My mom’s computer got a virus today, and Malwarebytes found and deleted it… all but one file, it seems.
The file is “ogphqtx.sys”. It keeps coming up in scans done by both Malwarebytes and Avast, but neither of them can delete it, and Avast can’t even move it to the chest.
This is its location:
C:/WINDOWS\System32\drivers\ogphqtx.sys
Avast says that is is a “Rootkit.Agent”.
I tried to go into the drivers folder and delete it myself but it says:
“Cannot delete ogphqtx: Cannot read from the source file or disk.”
Does anyone know of a way to get rid of this thing? That is, assuming that Malwarebytes and Avast are correct in telling me that it isn’t supposed to be there…
Also, I have a log from hijackthis, if it is needed. I don’t know what any of it means, but I imagine there’s a lot of stuff in there that shouldn’t be. This poor computer has been through a lot. I will post the log in the next post, though, because posting it in this one made it exceed the maximum allowed length.
EDIT: Also, I did a Boot Time Scan with Avast. It did not even find the file. I was glad because I thought it was gone, but just to be sure, I booted into Safe Mode and scanned again with both Malwarebytes and Avast. Avast still finds it with a normal scan (odd that it finds it that way but not in a Boot Time Scan…), but even in safe mode, it still cannot move it to the chest or delete it; Malwarebytes can’t find it at all in safe mode. Is this really a part of the virus from before, or could this be a false positive that was coincidentally found with actual virus files? I can’t find anything about “ogphqtx.sys” by googling it, so I assume that it isn’t supposed to be in there, but…
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:05 PM, on 12/19/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support
I will leave your HiJackThis log for someone else. There are others on the forum who can provide specialist support. There are a few tasks to do but nothing major as far as I can see.
The following is important –
Not a good idea to run two antivirus at the same time as they may clash.
You have Norton (Symantec) and avast running at the same time
Get this (from MajorGeeks) to finish off the removal of Norton.
You could try a boot scan with Avast.
I’m not qualified to process your log; that’s just general advice. Hope it might work.
Ah, not really,you could just run the program and it should totally remove all Norton products, but the normal order of things would be to uninstall it from the control panel first, reboot, then run the removal tool.
I don’t think it matters that much. I’ve only used it twice in anger.
Other suggestions to try different rootkit scanners are good.
Sophos found the file (along with 13 others… yikes!) but for every one of them it says that cleanup is not recommended. Except for ogphqtx.sys (which is in the drivers folder, like I mentioned before), all 13 of the other files are in:
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5
Since Sophos does not recommend cleanup for any of these files, I’m hesitant to do the cleanup. But all of them (except, of course, for ogphqtx.sys) are in the Temporary Internet Files, so wouldn’t they be safe to get rid of? Should I go ahead and try to cleanup all of these files anyway (ogphqtx.sys included)?
Okay. Thank you! I will definitely be getting rid of Norton as soon as this Rootkit thing is sorted out.
The temporary internet files can be simply cleaned using the disk cleanup utility, or ATF cleaner (hosted here by MajorGeeks.
I think that would be preferable to using the Sophos application to clean it; without knowing the tech details, antirootkit apps. will also delve inot the alternated data stream, and might possibly mess things up.
Definitely clean the item indicated in the drivers folder, though, and then try another scan with Avast, to see if it’s really gone.
Not sure. This is a bit beyond me.
After the cleanup, I’d try scanning with MBAM again, not so much to find that file but to see if any others have been created in the meantime.
Something is re-creating this file. That “something” is eluding detection. Although it may be related to the temporary internet files.
(We can but hope.)
If MBAM finds anything, clean with it, if it prompts for a reboot to remove that one problem file, don’t; run Sophos again and have it remove it, then reboot.
Will do. The disk cleanup has already finished, so I am scanning with MBAM now. It usually takes about an hour, so I’ll come back when its finished and let you know if it found anything.
When you are done cleaning the system Windows XP Service Pack 3 has been available for over a year and provides many Critical Updates plus performance improvements.
You need to start Internet Explorer then go to Tools then Windows Update and download all of the available updates.
Go to Control Panel then Automatic Updates then select Automatic (recommended) or at least Notify me but don’t automatically download or install them.
mbam should not take an hour to scan.
You don’t need to run thorough. Quick scan is preferable, and remember to update the definitions prior to the scan.
Do you have System Restore turned on?
If so create a new System Restore (check) point. Then use Windows Disk Cleanup in System Tools to remove all System Restore points except the most recent.
Start–>Programs–>Accessories–>System Tools–>Disk Cleanup–>More Options–>…remove all but…
Alternatively, if System restore is turned on, then turn it off prior to scanning and cleaning
Either way, should significantly decrease the time takes to scan and clean.
As YoKenny says above - you need Service pack 3 and all recommended updates.
Do this sooner rather than later, unless you are especially confident and at home with Windows OS.
MBAM still only found the one file, and it still cannot remove it.
It didn’t even occur to me to do a quick scan. I always do thorough, just to be sure it doesn’t miss anything. But you’re right, it would have been better just to do a quick one.
I think I’ll do another scan with Sophos tomorrow; too tired to do it tonight.
Also, I am aware of the service pack issue. In fact, trying to install Service Pack 3 when it came out is the reason for not having updated since. After updating, the computer said it needed to restart. So I let it do so, of course. But then it was no longer able to boot. Not even in Safe Mode. Nothing. It would try over and over again with no results.
I found a blog about this (by using another computer, of course) by a person that had found a solution for this problem. I suppose the problem came about because this is an AMD-based computer and Service Pack 3 assumed that it was an Intel-based computer and some driver was not working properly because of this. I had to disable that driver with the command prompt and then the computer was finally able to boot after several stupid and desperate attempts to fix it myself before I knew that’s all it was. I had attempted to do a system recovery at some point, which completely disorganized and confused the computer.
Now I am very wary of Windows Updates and I decided that I would only update in the future if it was -absolutely- necessary to do so. But even if I tried to update, I’m not sure it would work; I can’t even update Windows Media Player on this computer (apparently, this computer’s version of Windows Media Center (I think that’s what it was, anyway) is now invalid or something as far as the installer is concerned; which, of course, I know it’s not, but the computer is terribly confused ever since the SP3 update and the problems that resulted from it (and my attempt to fix it with a system recovery).
But yeah. I haven’t been all that trusting of windows updates ever since then. :-\
I’ve been browsing your HJT log (as a non-expert) and there are a couple of things that pretty much leap out at me.
At some stage, maybe after you’ve tried Rootrepeal (as posted by micky77) you could run HjT again. Place a tick beside all the “file missing” entries. and beside this one:
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe
and all but the first “01 hosts” entries (4 total, indicating you’ve been exposed to the rogue security program spyware-protector2009).
After doing this select “fix selected”, and reboot; post a new HJT log after this action.
Your Java is seriously out of date.
Your computer, as you say, is actually quite a mess.
Quite possibly the reason for the SP3 update failing was Norton. I have helped someone with a borked SP3 install. Worked no problem after I’d worked it out, uninstalled Norton, and put it right.
Norton is sometimes one of those programs you actually do need to disable to allow decent updates.
The above para just a bit of background info to let you know where you should be heading after this problem is sorted.