system
August 24, 2008, 2:12am
1
Hi, I’m a newbie here.
A few days ago I got warnings that Avast had detected to viruses (VBS:Malware-gen and Win32:Trojan-gen {Other}). I followed the advice an removed them both to the chest. Now, however, whenever I log in and my computer starts up there are always 2 or 3 viruses detected (all of which I move ot the chest as directed) - so far the list is at VBS:Malware-gen, Win32:Trojan-gen {Other} and Win32:Rootkit-gen [Rtk] which just appear over and over again. I have tried the Avast virus cleaner as well as scanning all files and running a boot time scan, all to no avail.
Aside from slowing my computer and replacing my desktop image with a blue screen, no other functions seem to be impaired (yet) but I’d love to get it sorted out.
Any help would be much appreciated. Thanks!
system
August 24, 2008, 2:21am
2
What’s your operating system?
I suggest you download HiJackThis
system
August 24, 2008, 2:30am
3
Do what Jaytaylor says
have you tried a boot time scan with Avast? rt click the ball and update program
please run a MAlware bytes anti malware and ALSO Rogue Remove Scans
Can you get to “virus total” and upload the files in the Chest (not the system backup files- leave those ALONE)
system
August 24, 2008, 8:30am
4
Thanks for such speedy responses!
My operating system is Windows XP and I have tried running a boot time scan but it picks up nothing.
The log file from HJT is this:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
August 24, 2008, 8:31am
5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com.au/ig/dell?hl=en&client=dell-row&channel=auhttp://www1.ap.dell.com/content/default.aspx?c=au&l=en&s=gen http://www1.ap.dell.com/content/default.aspx?c=au&l=en&s=gen http://au.mcafee.com/root/redirects/support.asp?affid=105-68 Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllhttp://www.mugglenet.com/countdown/desktop-dhootp.html
–
Thanks again for the help.
system
August 24, 2008, 8:49am
6
First of all, your Java is out of date. Please uninstall the old version and install the latest here
C:\WINDOWS\system32\lphcntmj0e145.exe
Second, upload this file above to VirusTotal
I also need to see the avast! warning text.
system
August 24, 2008, 9:40am
7
Ceywood, as your Sun Java is way down level there could be other severely vulnerable versions of Sun Java on your system.
Go to Add/Remove Programs and un-install all versions of Sun Java.
Download then run JavaRa then run it to insure that the remnants are gone:http://raproducts.org
Download MBAM then run it and do an Update to get its latest definitions then run a Quick scan and post its results here:http://www.malwarebytes.org/mbam.php
Then run Secunia: Online Software Inspector to find out what other applications are installed that have vulnerabilities:http://secunia.com/software_inspector
You will find that you need to download and install Windows Service Pack 3.
system
August 25, 2008, 2:56am
8
Thanks you two.
I’ve removed all out of date Java and am currently installing the latest version.
Jtaylor 83 the results of uploading that file to VirusTotal are as follows:
File lphcv24j0e184.exe.vir received on 08.24.2008 16:51:43 (CET)
Did you need the Additional Info as well?
system
August 25, 2008, 2:58am
9
The Avast warnings logfile -
8/20/2008 11:23:24 PM 1219240404 SYSTEM 1796 Sign of “VBS:Malware-gen” has been found in “C:\Documents and Settings\Ceywood\Local Settings\Temp.tt80.tmp.vbs” file.
I’ll post the other info when I’ve downloaded and run your suggestions YoKenny.
Hello Ceywood
In the meantime can you please EmailVirus@avast.com in a pasword protected Zip file
-Justin
system
August 25, 2008, 5:53am
11
MBAM log:
Malwarebytes’ Anti-Malware 1.25
3:05:17 PM 8/25/2008
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 1
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
system
August 25, 2008, 4:19pm
12
Looks like a disk cleanup is needed.
I suggest:
ATF-Cleaner CCleaner
I also prefer SuperAntiSpyware Free Version
system
August 25, 2008, 7:35pm
13
re run the Malware bytes program and click
then as suggested download, update and run superantispyware
keep both around as on demand scanners
post up a new HJT
keep this YoKenny suggestion on your “to do” list when the malware is gonehttp://secunia.com/software_inspector ”
question
system
August 26, 2008, 1:17pm
14
Ran Malware bytes again, log below:
Malwarebytes’ Anti-Malware 1.25
10:36:40 PM 8/26/2008
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 1
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Currently running SUPERAntiSpyware scan…
AND no more viruses have been detected in the meantime!!! THANK YOU ALL!!
system
August 26, 2008, 1:44pm
15
Nope, spoke too soon - this warning just came up:
8/26/2008 10:57:37 PM 1219757257 SYSTEM 1840 Sign of “Win32:Rootkit-gen [Rtk]” has been found in “C:\SYSTEM VOLUME INFORMATION_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP191\A0050520.EXE” file.
Now the SUPERAntiSpyware log:
SUPERAntiSpyware Scan Loghttp://www.superantispyware.com
Generated 08/26/2008 at 11:08 PM
Application Version : 4.20.1046
Core Rules Database Version : 3548
Scan type : Complete Scan
Memory items scanned : 633
Adware.Tracking Cookiead.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]ad.yieldmanager.com [ C:\Documents and Settings\Ceywood\Application Data\Mozilla\Firefox\Profiles\3709tul1.default\cookies.txt ]
system
August 26, 2008, 1:54pm
17
Finally, ran HJT again:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
August 26, 2008, 1:55pm
18
Cont.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com.au/ig/dell?hl=en&client=dell-row&channel=auhttp://www1.ap.dell.com/content/default.aspx?c=au&l=en&s=gen http://www1.ap.dell.com/content/default.aspx?c=au&l=en&s=gen http://au.mcafee.com/root/redirects/support.asp?affid=105-68 Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllhttp://www.mugglenet.com/countdown/desktop-dhootp.html
–