system
April 14, 2009, 7:40pm
1
Hey guys!
I was watching a streaming video of Castle (ABC show) on a googled site when an Avast alarm went off. It told me it had found the worm Win32:VB-FXE [trj]. I immediately stopped the video and started up a thorough scan with Avast. It immediately popped up with three or four infected files that I moved to quarantine chest as recommended. I am still in the process of completing the scan and I was wondering what my next move should be? Should I trust that Avast has sufficiently quarantined the worm or are there more steps I should take? Any advice would be appreciated, but it might have to be on a more remedial level. Ive looked through this forum a bit and I am easily confused by some of the advice given.
Thanks so much.
system
April 14, 2009, 7:56pm
3
Howdy Tech!
Thank you for your reply! I have seen you give this response before on other threads and I am sure it is VERY sound advice. I also understand that you help many, many people who post threads just like mine. However, as I stated I think I may need more instruction on just what your Eight-Step program involves. I have a few questions if I may… :-[
I am already scanning with archive scanning on. Should I abort this scan and start over with the cleaning of the temp files?
Is it okay to install the programs you mentioned? I mean, if the worm isnt contained it wont harm the program downloads or corrupt files, will it?
Should I install all these programs at the same time, then do step 2?
I have more questions, but I think those are the ones that would cover the first few moves on my end. I just want to make sure I dont install something only to have it corrupted. I am also scared of my computer failing to boot up if I shut down.
Sorry for the headache!
system
April 14, 2009, 8:07pm
4
Avast alarm just went off again…
This time it came up with Win32:Trojan-gen {Other}. I moved it to the chest as well. Should I just wait out this initial scan?
I am already scanning with archive scanning on. Should I abort this scan and start over with the cleaning of the temp files?
No, go ahead.
Is it okay to install the programs you mentioned? I mean, if the worm isnt contained it wont harm the program downloads or corrupt files, will it?
Very few malware block the installation of that programs. You could try and post the results.
Should I install all these programs at the same time, then do step 2?
Finish your avast scanning… maybe it won’t even necessary to run it at boot time, depending on the results.
system
April 14, 2009, 9:47pm
6
This is what Dr. CureIt came up with. What should I do with the files that can not be cured or moved?
popcaploader.dll;c:\windows\downloaded program files;Program.PopcapLoader;Cannot move.Cannot delete.Cannot move.;
system
April 15, 2009, 3:44am
7
Rootkit log:
±---------------------------------------------------
–== Dump Hidden MBR and Hidden File on C:\ ==–
–== Dump Hidden Registry Value on HKLM ==–
–== Dump Hidden Process ==–
–== Dump Hidden Driver ==–
Im guessing that this is a good thing.
system
April 15, 2009, 3:48am
8
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
system
April 15, 2009, 3:50am
9
O4 - HKUS\S-1-5-21-3075862019-4194980175-618666321-1003..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup (User ‘Jenn’)OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe (User ‘Jenn’)OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe (User ‘Jenn’)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/MyFunCardsFWBInitialSetup1.0.1.0.cab http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-us.cab http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab http://zone.msn.com/bingame/luxr/default/mjolauncher.cab http://web1.shutterfly.com/downloads/Uploader.cab http://www.linksysfix.com/netcheck/67/install/gtdownls.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://zone.msn.com/binframework/v10/StProxy.cab55579.cab http://messenger.zone.msn.com/binary/WoF.cab57176.cab http://aolsvc.aol.com/onlinegames/popzuma/popcaploader_v10.cab https://secure.gopetslive.com/dev/GoPetsWeb.cab http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab
system
April 15, 2009, 3:50am
10
O18 - Protocol: bw+0 - {75BD74E1-9A7F-43BD-8703-8388F9B9C85B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
system
April 15, 2009, 3:51am
11
O18 - Protocol: bwp0s - {75BD74E1-9A7F-43BD-8703-8388F9B9C85B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
–
system
April 15, 2009, 8:46am
12
An analysis of your HJT log shows the following :
We didn’t detect any active process of a firewall on your system. Reasons maybe:
Platform: Windows Vista (WinNT 6.00.1904)
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL http://www.threatexpert.com/files/a9srchas.dll.html
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe (file missing)
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Farm%20Frenzy/Images/stg_drm.ocx http://www.prevx.com/filenames/1545113104529264601-X1/STG_DRM.OCX.html
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/MyFunCardsFWBInitia lSetup1.0.1.0.cab http://www.2-spyware.com/remove-funwebproducts.html http://www.tnet.com/fun-web-products.php
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Farm%20Frenzy/Images/armhelper.ocx http://www.prevx.com/filenames/X3821396689427713719-X1/ARMHELPER.OCX.html
system
April 16, 2009, 1:41am
13
Thanks for the Summary CharleyO! I think I might have fixed the issues you suggested. Since I did not have a firewall, I decided to get Kerpersky to patch up that lose end. I have also upgraded to SP1. Would you mind looking over a fresh HJT to see if there is anything else that needs to be cleaned up? How do I know when my system is clean?
Thanks and sorry for the bother!
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
April 16, 2009, 1:42am
14
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
system
April 16, 2009, 1:43am
15
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab http://gfx1.hotmail.com/mail/w2/resources/VistaMSNPUplden-us.cab http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab http://zone.msn.com/bingame/luxr/default/mjolauncher.cab http://web1.shutterfly.com/downloads/Uploader.cab http://www.linksysfix.com/netcheck/67/install/gtdownls.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab http://zone.msn.com/binframework/v10/StProxy.cab55579.cab http://messenger.zone.msn.com/binary/WoF.cab57176.cab http://aolsvc.aol.com/onlinegames/popzuma/popcaploader_v10.cab https://secure.gopetslive.com/dev/GoPetsWeb.cab http://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab
system
April 16, 2009, 1:43am
16
O18 - Protocol: bwe0s - {75BD74E1-9A7F-43BD-8703-8388F9B9C85B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
system
April 16, 2009, 1:44am
17
O18 - Protocol: bwy0 - {75BD74E1-9A7F-43BD-8703-8388F9B9C85B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dllCrawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
system
April 16, 2009, 9:09am
18
One more to get that I somehow missed in the last HJT.
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} - http://www.spyandseek.com/Search.php?search_for=DBA230D1-8467-4e69-987E-5FAE815A3B45&search=SAS-Search
It is no bother as I like to help when I can. After fixing the entry above, all should be well.
system
April 16, 2009, 5:25pm
19
Ok, I took care of O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} - . Spyware Terminator is now coming up clean as well. Thank you CharleyO and Tech for helping me through the process.
As for the computer, it is running a bit slow still… I can hear the hard drive? spinning a lot. I also have an issue with a black screen after logging into a non-admin account on the computer. I think that is the fault of Microsoft though.
Good luck with the next cases and thanks again for the guidance. ;D
Edit - After running the computer a bit today, I am not sure if the computer is clean or not. /sigh. Ive gotten a couple of pop-ups and a failure to load Windows from Safe Mode…any suggestions?
system
April 17, 2009, 10:34am
20
If you have not run MBAM yet, go ahead and run it now. Download it, update it, and then run a quick scan.
http://www.malwarebytes.org/mbam.php
That is my next issue to tackle. :-\