(I only renamed the Avast folder so that any malwares that search for the folder to delete it, will not detect it)
Part 1
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
Part 2
C:\WINDOWS\system32\ctfmon.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://favorites.live.com/quickadd.aspx Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://ak.imgag.com/imgag/cp/install/AxCtp2.cab http://support.dell.com/systemprofiler/SysPro.CAB http://www.creative.com/su/ocx/15009/CTSUEng.cab http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193516774250 http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1193516760546 http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab http://a532.g.akamai.net/f/532/6712/4h/player.virtools.com/downloads/player/Install3.0/Installer.exe https://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab http://www.adobe.com/products/acrobat/nos/gp.cab http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab http://www.creative.com/su/ocx/15010/CTPID.cab
Part 3
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
–
system
April 8, 2009, 5:30am
4
An analysis of your HJT log shows the following :
O4 - HKLM..\Run: [DSS] C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE http://www.prevx.com/filenames/X1528353241193056308-X1/DSSAGENT.EXE.html
O16 - DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
There were several other questionable entries but research checked those as OK.
DavidR
April 8, 2009, 1:57pm
5
Lets not forget to help improve avast detection - Upload this to virustotal C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE for analysis:
Check the suspect file/s at: VirusTotal - Multi engine on-line virus scanner
Send the sample to virus@avast.com
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that .
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
I can’t upload it because its hiding from me…
DavidR
April 8, 2009, 4:15pm
7
Ensure that you have hidden files and folders enabled and disable hide system files in Windows Explorer, Tools, Folder Options, Hidden files and folders, uncheck Hide extensions for known file types, etc. see image.
I have those settings set, I’ll try uploading it again…
I got this:
Service Temporarily Unavailable
DavidR
April 8, 2009, 5:50pm
10
In the meantime send it to avast as a possible undetected malware sample.
You could also try this scanner, http://www.virscan.org/ or http://virusscan.jotti.org/ .
system
April 8, 2009, 6:37pm
11
There seem to be a couple of “Symnatec” Items in your HijackThis Log !?
Hi DavidR,
I tried typing C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE in the textbox and then clicked upload and it said “Error: File not Valid”. Do you think maybe the virus is hiding still?
Hi Spiritsongs,
I’ll try what you said! (After I find out which one to install)
~Donovansrb10~
DavidR
April 8, 2009, 7:48pm
13
You really have to find it first as if it can hide from you it will also be hiding from the explorer interface too. So did you find it first ?
If not even with the view hidden files and folders settings in the image I posted, then it could be being hidden by a rootkit.
Also see, anti-rootkit, detection, removal & protection http://www.antirootkit.com/software/index.htm . Try these as they are some of the more efficient and user friendly anti-rootkit tools.
Avast! Anti-Rootkit crashed when it was almost done but it found over 2,000 rootkits.
Here is the first part of the Avast! Anti-Rootkit (I think this is the most important part - besides, its a big file and could take up to 16 posts.)
Registry item [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\EventHandlersDefaultSelection] PlayCDAudioOnArrival=“MSRipCDAudioOnArrival” HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN HIDDEN
Scan finished: Monday, April 06, 2009 11:17:30 AM
DavidR
April 8, 2009, 9:40pm
16
Looks like you are using the old stand alone beta anti-spyware which hasn’t been updated in some time ?
The one incorporated in avast is much more accurate so I would ignore the avast beta anti-rootkit. It was meant to be released as a stand alone tool but that didn’t happen.
See image as this is the current anti-rootkit within avast that runs 8 minutes after boot.
Hi :