I found this malware yesterday. It kills the Avira service, disable it effectively. Later I format my C partition and reinstall my operating system (Windows XP), and install Avast with latest update.
Avast sometimes detect it as rootkit, but in most cases Avast didn’t recognize it at all, even if I manually scan it and increasing the heuristic level into maximum.
It can place itself under system32 directory, and create a startup entry in HKEY_LOCAL_MACHINE, although I just using a limited user. It mark itself as “Intel Display Manager” in the startup entry (I currently have NO Intel device at all).
I’ve tried to boot on my Ubuntu Linux OS and delete it from there. It appears again right after windows startup, means there’s another one lurks inside my system.
I’ve checked my services and drivers entries using Serviwin, and found nothing suspicious. Please help, I don’t know how to remove it. I’ll send the EXE if needed.
To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( OTL.Txt and Extras.Txt. and Malwarebytes scan log)
Essexboy will be notified when you have posted the log`s
Follow the directions of obtaining an MBAM log (make sure you update MBAM first) and the OTL logs (save them as ANSI and not Unicode). When the OTL scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. Post the MBAM log here and the two (2) OTL log as an attachment (Additional Options > Attach > Browse (the logs will be on your desktop > Post).
Essexboy will review your logs and give you further instructions, however he comes on the forum late UK time. He will respond to you in this thread, so remember to check this thread daily.
My copy of Avast automatically updated its virus definition about an hours ago. It’s now able to detect and clean that malware. Thank you, that was so fast
But I’ll try MBAM in case of future infection. Once again, thanks.
Seems that the malware is polymorphic type. Avast clearly detect and clean the last infection. Minutes later, it appears again at same location with new name, igfxdxr32.exe. Yet Avast is now unable to detect it. I can copy and access the file without warning at all from Avast.
well looks as you have something more in there that make it come back
lets see if Malwarebytes is able to fix it ?
these rootkits is often difficult to remove and that is where Essexboy and his magic tools does wonderfull work. he can if you post the log`s see if everything is removed, if not he will fix it
