This has many parts to it, so bear with me. I’m simply looking for the best way to resolve this issue permanently.
-
From time to time, avast! (Pro, version 5.0.677, up to date virus definitions) is popping up with a blocked connection warning. The Network Shield showed that from time to time my computer is trying to connect to a site that starts with 199.80.55.19/go.php?data= (after the =, it goes on for a while).
-
Also, svchost.exe seems to be infected. A recent (still on my screen) Application Error message said:
"The instruction at “0x7c923845” referenced memory at “0x00000000”. The memory could not be “read”.
“Click on OK to terminate the program”
“Click on CANCEL to debug the program” -
Directly after the previous error: “Generic Host Process for Win32 Services has encountered a problem and needs to close. We are sorry for the inconvenience”
According to the error signature:
szAppName: svchost.exe szAppVer: 5.1.2600.5512 szModName: ntdll.dll
szModVer: 5.1.2600.5755 offset: 00023845 -
My desktop BSoD’d twice in a row during startup, while the desktop was loading. I don’t remember how to access the information stored during a BSoD.
-
During two consecutive scans with MBAM, malware has come up.
On the first run:
Trojan.Agent file at C:\WINDOWS\system32\certstore.dat
Password.Stealer registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components{cb92d056-5802-4d2e-a0fe-59e3f5ef3598}
Password.Stealer registry at HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components{cb92d056-5802-4d2e-a0fe-59e3f5ef3598}
During the second run of MBAM one Trojan.Agent and one Password.Stealer came up.
I’m hoping that removing certstore.dat won’t damage my computer.
Running Windows XP, updated avast! Pro and MBAM.
I don’t know where the viruses came from, and if anything else comes up I’ll post here.
Edited on 11/06/10 to add details to the infected registry entries.
