23 -
VirusBuster 4.3.26:9 2007.08.23 -
Webwasher-Gateway 6.0.1 2007.08.23 -
Additional information
File size: 11776 bytes
MD5: 5f7eaaf5d10e2a715d5e305ac992b2a7
SHA1: 4c30315b9c16106b542f088921888d83d3f185f7

system · 2007-08-23T21:48:26.000Z

Did you find ISTBar?

system · 2007-08-23T22:48:37.000Z

I looked for the ISTBar in add/remove programs but could not find any. Could it be hidden? ???

DavidR · 2007-08-23T22:51:55.000Z

I wouldn’t have though it would be an add remove item as it is a browser toolbar add on.

ToolbarCop http://www.snapfiles.com/get/toolbarcop.html is usually at finding bad browser toolbars .

system · 2007-08-24T00:06:35.000Z

Thanks, I will try it…

system · 2007-08-24T00:12:26.000Z

I ran toolbarcop and these were the results. I did not see ISTBar but maybe it is there…

n/a
Browser Extension
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}
C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
Enabled
All Users

Yahoo! Services
Browser Extension
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
C:\Program Files\Yahoo!\Common\yiesrvc.dll
Enabled
All Users

n/a
Browser Extension
{E2E2DD38-D088-4134-82B7-F2BA38496583}
%windir%\Network Diagnostic\xpnetdiag.exe
Enabled
All Users

Messenger
Browser Extension
{FB5F1910-F110-11D2-BB9E-00C04F795683}
C:\Program Files\Messenger\msmsgs.exe
Enabled
All Users

&Address
Toolbar
{01E04581-4EEE-11D0-BFE9-00AA005B4383}
%SystemRoot%\system32\browseui.dll
Enabled
Current User

&Links
Toolbar
{0E5CBF21-D15F-11D0-8301-00AA005B4383}
%SystemRoot%\system32\SHELL32.dll
Enabled
Current User

&Google
Toolbar
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
c:\program files\google\googletoolbar3.dll
Enabled
Current User

(Empty)
Toolbar
{B7D3E479-CC68-42B5-A338-938ECE35F419}
(empty)
Enabled
Current User

&Google
Toolbar
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
c:\program files\google\googletoolbar3.dll
Enabled
All Users

Adobe PDF Reader Link Helper
BHO
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
Enabled
All Users

Yahoo! IE Services Button
BHO
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}
C:\Program Files\Yahoo!\Common\yiesrvc.dll
Enabled
All Users

SSVHelper Class
BHO
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
Enabled
All Users

Google Toolbar Helper
BHO
{AA58ED58-01DD-4D91-8333-CF10577473F7}
c:\program files\google\googletoolbar3.dll
Enabled
All Users

Google Toolbar Notifier BHO
BHO
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
Enabled
All Users

&D&ownload &with BitComet
Menu Extension

res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
Enabled
Current User

&D&ownload all video with BitComet
Menu Extension

res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
Enabled
Current User

&D&ownload all with BitComet
Menu Extension

res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
Enabled
Current User

swg
Run - Startup

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
Enabled
Current User

ctfmon.exe
Run - Startup

C:\WINDOWS\system32\ctfmon.exe
Enabled
Current User

SunJavaUpdateSched
Run - Startup

“C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe”
Enabled
All Users

SiSUSBRG
Run - Startup

C:\WINDOWS\sisUSBrg.exe
Enabled
All Users

SiS KHooker
Run - Startup

C:\WINDOWS\System32\khooker.exe
Enabled
All Users

Cmaudio
Run - Startup

RunDll32 cmicnfg.cpl,CMICtrlWnd
Enabled
All Users

avast!
Run - Startup

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
Enabled
All Users

DavidR · 2007-08-24T00:39:31.000Z

No sign of 1stbar, can’t see anything else there.

system · 2007-08-24T01:17:48.000Z

Mauserme, I am not sure if this means anything but the Bagle virus that I believe started it all is still in my startup (it is inactive though)
I traced it to this folder wintems.exe.vir C:\QooBox\Quarantine\C\Windows\System 32

Can I delete it from my computer all together??

Also, the vsnpstd2.exe is located in C:\Windows and also in

C:\Program Files\GE\98067 MiniCam Pro

I am pretty sure this file is some sort of spyware.

system · 2007-08-24T11:57:30.000Z

DavidR post:150:

No sign of 1stbar, can’t see anything else there.

Me neither.

At this point I’ll go out on a limb and say the tool bar was actually gone before we started, but there are some left over registry entries that are pretty stubborn.

