system
December 14, 2007, 1:47am
1
??? ??? ??? ??? earlier today my sister sent me a file on msn it said do you like this, and i opened it now my avast is going crazy saying caution potential infection was detected,then it says continue or dont send the more i press dont send the more it pops up, its not stopped popping up i dont know what to do,the avast mail scanner is permenatly running in the blue bar at the bottom but im not sending no email heres what it says as well when it pops up,
There are too many identical e-mails in appointed time
these are emails i am not sending it turns out my sister never sent me the file its some sort of virus or something and her computer is going crazy too,can anyone be any help to me im at my wits end havent a clue what to do, ive deleted msn and told everyone to block me as they say i was sending files to them, which i wasnt. ive deleted the file what was sent to me i have done a virus scan its not found anything, were are these emails being sent from on my pc ???
please help thanks…gemma
DavidR
December 14, 2007, 2:32am
2
Please modify your Post removing the email addresses, as these may be legitimate emails which could be harvested resulting in more spam being sent to these innocent bystanders.
There would appear to be an undetected or hidden trojan spambot on your system sending out these emails.
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode.
If using winXP SUPERantispyware AVG anti-spyware (formerly Ewido) Spyware Terminator a-Squared free
What is your firewall (?) as this too should be able to intercept unauthorised internet connections (like the application trying to send the emails) ?
system
December 14, 2007, 11:01am
3
thanks for your help i have windows firewall and ive run the things you have told me and there is nothing its free of spyware. so what can i do to get this off
system
December 14, 2007, 1:26pm
4
Hmmm maybe you are attacked by trojan mirror…
DavidR
December 14, 2007, 2:40pm
6
Did you run the SAS, etc. in safe mode as suggested and if so what were the results ?
Next step this may be protected by a rootkit so it is hidden by another process, the rootkit.http://www.antirootkit.com/software/index.htm . Try these as they are some of the more efficient and user friendly anti-rootkit tools.
system
December 14, 2007, 2:47pm
7
i think its gone thanks very much for all your help ;D no more pop ups or the email thing in my blue tray at the bottom
DavidR
December 14, 2007, 3:20pm
8
Which program was it that you ran that detected it and what was the detected file ?
These tools usually give a log on completion information from that log could help others, especially if we can obtain a sample of the file/s concerned.
system
December 14, 2007, 5:01pm
9
its not gone still here im gonna try everything again :-[ :-[ :-[
DavidR
December 14, 2007, 6:09pm
10
Try one thing at a time and report the findings so that we can see what has been found or otherwise.
The more information we have the more likely we will be able to help.
As I mentioned previously the anti-spyware tools I gave in my first reply are best run from safe mode.
system
December 14, 2007, 7:41pm
11
ive tried superantispyware in safe mode and the avg one in safe mode they find nothing im gonna keep trying everything else you have said il keep you updated on my findings
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP . System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
As posted before by David, it will be good if you download, install, update and run AVG Antispyware . Some users recommend SUPERantispyware , Spyware Terminator and/or a-squared (take care about false positives).
If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications . I suggest AVG or Trend Micro RootkitBuster (for XP/Vista). For XP: Panda (for XP).
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
system
December 14, 2007, 8:41pm
13
i am running spyware terminator at the min and there are 11 critical objects
but the little avast mail symbol does not stop running in my tray at the bottom as if im sending loads of emails and im not there spam emails.
DavidR
December 14, 2007, 9:39pm
14
Yes give us details, without them we are totally in the dark.
What are the 11 critical objects, etc. ?
You can copy and paste the contents of that loge here, you may need to split it over two posts if it is large.
