system
December 2, 2008, 8:51pm
1
I recieved numerous messages from Avast stating that I had trojans/viruses. I ran a scan and moved some to the chest as I was previously trying to delete and they just kept popping up. I know, I shouldn’t delete but I assumed that it would be ok since all of them were in my temporary internet folder with the exception of 1 being in my windows folder. I ran a boot scan as well.
Asidse from still having these on my computer, my computer is of course acting very strange. My screen keeps blinking every 10-20 seconds(where all my icons disappear and then reappear) making it difficult for me to search for anything on my computer. Also anywindows that had pictures in them are now gone and replaced with a red, green and blue icon. I am currently running the virus cleanerand here was the results:
avast! Virus Cleaner Tool - version 1.0.211 Unicode
Creating log file: C:\Documents and Settings\marcie\Local Settings\Temporary Internet Files\Content.IE5\L5JG3GR0\aswclnr[1].log
.
The boot scan listed that I had a win32lighty-H (cryp) and a win32rootkit-gen in my temp internet files. I would send you a copy of what I have in my chest but I can not copy and paste unless there is another way. Those files are listed as:Tiny-II, agent-hyd,rootkit-gen, agent agkb,trojen-gen, and a dialer 567.
I currently run a windows xp with service pack 2. My avast is updated but I have noticed that everyday more than once or everytime I restart my computer that avast is always trying to download/update which I don’t recall this being so frequent before.
Any help and instruction is greatly appreciated.
system
December 2, 2008, 9:26pm
2
here is the result from hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exehttp://ax.emsisoft.com/asquared.cab http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
–
The avast! Virus Cleaner Tool is a very limited version of avast installed on PC. So, I suggest:
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use SUPERantispyware , MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Test your machine with anti-rootkit applications . I suggest avast! antirootkit or Trend Micro RootkitBuster .
Make a HijackThis log to post here or this analysis site . Or even submit the RunScanner log to to on-line analysis.
Disable System Restore and then reenable it again.
Immunize your system with SpywareBlaster .
Check if you have insecure applications with Secunia Software Inspector .
system
December 4, 2008, 2:44am
4
So here is what I did so far: I have installed and ran Spyware Terminator. I have attempted to quarruntine the threats with the excepts of a few that wouldn’t move.
I have also installed and ran an antiroot program which returned no results. I have ran Avast in a boot scan also scanning archive files. Some files I could put in the chest, a few others, I had to ingnore because no other action could be performed ie 1-delete, 5-move to chest, 9-ignore etc. I have also cleared my temp internet files and disabled my system restore.
I was hoping after doing a few scans that it would solve the situation. I am still having trouble opening/finding anything in the start menu or just off of my desk top as my screen keeps disapearring and then reappears every 10-20 seconds. Can I not just delete these files instead of quarranting them? What else can I do?
Here is the Hijack this report, I’m not sure if anything had changed:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exehttp://ax.emsisoft.com/asquared.cab http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
system
December 4, 2008, 3:14am
5
This one’s a nasty.
O4 - HKLM..\Run: [{6B-B7-7D-D4-DW}] c:\windows\system32\dwwnw64r.exe DWmmm01
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\dwwnw64r.exe
http://spywarefiles.prevx.com/RRIHHI44937542/DWWNW64R.EXE.html
Try MBAM or SAS.
And Fix these lines
O15 - Trusted Zone: *.amaena.com O15 - Trusted Zone: *.antimalwareguard.com O15 - Trusted Zone: *.antispyexpert.com O15 - Trusted Zone: *.avsystemcare.com O15 - Trusted Zone: *.gomyhit.com O15 - Trusted Zone: *.imageservr.com O15 - Trusted Zone: *.imagesrvr.com O15 - Trusted Zone: *.onerateld.com O15 - Trusted Zone: *.safetydownload.com O15 - Trusted Zone: *.spyguardpro.com O15 - Trusted Zone: *.storageguardsoft.com O15 - Trusted Zone: *.trustedantivirus.com O15 - Trusted Zone: *.virusremover2008.com O15 - Trusted Zone: *.virusschlacht.com O15 - Trusted Zone: *.amaena.com (HKLM) O15 - Trusted Zone: *.antimalwareguard.com (HKLM) O15 - Trusted Zone: *.antispyexpert.com (HKLM) O15 - Trusted Zone: *.avsystemcare.com (HKLM) O15 - Trusted Zone: *.gomyhit.com (HKLM) O15 - Trusted Zone: *.imagesrvr.com (HKLM) O15 - Trusted Zone: *.onerateld.com (HKLM) O15 - Trusted Zone: *.safetydownload.com (HKLM) O15 - Trusted Zone: *.spyguardpro.com (HKLM) O15 - Trusted Zone: *.storageguardsoft.com (HKLM) O15 - Trusted Zone: *.trustedantivirus.com (HKLM) O15 - Trusted Zone: *.virusremover2008.com (HKLM) O15 - Trusted Zone: *.virusschlacht.com (HKLM)
system
December 4, 2008, 3:33am
6
Ummm…how do I fix the trusted zones? Is it a matter of going into my internet zone or something a bit more complicated? I have never seen thoses files until I got this virus/trojan.
Thank you
Also with this:
O4 - HKLM..\Run: [{6B-B7-7D-D4-DW}] c:\windows\system32\dwwnw64r.exe DWmmm01
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\dwwnw64r.exe
http://spywarefiles.prevx.com/RRIHHI44937542/DWWNW64R.EXE.html
Try MBAM or SAS.
I assume that MBAM should take care of it?. Do I want to quarrantine all files that show up in MBAM or am I ok to delete? It sounds nasty and I really want to make sure that it goes away!
system
December 4, 2008, 8:13am
7
What Jtaylor means is that you run HJT again, check the boxes left of the entries he indicates above, and then click the Fix button at the bottom.
system
December 4, 2008, 3:56pm
8
Ok…so the MBAM work wonderfully!.. My computer is no longer blinking and I can so far open programs in my start menu However…my internet is still missing alot of content. I have ran HJT and deleted the trusted zone files(thanks for the clairfication CharleyO) If anything has pictures on my internet, they are all missing and replaced with a blank spot the has a red square, green circle and a blue triangle. Any ideas on how to get this back? Here is the most recent report of HJT:
(PS…thanks for all of your help so far!!!)
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exehttp://ax.emsisoft.com/asquared.cab http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
–
system
December 4, 2008, 5:29pm
9
Ok…I got it…lol. I found out why I had no pictures in intenet explorer. I had to go into the internet properties and clicked on the advanced tab. Under the mulitmedia section, there is a box that says ‘show pictures’ which was unchecked.
system
December 5, 2008, 5:56am
10
Okay, now that you’re clean. You need to update your Java by uninstalling the old version and install the latest here .