I need help. My O.S. is Win Xp and was using Avast free home edition antivirus. I was trying to download a file from the internet and got infected. At the time of Infection there was a triangle Icon which popped out from the system tray which said “Antivirus not installed” or something which I forgot exactly what it said.
Now Avast wasn’t able to detect it so had to install a different antivirus to check, installed AVG and walla… it detected that the file C:\WINDOWS\system32\cd.dll is infected with “Trojan Horse Generic9.AAUM”
Now the problem is I ain’t able to delete or fix the file. It just keeps coming back. Even deleting from the folder system32 wouldn’t let me delete the file. Tried using safe mode still the same.
Is there a way to remove this? Please help. Thanks in advance.
As this is a malware BHO download toolbarcop from here: http://www.majorgeeks.com/download4126.html
Fire it up and copy to clipboard its findings, put them here as a textfile (if not inside 1 post, use more), then we can see what you should remove from the list after analysis.
Oh no… something went wrong. I downloaded toolbarcop and unzipped to a new folder on the desktop but when tried to run it this is what came up “Component ‘mscomctl.ocx’ or one of its dependencies not correctly registered: a file is missing or invalid”
Component MSCOMCTL.OCX or one of its dependencies not currently registered …
Sometime certain Microsoft Libraries can become unregistered when installing and uninstalling a lot of software. One very common problem is the MSCOMCTL.OCX.
Good you got the library dependency back. Now we can proceed.
Just fire up toolbarcop again, put a tag before
(Empty)
BHO
{9828DDAB-2B7A-4626-885A-5579EA690FEB}
C:\WINDOWS\system32\cd.dll
Enabled
All Users
And delete if from your comp.
Hi polonus, thanks again. But I was not able to delete it. I have even tried to disable it first and then delete. But it just wouldn’t be deleted.
Is there another way?
Hi polonus… when I tried using killbox with path as “c:\windows\system32\cd.dll” to delete. It says file does not exist. But when I checked it manually going to sytem32 folder. File is still there. When I tried “delete on reboot” the virus changes the registry and reboot stops. Is there another way to delete this file? Please help!!!
If that would not work start up in safe mode and try to kill cd.dll there.
STEP 1
Start the computer in Safe mode
1
Exit all programs.
2
Click Start > Run.
3
In Run dialog box, type the following text:
msconfig
4
Click OK.
5
In the System Configuration Utility, on the BOOT.INI tab, check /SAFEBOOT.
6
Click OK.
7
When you are asked to restart the computer, click Restart.
The computer restarts in Safe mode. This can take several minutes.
NOTE Note After you complete the work in Safe mode, use the System Configuration Utility to start Windows XP in Normal mode. Go to STEP 2.
STEP 2
Start the computer in Normal mode
1
Close all programs.
2
Click Start > Run.
3
In Run dialog box, type the following text:
msconfig
4
Click OK.
5
In the System Configuration Utility, on the BOOT.INI tab, uncheck /SAFEBOOT.
[*]Unzip it to your desktop to a folder named avz4
[*]Double click on AVZ.exe to run it.
[*]Run an update by clicking the Auto Update button on the Right of the Log window: http://rathat.geekstogo.com/images/AVZupdate.jpg
[*]Click Start to begin the update
Note: If you recieve an error message, chose a different source, then click Start again
[*] Start AVZ.
[] Choose from the menu “File” => "Standard scripts " and mark the “Healing/Quarantine and Advanced System Investigation” check box.
[] Click on the “Execute selected scripts”.
[] Automatic scanning, healing and system check will be executed.
[] A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
[] It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
[] All applications will work properly after the system restart.
.
When restarted
[*] Start AVZ.
[] Choose from the menu “File” => “Standard scripts " and mark the “Advanced System Investigation” check box.
[] Click on the “Execute selected scripts”.
[*] A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.
Not so desperate, my good friend. Let us not haste into things that are not at hand at the moment.
It is well possible that the scanner that alerted you to the malware did delete it, whereas toolbarcop mentioned it was Empty, something must have emptied it. The registry entrance on it has been removed. So there are two possibilities a: this is a ghost notice, or something else is preventing the delete. Let us try a couple of things next. A upload the cd.dll to virustotal, and give me the details what the scan gives there. Follow essexboy’s suggestions now, anxious to know what is the matter really, when you use his tool first clean all your temporary files using ATF-Cleaner http://www.atribune.org/ccount/click.php?id=1
& you must not allow system restore when using this.
Also, I have tried HijackThis in normal and safeboot and here is the log…
[b]Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:06 AM, on 12/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Download avz4.zip from here
[list]
[*]Unzip it to your desktop to a folder named avz4
[*]Double click on AVZ.exe to run it.
[*]Run an update by clicking the Auto Update button on the Right of the Log window: http://rathat.geekstogo.com/images/AVZupdate.jpg
[*]Click Start to begin the update Note: If you recieve an error message, chose a different source, then click Start again
[*] Start AVZ.
[*] Choose from the menu “File” => "Standard scripts " and mark the “Healing/Quarantine and Advanced System Investigation” check box.
[*] Click on the “Execute selected scripts”.
[*] Automatic scanning, healing and system check will be executed.
[*] A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
[*] It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
[*] All applications will work properly after the system restart.
. When restarted
[*] Start AVZ.
[*] Choose from the menu “File” => “Standard scripts " and mark the “Advanced System Investigation” check box.
[*] Click on the “Execute selected scripts”.
[*] A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.
. Attach both zip files to your next post[/list][/list]