system
December 14, 2007, 9:52pm
15
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60327 http://www.blueyonder.co.uk/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.crawler.com/search/ie.aspx?tb_id=60327 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.crawler.com/search/ie.aspx?tb_id=60327 http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327
system
December 14, 2007, 9:53pm
16
O4 - HKLM..\Run: [lxcrmon.exe] “C:\Program Files\Lexmark 2400 Series\lxcrmon.exe”Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://downloads.ewido.net/ewidoOnlineScan.cab http://www1.snapfish.co.uk/SnapfishUKActivia.cab http://bmm.imgag.com/imgag/cp/install/crusher-uk.cab http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe https://flashcasino.ladbrokes.com/instant-play-en/FlashAX.cab Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
this is from hijackthis
system
December 14, 2007, 9:56pm
17
i am just doing runscanner now ive done everything what everyone has told me, and its still here sending emails from my laptop :‘( :’(
system
December 14, 2007, 9:59pm
18
and this is from runscanner
Runscanner logfile http://www.runscanner.net
Computer name : STUANDKAITLYNN
c:\windows\system32\alg.exe (Microsoft Corporation)
c:\program files\symantec\liveupdate\aluschedulersvc.exe (Symantec Corporation)
c:\program files\alwil software\avast4\ashserv.exe (ALWIL Software)
c:\program files\alwil software\avast4\aswupdsv.exe (ALWIL Software)
c:\program files\alwil software\avast4\ashmaisv.exe (ALWIL Software)
c:\progra~1\alwils~1\avast4\ashdisp.exe (ALWIL Software)
c:\program files\alwil software\avast4\ashwebsv.exe (ALWIL Software)
c:\windows\system32\csrss.exe (Microsoft Corporation)
c:\windows\system32\dllhost.exe (Microsoft Corporation)
c:\progra~1\crawler\toolbar\ctoolbar.exe (Crawler.com )
c:\windows\system32\ctfmon.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\svchost.exe (Microsoft Corporation)
c:\windows\system32\hkcmd.exe (Intel Corporation)
c:\program files\internet explorer\iexplore.exe (Microsoft Corporation)
c:\program files\java\jre1.6.0_03\bin\jusched.exe (Sun Microsystems, Inc.)
c:\program files\common files\symantec shared\pif{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe (Symantec Corporation)
c:\windows\system32\lsass.exe (Microsoft Corporation)Crawler.com )
c:\windows\ehome\mcrdsvc.exe (Microsoft Corporation)
c:\windows\ehome\ehmsas.exe (Microsoft Corporation)
c:\windows\ehome\ehrecvr.exe (Microsoft Corporation)
c:\windows\ehome\ehsched.exe (Microsoft Corporation)
c:\windows\ehome\ehtray.exe (Microsoft Corporation)
c:\windows\system32\igfxpers.exe (Intel Corporation)
c:\windows\system32\lxcrcoms.exe
c:\windows\rthdcpl.exe (Realtek Semiconductor Corp.)
c:\windows\system32\rundll32.exe (Microsoft Corporation)
c:\documents and settings\lisa richardson\local settings\temporary internet files\content.ie5\m7e9lj7p\runscanner[1].exe (Runscanner.net )
c:\windows\system32\services.exe (Microsoft Corporation)
c:\windows\system32\spoolsv.exe (Microsoft Corporation)Crawler.com )
c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe
c:\program files\synaptics\syntp\syntpenh.exe (Synaptics, Inc.)
c:\program files\synaptics\syntp\toshiba.exe (Synaptics, Inc.)
c:\windows\explorer.exe (Microsoft Corporation)
c:\windows\system32\winlogon.exe (Microsoft Corporation)
c:\windows\system32\smss.exe (Microsoft Corporation)
C:\WINDOWS\agrsmmsg.exe (Agere Systems)
c:\progra~1\alwils~1\avast4\ashdisp.exe (ALWIL Software)Crawler.com )
c:\program files\alwil software\avast4\ashserv.exe (avast! Antivirus)
c:\program files\alwil software\avast4\aswupdsv.exe (avast! iAVS4 Control Service)
c:\program files\alwil software\avast4\ashmaisv.exe (avast! Mail Scanner)
