new virus

system · 2007-10-27T20:10:01.000Z

Help! I am infected with a virus that Avast said is in c:\windows\system32\drivers\mfl,sys. It said that it is a windows Trojan32 (other). I followed the instructions and deleted as well as moved it to the chest after the second time but it keeps coming back. I have system restore off as well as cleaned all my temporary files as well as my cached files. It keeps coming back and I am lost

Thanks

essexboy · 2007-10-27T20:14:46.000Z

Sounds like it is being re-installed

Download ComboFix from Here or Here to your Desktop.

[*]Double click combofix.exe and follow the prompts.
[*]When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix’s window while its running. That may cause it to stall

system · 2007-10-29T03:42:40.000Z

Combofix log

system · 2007-10-29T03:43:23.000Z

HiJackthis log

essexboy · 2007-10-29T20:26:30.000Z

Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

[b]C:\Documents and Settings\KEVI N\Start Menu\Programs\Startup\DESKTOP.INI
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DESKTOP.INI
C:\WINDOWS\SYSTEM32\DRIVERS\mfl.sys

[/b]

Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

The .sys file has the characteristics of a rootkit … if this does not remove it I will use a stronger tool

So on completion if you could do the following

Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Under Additional Scans click the checkboxes in front of the following items to select them:

Reg - BotCheck
Reg - ControlSets
Reg - Security Settings

[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.

Announcements