system
December 8, 2007, 4:01am
21
Ok, I have a notebook running XP with avast and I have installed superantispyware.
When my desktop loads up after turning on my PC I get the warning message that VBS:malware-gen has been detected
I have followed the procedure outlined at the start of this thread.
There is another suggested fix athttp://roguemei.blogspot.com/2007/08/removing-vbsmalware-gen-virus-solution.html
which i have also followed and still it seems to be there.
I have run AVG Anti-Rootkit, Dr Web Cureit, Trend Micro Housecall and CCleaner which cleared a couple of trojans and unwanted cookies
I have removed cookies, deleted temporary internet files
Any thoughts?
system
December 8, 2007, 9:25am
22
Hi, I had tha same virus, Avast couldn’t get rid of it, register with this forum they will show you how to remove it,http://www.techguy.org/ when you join click on general security tell them your problem and they will sort it for you. good luck
DavidR
December 8, 2007, 1:58pm
24
When my desktop loads up after turning on my PC I get the warning message that VBS:malware-gen has been detected
"Sign of "VBS:Malware-gen" has been found in "C:\DOCUME~1\Scott\LOCALS~1\Temp\1.reg" file. "
Each time I get the warning I move to chest as per the suggested action
If this file keeps coming back, “C:\DOCUME~1\Scott\LOCALS~1\Temp\1.reg” something undetected is either restoring it or downloading it again. I doubt it is the downloading bit as I would hope that the web shield would detect it on download and abort the connection, stop it being downloaded.
So something has to be running at boot to be able to do this, so I would suggest running HJT to see what is running and post the contents of the HJT log file here. Copy and paste the contents into a new post or posts if it is a large log.
Program & Tutorial - Also useful as a diagnostic tool - FileHippo Download - HiJackThis HiJackThis Tutorial 1
The 1.reg file seems a strange one to get a VBS (Visual Basic Script) malware alert on as .reg files are files that can be used to modify the registry. However, the file type displayed doesn’t have to be correct, but I would suggest confirmation at: VirusTotal - Multi engine on-line virus scanner
system
December 9, 2007, 3:49am
25
Ok DavidR thanks I have submitted it to virustotal and here is the report:
File 1.reg received on 11.17.2007 19:05:24 (CET)Antivirus Version Last Update Result
Additional information
also, I have run HJT and have the report from that, none of this means much to me and I am a bit reluctant to do too much more without advice, what i should do next?
A file called 1.reg is not welcome… I won’t be sure the file is innocuous by your Virustotal report. I suggest:
Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on.
Use AVG Antispyware ; SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Test your machine with anti-rootkit applications . I suggest AVG or Trend Micro RootkitBuster .
Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
Immunize your system with SpywareBlaster or Windows Advanced Care .
Check if you have insecure applications with Secunia Software Inspector .
Specially step 6 with Runscanner automatic analysis could help us helping you.
DavidR
December 9, 2007, 2:08pm
27
File 1.reg received on 11.17.2007 19:05:24 (CET)Antivirus Version Last Update Result
also, I have run HJT and have the report from that, none of this means much to me and I am a bit reluctant to do too much more without advice, what i should do next?
From the VT hits, a google search on the other malware names (commonly, TCPParams) it is possible that there may be other elements hidden/undetected, see below.
Post the contents (copy and paste) of the HJT log file here, it may need to be split over two or more posts, depending on how large it is.
Try these other anti-rootkit tools and report the findings.
system
December 10, 2007, 6:43am
28
As requested
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
system
December 10, 2007, 6:47am
29
continued 2/2
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab http://go.microsoft.com/fwlink/?linkid=39204 http://downloads.ewido.net/ewidoOnlineScan.cab http://ppd.swinburne.edu.au/stuinf/vm.cab
–
Thanks
DavidR
December 10, 2007, 4:20pm
30
First you don’t appear to have an active firewall, what is your firewall ?
Unknown:
Upload to VirusTotal, send the sample to avast if multiple detections and FIX in HJT (see below)
C:\WINDOWS\system32\sysregi.exe
There is only one hit in a google search for the file name and that one is suspect. If this really was a Nod32 file then there would be much more information about it, I take it you aren’t using or haven’t got or had nod32 on your system ?
O16 - DPF: {FDE14979-D821-4CD8-BE1C-9D6AF01D097F} (VMTOCCtrl Class) - http://ppd.swinburne.edu.au/stuinf/vm.cab
Is this something that you require, is swinburne.edu.au familiar to you, etc. ?
FIX:http://www.bleepingcomputer.com/startups/ALCMTR.EXE-240.html
Other than the above I don’t see anything obvious.
Check the suspect file/s at: VirusTotal - Multi engine on-line virus scanner
Send the sample to virus@avast.com
Run HJT again (close any other windows except HJT), tick the box to the left of the suspect entry you wish to fix, click the Fix Selected Button.
system
December 16, 2007, 2:04am
31
DavidR
I seem to be all better, sysregi.exe was the problem. So since I deleted it I Avast has not detected anything. And I never had nod32 on my pc ever.
I have loaded on Comodo firewall now too
Thanks for your help, Merry Christmas
DavidR
December 16, 2007, 2:32am
32
That is what I was saying this was trying to hide ad a nod32 application when the file had no association with nod32. But it was just confirmation that you hadn’t had nod32 at any time in the past.
Your welcome and a Merry Christmas to you too.