system
March 24, 2009, 4:34pm
1
virus total scan of ispiqq.dll
http://www.virustotal.com/analisis/d068e3d6cb4420db08ed55b5d2bb7c47
Two Days Ago I Went on msn and messenger discovery loaded a popup page like it normally does… which is normally blank
but now its causing Function setifaceupdatepackages() has failed return code is 0xc0000005, DWres is c0000005
so anyway i just ignored this thinking it might have been a network issue…until i was playing a game on my Pc and end tasked it too shut my pc down when this popped up
ispiqq.dll Trojan-gen {other} was detected in d:\windows\system32
heres my hijack this log
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ @D :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe@D :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exehttp://go.microsoft.com/fwlink/?linkid=39204 http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1199300685734
–
system
March 24, 2009, 4:40pm
2
just to add i just noticed this
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\oembios.exe,
What does SAS say when you run a scan? Does it find anything?
DavidR
March 24, 2009, 8:26pm
4
Two things:
SP3 for XP has been out for about nine months and that allows IE6 to be updated to IE6 SP3 also.
Your JAVA is way out of date and as such vulnerable to exploit.
Then get the latest update from here http://java.sun.com/javase/downloads/index.jsp
Or JRE version 6 update 12 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html
Showing this form for having out of date applications ;Dhttp://secunia.com/software_inspector/ .
That F2 HJT entry is suspect and a google search shows it to be so, http://www.google.com/search?q=oembios.exe . Also see, http://www.threatexpert.com/files/oembios.exe.html .
Check the suspect file/s at: VirusTotal - Multi engine on-line virus scanner
Send the sample to virus@avast.com
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that .
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
system
March 24, 2009, 9:12pm
5
how do i scan the ispiqq.dll using virus total if its in my Infected files part of the chest
also i deleted oembios.exe using avasts delete option…before i posted this hi-jack this log
yet superantispywares Tea Timer still gives me the option to deny/allow its registry change to userinit
inside my system32 i noticed oemdspif.dll which is an ati driver interface dll
oembios.bin oembios.dat and oembios.sig
DavidR
March 24, 2009, 11:02pm
6
If avast was already detecting them n(you didn’t mention that) then there is little point in uploading them.
Follow these instructions:Standard Shield, Customize, Advanced, Add , type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder.
You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.
These associated oembios files would obviously need to be removed oembios.bin oembios.dat and oembios.sig, but the oemdspif.dll doesn’t appear to be associated.
system
March 25, 2009, 4:01pm
7
is extract what you mean by export? just dont wanna be clicking the wrong thing here
Yes, extract is what he meant.
system
March 25, 2009, 4:11pm
9
ok done… under it it says its an lsp dynamic link library version 1.0.0.1… which means it Executes a Process
ill post its virustotal under here when its done
ok… seems somethings up with it
http://www.virustotal.com/analisis/d068e3d6cb4420db08ed55b5d2bb7c47
Did you upload it to virustotal.com as DavidR has suggested?
system
March 25, 2009, 4:20pm
11
yep its just above your post
DavidR
March 25, 2009, 4:54pm
12
Well the results are pretty conclusive it is infected with 22 of 40 scanners finding it infected.
And avast should remove it, because it identifies it as a virus as well.
system
March 25, 2009, 5:26pm
14
so ill just delete it out the chest then?
DavidR
March 25, 2009, 5:31pm
15
Yes, normally I would suggest you leave any infected file in the chest foe a few weeks before scanning it again within the chest and if still detected then delete, but this one is pretty conclusive.
system
March 25, 2009, 5:36pm
16
ok there we go…deleted out of chest and then deleted the one in suspect to the recycle bin then its virus alert came up and i deleted it out of the recycle bin… so all is well
Thanks For The Help…knowing me i would have just clicked restore…
also how can i go about removing this registry entry i mentioned
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\WINDOWS\system32\oembios.exe,
i deleted oembios.exe with avast… but that entry still is in my hi-jack this
DavidR
March 25, 2009, 7:13pm
17
You fix it in HJT
If the file is gone the registry entry (which is what HJT shows) is redundant so couldn’t download anything, but you should still remove it using HJT.
Run HJT again (close any other windows except HJT), tick the box to the left of the suspect entry you wish to fix, click the Fix Selected Button.
system
March 25, 2009, 7:26pm
18
thanks that did it
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ @D :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe@D :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exehttp://go.microsoft.com/fwlink/?linkid=39204 http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1199300685734
–
system
March 25, 2009, 7:28pm
19
i just looking fast at it i think its look good ask another guy i just looked fast like that
DavidR
March 25, 2009, 7:38pm
20
That looks much better nothing obvious.
