hello ^^ I’ve already tried bootscan 3 times…but it still shows up on all 3 drives (which includes my external HD)
its rather annoying…ive tried deleting it, moving to chest…still wont go away…
and here’s the logfile…
please help me thank you…
also, is it true it sends log in information to hackers??
[b]EDIT: I downloaded the latest version of HJT … here’s the log file ^[1]
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:01 AM, on 1/29/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Why can’t you remove it, e.g. file is in use, it keeps coming back, etc. try to be more detailed ?
What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe
If it keeps coming back, there is likely to be an undetected or hidden element to the infection that restores or downloads the file again. What is your firewall ?
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
Your copy of HJT is out of date so it would be best to install the latest version (after running the above programs) FileHippo Download - HiJackThis and post the results.
You don't appear to have an active firewall - It should be capable of blocking unauthorised outbound Internet Connections. - What is your firewall ?
Suspect:
O4 - HKLM\..\Run: [ ] C:\WINDOWS\MyMP3.vbs
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
HJT ACTIONS
Suspect: Upload the file/s to VirusTotal, Send a sample to avast if multiple detections at VT and Fix in HJT (see below)
####
Check the suspect file/s at: [url=http://www.virustotal.com/][b]VirusTotal - Multi engine on-line virus scanner[/b][/url] and report the findings here in the topic.
Send the sample to [b]virus@avast.com[/b] zipped and password protected with the password in email body, a reference to this topic (give URL) and undetected malware in the subject.
Run HJT again (close any other windows except HJT), tick the box to the left of the suspect entry you wish to fix, click the Fix Selected Button.
####
The file keeps on coming back…when I tried to bootscan it removed a ton of these in my registries etc…
then when I open my computer again the warning says I have a virus @ (C:\autorun.inf, D:\autorun.inf, F:\autorun.inf) << I have 2 drives and 1 external HD.
Here is what I suggest (at least to start with):
1] Disable system restore
2] Disable autorun
3] Do NOT attach any removable drive (drive, thumbnail, etc)
4] Run a bootscan with avast and have it check ALL files (yes, this can take a while to finish)
5] Run CCleaner
6] Reboot (to make sure all changes have been applied)
7] Search your system for autorun*.* files and delete ALL it finds (make sure showing system/hidden files is enabled)
8] Attache any removable storage device and run a full scan on it. Have Avast clean everything it can.
The Windows XP’s firewall is better than no firewall but, it lulls you into a false sense of protection, it doesn’t provide outbound protection. Whilst the windows XP firewall is usually good at keeping your ports stealthed (hidden) it provides no outbound protection and you should consider a third party firewall.
Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.
There are many freeware firewalls such as, Comodo (care required now it is a suite not to install the anti-virus element), PCTools Firewall Plus, Jetico, etc. - Zone Alarm free works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated with trial ware and is also crippled as far as outbound protection goes In the Program Control, configuration area, the slider will only goes as far as Medium protection, if you want more you have to buy the Pro version.
I run the 2 spyware software you recommended…did it on safe mode…and I cant find any log file ~_~ but SuperAntiSpyware detected 3 adware tracking cookie…its gone now~
When I went back from safe mode … Avast virus warning still pops up…uploaded the suspect files to virustotal and got this:
It normally displays the log on completion, run it again and click the Logs tab and select the relevant log.
Tracking cookies are a minor issue and not really a security one, I disable that option in the scanning settings. Don’t allow third party cookies (normally associated with tracking) in your browser and periodically clear out your cookies.
Yes, send the MyMP3.vbs to avast the other which isn’t detected by any scanner I would hold off on sending the dimsntfy.dll file.
Have you downloaded and run the Flash Disinfector tool I gave the link for ?
1 - Flash Drive Disinfector
Download Flash_Disinfector.exe by sUBs from >here< and save it to your desktop.
[*] Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.[*] The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.[*] Wait until it has finished scanning and then exit the program.[*] Reboot your computer when done. Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don’t delete this folder…it will help protect your drives from future infection.
uwah…the virus is gone!!! ;D sorry… tried the HJT fix thingie again on safe mode…hehehe >_<
will now disinfect my external HD …
thank you thank you again… ;D
ermm… should I still run SUPERAntispyware and Malwarebytes along with AVAST, Spywareblaster (this is the one I use for spyware…) and firewall (will download later)? …
Yes the two on-demand anti-spyware scanners compliment avast and if you haven’t noticed, check my signature below my posts ;D.
SpywareBlaster is not an anti-spyware applications, it is passive, you can’t run on-demand scans and was a total passenger in this as it isn’t something it is even immunising against.
