system
October 22, 2007, 9:30am
1
Lets start by saying that I have already read the thread http://forum.avast.com/index.php?topic=29944.0 about this virus.
Jotti scan
File: rcScreen2[1].htm
Scanner results
Coming next…Hijack this…
system
October 22, 2007, 9:31am
2
Hijack This Log
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zeus/klweb/default.asp http://zeus – Script we use to set up MS Outlook profile. http://zeus – Our Companies Home page. xqehkl.nhs.uk xqehkl.nhs.uk xqehkl.nhs.uk – Client of a utility we have written ourselves. – Client of a utility we have written ourselves .www.ppandora.com - Unknown owner - C:\WINDOWS\System32\nsvc32.exe (file missing) – Old virus, service is disabled –
system
October 22, 2007, 9:32am
3
Now initially this virus was picked up on another PC, here’s it’s Hijack this log for comparisson.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://zeus/klweb/default.asp http://zeus http://zeus http://support.euro.dell.com/systemprofiler/SysPro.CAB http://go.microsoft.com/fwlink/?linkid=67633 http://go.microsoft.com/fwlink/?linkid=39204 http://go.microsoft.com/fwlink/?LinkId=82580 http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab https://www-307.ibm.com/pc/support/access/aslibmain/content/AcpIR.cab http://test.catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1179259659555 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1189421776727 http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189421721336 http://www-307.ibm.com/pc/support/IbmEgath.cab http://www.crucial.com/controls/cpcScanner.cab http://www.driveragent.com/files/driveragent.cab xqehkl.nhs.uk xqehkl.nhs.uk xqehkl.nhs.uk xqehkl.nhs.uk
–
system
October 22, 2007, 9:35am
4
Now the interesting thing about it is that the initial detection was in a temp file within the directory C:\Windows\TEMP_avast4_ on both machines.
After a full cleansing using a BART CD, more files show up the next day.
system
October 31, 2007, 8:39am
7
I’m starting to get a little nervous about this as it seems to be slowly spreading.
AhnLab-V3 2007.10.31.1 2007.10.31 -
It seems to only infect HTML files, I understand Fujacks is a variant of Nimaya; not that that helps an awful lot.
I need to get on top of this, but I feel I may be losing control of the situation.
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP . System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
It will be good if you download, install, update and run AVG Antispyware . Some users recommend SUPERantispyware , Spyware Terminator and/or a-squared (take care about false positives).
If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications . I suggest AVG or Trend Micro RootkitBuster (for XP/Vista). For XP: Panda (for XP).
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.
If you do run SAS,
First update SAS Then
Under Configuration and Preferences, click the Preferences button.
Under Scanner Options make sure the following are checked
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quaranine.
leave the others unchecked.
Return to the main page by clicking close on that screen. On the main screen, under Scan for Harmful Software click Scan your computer. On the left check C:\Fixed Drive.(and other fixed drives)
When the scan is done, quaretine everthing found . Reboot if asked. You can post the log in your next reply if you wish.
system
October 31, 2007, 2:28pm
10
I don’t know if you missed it, but I actually posted a Hijack this log.
system
November 7, 2007, 8:45am
11
Well it appears that the latest VPS has eliminated this threat.