c:\program files\alwil software\avast4\ashwebsv.exe (avast! Web Scanner)
c:\program files\google\common\google updater\googleupdaterservice.exe (Google Updater Service)
c:\program files\common files\logishrd\srvlnch\srvlnch.exe (LVSrvLauncher)
C:\WINDOWS\system32\drivers\aegisp.sys (AEGIS Protocol (IEEE 802.1x) v3.5.3.0)
c:\windows\system32\drivers\aswrdr.sys (aswRdr)
c:\windows\system32\drivers\aavmker4.sys (avast! Asynchronous Virus Monitor)
c:\windows\system32\drivers\aswtdi.sys (avast! Network Shield Support)
c:\windows\system32\drivers\aswmon2.sys (avast! Standard Shield Support)
c:\windows\system32\drivers\changer.sys (Changer)
system
December 14, 2007, 10:00pm
19
C:\WINDOWS\system32\dla\dlaudfam.sys (DLAUDFAM)
c:\windows\system32\drivers\i2omgmt.sys (i2omgmt)
c:\windows\system32\drivers\lbrtfdc.sys (lbrtfdc)
C:\WINDOWS\system32\drivers\lvckap.sys (Logitech AEC Driver)
C:\WINDOWS\system32\drivers\lvmvdrv.sys (Logitech Machine Vision Engine Loader)
c:\windows\system32\drivers\lv561av.sys (Logitech QuickCam Express(PID_0928))
c:\windows\system32\drivers\lvusbsta.sys (Logitech USB Monitor Filter)
c:\windows\system32\drivers\pcidump.sys (PCIDump)
c:\windows\system32\drivers\pdcomp.sys (PDCOMP)
c:\windows\system32\drivers\pdframe.sys (PDFRAME)
c:\windows\system32\drivers\pdreli.sys (PDRELI)
c:\windows\system32\drivers\pdrframe.sys (PDRFRAME)
c:\windows\system32\drivers\wanatw4.sys (WAN Miniport (ATW))
c:\windows\system32\drivers\wdica.sys (WDICA)
C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) {1E66F26B-79EE-11D2-8710-00C04F79ED0D}
c:\program files\common files\microsoft shared\information retrieval\msitss.dll (Microsoft Corporation) {0A9007C0-4076-11D3-8789-0000F8105754}Crawler.com ) {4D25FB7A-8902-4291-960E-9ADA051CFBBF}
c:\windows\system32\mscories.dll (Microsoft Corporation) {89B4C1CD-B018-4511-B0A1-5476DBF70820}
c:\progra~1\crawler\toolbar\ctbr.dll (Crawler.com ) {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
c:\progra~1\crawler\toolbar\ctbr.dll (Crawler.com ) {4B3803EA-5230-4DC3-A7FC-33638F3D3542}
c:\program files\messenger\msmsgs.exe {FB5F1910-F110-11d2-BB9E-00C04F795683}
c:\documents and settings\lisa richardson\start menu\programs\imvu\run imvu.lnk {d9288080-1baa-4bc4-9cf8-a92d743db949}
c:\program files\windows desktop search\msnlnamespacemgr.dll (Microsoft Corporation) {56F9679E-7826-4C84-81F3-532071A8BCC5}
GUID / CLSID not found {02478D38-C3F9-4efb-9B51-7695ECA05670}Crawler.com ) {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}
c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24}
deskpan.dll {42071714-76d4-11d1-8b24-00a0c9068ff3}Crawler.com ) {BD88A479-9623-4897-8546-BC62B9628F44}
c:\program files\common files\adobe\acrobat\activex\pdfshell.dll (Adobe Systems, Inc.) {F9DB5320-233E-11D1-9F84-707F02C10627}
C:\WINDOWS\system32\ebpmon24.dll (SEIKO EPSON CORPORATION)
CustomizeSearch HKLM : http://dnl.crawler.com/support/sa_customize.aspx?TbId=60327 http://www.crawler.com/search/ie.aspx?tb_id=60327 http://www.blueyonder.co.uk/
c:\windows\downlo~1\ewidoo~1.dll (Anti-Malware Development a.s.) {193C772A-87BE-4B19-A7BB-445B226FE9A1}AmericanGreetings.com ) {BD8667B7-38D8-4C77-B580-18C3E146372C}
c:\program files\virtools\3d life player\webplayer.ocx (Virtools SA) {D4323BF2-006A-4440-A2F5-27E3E7AB25F8}
c:\windows\system32\flashax\flashax.ocx (Microgaming Systems) {D8089245-3211-40F6-819B-9E5E92CD61A2}
&AOL Toolbar search : res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
{2265eb70-73f8-11db-a80d-00038a000015} : E:\LaunchU3.exe
c:\program files\alwil software\avast4\ashshell.dll (ALWIL Software) {472083B0-C522-11CF-8763-00608CC02F24}Crawler.com ) {BD88A479-9623-4897-8546-BC62B9628F44}
system
December 14, 2007, 10:01pm
20
hope i have copy the right thing