BJS post:151:

Mauserme, I am not sure if this means anything but the Bagle virus that I believe started it all is still in my startup (it is inactive though)
I traced it to this folder wintems.exe.vir C:\QooBox\Quarantine\C\Windows\System 32

Can I delete it from my computer all together??

Also, the vsnpstd2.exe is located in C:\Windows and also in

C:\Program Files\GE\98067 MiniCam Pro

I am pretty sure this file is some sort of spyware.

Qoobox is the ComboFix quarantine. Everything in there is safe - we’ll take care of it later when we clean things up.

Everything I find on vsnpstd2.exe relates it to a USB camera and many sites do seem to think its spyware. But it does give you some configuration options so I wasn’t rushing into removing it. If you don’t care about whatever options these might be we can take of it now. Let me know.

For the time being download AVG Antispyware. Install, update, scan and quarantine anything found. Then post the log.

http://free.grisoft.com/doc/download-free-anti-spyware/us/frt/0

How is the computer running?

system · 2007-08-24T14:39:32.000Z

OK, I will run the AVG antispyware when I get back.
As far as the vsnpstd2.exe file, we can get rid of it because we no longer have the camera.

The computer seems to be running fine (minus having no virus protection) now that I am using Firefox.
IE would not let me update security patches (because I could not install Windows Installer)
I am happy with Fierfox but a few things are of concern.

It takes about 2 minutes to get into my C drive folders and about the same amount of time to look at the add/remove programs. They do come up but not instantly like before.

Also, for some reason I cannot shut the PC of via the start button. I either have to put it on standby via the taskbar or shut it of manually.

I am not too concerned about those yet. I would just like to clean my system out and take care of those problems later.

system · 2007-08-26T00:05:57.000Z

Mauserme,
I guess I was meant to take my wifes PC to the shop :-\

Yesterday I was trying to post you a message stating that I could not download the AVG antivirus program (or Panda for that matter) when I was hit by the virus in the forum. It happened pretty quickly, something about spyware, then the screen went black and as I was rebooting, some new icon (it kinda looked like a knight or something) was on my desktop. After that, the computer just started to reboot over and over.
I tried safemode and it still would restart over and over. I did use that bootdisc that Oldman had me make and I could get into some dos commands but that was it.

Everything seemed to be going good and then this happens…kind of discouraging.

Luckily my PC has Avast and caught it (I also run Firefox)…

Lisandro · 2007-08-26T02:01:40.000Z

BJS post:154:

When I was hit by the virus in the forum.

The virus wasn’t on avast forum but at on a redirect iframe. Luckily it was on avast virus database and was stopped. I wish an explanation of which risk have we run into yesterday. I’m not bashing avast, far from this, just trying to learn how to improve security. I also run Firefox like you.

BJS post:154:

Everything seemed to be going good and then this happens…kind of discouraging.

For me it’s encouraging to learn how to get even more protected.

system · 2007-08-26T03:14:38.000Z

BJS post:154:

Mauserme,
I guess I was meant to take my wifes PC to the shop :-\

Sorry to be so long responding. Like many others I was unable to log in. Avant (an IE shell), Opera, Firefox - nothing worked. I could see that DavidR and Tech were logged in but I couldn’t . Maybe they will share their secrets with me.

Anyway, if you are able to boot the machine at all, we need to take a very deep look a things which we can do with a WinPfind log.

Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Under Additional Scans click the checkboxes in front of the following items to select them:

Non-Microsoft Only
Reg - BotCheck

[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.

I would also loke you to run SDFix:

Download SDFIX and save it to your desktop.
Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press “Enter”.
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose “Extract All”,
Open the extracted folder and double click “RunThis.bat” to start the script.
Type Y to begin the script.
It may remove Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool will be running and removing files.
When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log.

system · 2007-08-26T04:53:55.000Z

I can boot to DOS (using the bootdisc) but I cannot get to my desktop in Windows :-\

system · 2007-08-26T13:28:54.000Z

How would you like to proceed?

I mean, our patience with these things is virtually endless around here (even if our abilities have limits). And from my point of view I want to know what’s going on and solve this. But we have to face another re-install of the OS, this time with an XP Home disc. With or without the current problem we would have to do this to get you back to the correct OS.

I just want to make sure you’re OK with this.

oldman960 · 2007-08-26T14:59:16.000Z

I agree with mauserme. Somewhere along the line you have to get back to xp home. Whether here or at a shop. And I too am interested in what is happening. But it’s your call.

Announcements