There is a vulnerability in WinPCap versions prior to 4.0.1. I looks like you have Beta v0. The vulnerability allows attackers to execute code on your computer
It was fat and ntfs only, so i cant format it. And i cannot open that usb stick now. Ok, i remove WinPCap already. And i using spybot search and destroy scan my pc, the result is my pc clean, did it really clean now??
I don’t think this is related to the repair install. Do you have a format utility from the USB stick manufacturer or are you using Windows’?
The only thing left, that I was aware of, was C:\WINDOWS\system32\msavpw1.dll and whatever was bring it back. If that’s gone for good now I would say you are clean.
Normally I would suggest celaning temp files and deleteing old restore points now but, after a repair install, I don’t think it s necessary.
I using windows and the msavpw1.dll i cant find in the system32 folder. OTMoveit result should be file not found but i still can delete it and remove success. Quite weird
Well, i hv a memory card that using at home only. That day we scan out dont hv anything, and i using it also show safely. But today suddenly contain flash.10.setup.exe in the autorun.inf then avast detect win32:VB-EHR[trj] in that memory card when i double click on that memory card. All 3 files that detect name flash.10.setup.exe, scanner.exe and love calculator.exe. I dun hv this 3 files before.
Flash.10.exe virus is B to remove. I am currently working one on Geeks to Go. If you have let the virus run then you will lose the option to look at folders, run task manager and use the command prompt
Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop http://img127.imageshack.us/img127/433/regtg8.jpg
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
Then reset the permissions and try to delete the main infectors
FILE DELETION
@Echo off
attrib -s -r -h "C:\Windows\SYSTEM32\Flash.10.exe"
del /q "C:\Windows\SYSTEM32\Flash.10.exe"
attrib -s -r -h "C:\Windows\SYSTEM32\JambanMu.com"
del /q "C:\Windows\SYSTEM32\JambanMu.com"
quit
I will need you to create the delete.bat to do that copy and paste ALL of the above in the quote box to a notepad file.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type delete.bat
This will create a delete.bat file on your desktop
To use this file you will need to left click the icon a black box may briefly appear and you are done
Then Locate the following files/folders on your system and delete them (first I would recommend copying and zipping to Avast for analysis)
C:\Windows\System32\CMD.COM
C:\Windows\System32\DXDIAG.COM
C:\Windows\System32\FLASH.10.EXE
C:\Windows\System32\JAMBANMU.COM
C:\Windows\System32\MSCONFIG.COM
C:\Windows\System32\PING.COM
C:\Windows\System32\REGEDIT.COM
C:\Documents and Settings%User%\My Documents\MY SECRET.FOLD
C:\Documents and Settings%User%\My Documents\My Music\NEW SONG.LAGU
C:\Documents and Settings%User%\My Documents\My Music\NEW VIDEO.VIDZ
C:\Documents and Settings%Use%r\My Documents\My Pictures\AWEKS.PIKZ
C:\Documents and Settings%User%\My Documents\My Pictures\SERAM.PIKZ
C:\Program Files\Common Files\Microsoft Shared\MACROMEDIA.10.EXE
C:\Program Files\Common Files\Microsoft Shared\DAO\MSN.MSN
C:\Documents and Settings%User%\Start Menu\Programs\Startup(EMPTY).EMPTY
Ok, i cant merge the fix.reg after doing what u ask. It show a error that say that is not a win32 application. Then files u ask me to found i cant found it but under this 2 i found .exe.
mauserme, we find the C:\WINDOWS\system32\msavpw1.dll already. It really not clean up from system32, and i know where it locate already. Should we delete through from windows?? This is after virustotal scan result.
Hi calciver. I’m not ignoring you - I want to go through your logs again and figure out a way to make this file disappear once and for all. My time has not been my own this week but I should be able to delve in deeper this weekend.
In regard to the USB stick, have you checked the manufacturere’s web site to see if they have a format utility? It may work better than Windows if they have one available.
EDIT: I didn’t see Essexboy’s response until just now. Do everything he says …
@ Essexboy
Ta
We deleted a mountpoints2 reg entry for the E: drive several pages back but when we looked for flash.10.setup.exe on E: it coulnd’t be found.
Thx, I already format the memory card and work normally already. I think that may be infected when i take my memory card check at the shop, it going some problem in my handphone. I make the fix.reg as Essexboy tell me but it cant be merge.
Edit: Its ok, everyone got work also, good luck for your own things
Holly fricken cow. :
You all have worked so hard for him!
I only read the first page and 13, 14, but holly cow. This guy needs to buy you all beer or something. ;D
Good work.
To keep up with the spirit of giving and to test my stuff against this one, Caciver, if you get reinfected, and I think you will because of the damage and holes left by the monster, log in for a free est, www.virusSWAT.com Services, Free Estimate. When asked for info about your issues, ask for Dean, say you are from this forum, I will hook ya up with our PC Barricade, (I will keep the Avast and not use Trend though).
Please do it on Monday if you do.
Yup, it still on C:\WINDOWS\system32 but at other location. Spend long time and eyes almost spoilt to get it out. I hv try remove with OTMoveit, result same. After delete then come back.
LOL. The guy who did our web site it too smart. Does not know how to do things simple! We are working on it.
Here is a direct link, please do not do it till monday cuz I am playing with my kids. http://www.virusswat.com/help/default.asp?2339
I’ve had some conversation with Essexboy about this and I think we should try the deletion method he posted several pages back (ta to Essexboy for sharing with me once again):
Please downloadThe Avenger by Swandog46 to your Desktop.
[*]Click on Avenger.zip to open the file[*]Extract avenger.exe to your desktop
Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
[QUOTE]Files to delete:
C:\WINDOWS\system32\msavpw1.dll
[/quote]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
Now, start The Avenger program by clicking on its icon on your desktop.
[*] Under “Script file to execute” choose “Input Script Manually”.
[*]Now click on the Magnifying Glass icon which will open a new window titled “View/edit script”
[*] Paste the text copied to clipboard into this window by pressing (Ctrl+V).
[*] Click Done
[*] Now click on the Green Light to begin execution of the script
[*] Answer “Yes” twice when prompted.
The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Unload”, The Avenger will actually restart your system twice.)
[*]On reboot, it will briefly open a black command window on your desktop, this is normal.
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
[*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply
@dewild1
Is there something you can do within the avast! forum. I think we would all like to learn from your abilities.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:08:20 PM, on 9/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
