system
October 4, 2007, 10:45am
1
Hi,
After doing several Avast scans, I can’t seem to get rid of this alert.
Avast finds a file called pdher.sys. The type is listed as Win32:Trojan-gen. {Other} and is removed to the Avast Chest per the recommendation by the program.
But when I reboot, it’s back again. I can’t seem to find anything about that file on Google, either.
I also tried A-Squared, Panda Online Scan, Ad-Adaware and SpyBlaster. Nothing seems to get this thing off my computer.
The only thing I remember doing before this happened was downloading GetFoxie because someone told me it was so great. The virus alert from Avast went off as soon as I attempted to run the program. I did not continue but vaulted it as per the recommendation.
I have also included my Hijackthis file below. Any assistance would be greatly appreciated!
Thanks!
system
October 4, 2007, 10:45am
2
Logfile of HijackThis v1.99.1
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.drweb.com/online/drweb-online-en.html @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
system
October 4, 2007, 10:47am
3
O11 - Options group: [INTERNATIONAL] International*http://www.sony.com/vaiopeople http://download.games.yahoo.com/games/clients/y/tt3_x.cab http://esupport.sony.com/VaioInfo.CAB http://www.creative.com/su/ocx/15026/CTSUEng.cab http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab http://go.microsoft.com/fwlink/?linkid=39204 http://inst.c-wss.com/n028p/EN/install/gtdownlr.cab http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab http://spaces.msn.com//PhotoUpload/MsnPUpld.cab http://www.systemrequirementslab.com/sysreqlab2.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126640696843 http://acs.pandasoftware.com/activescan/as5free/asinst.cab http://www.sonypictures.com/games/zuma/popcaploader_v10.cab http://driveragent.com/files/driveragent.cab http://www.creative.com/su/ocx/15029/CTPID.cab
can you tell us where the pdher.sys file was located?
system
October 4, 2007, 10:50am
5
Sure, it was in windows\system32\drivers.
Thanks again!
hmmm… it’s maybe a false positive, your HJT log looks clean… can you post here a log from www.virustotal.com ?
system
October 4, 2007, 11:14am
7
Here are the results but I forgot to mention that I also ran Sophos’ rootkit cleaner. That came up with nothing.
Antivirus Version Last Update Result
AhnLab-V3 2007.10.4.0 2007.10.04 Win-Trojan/Xema.variantRootkit.Agent.fi Rootkit.Win32.Agent.fi Rootkit.Win32.Agent.fi Rootkit.Win32.Agent.fi Rootkit.Win32.Agent.fi Rootkit.Agent.FI
Additional information
ooh, then it’s really a virus… ook… because it’s a driver (probably with some rootkit features), i should recommend that it would be good to scan your system with http://www.gmer.net/index.php and post a result here…
system
October 4, 2007, 11:51am
9
Sorry, that one took awhile. Here you go:
GMER 1.0.13.12551 - http://www.gmer.net
---- System - GMER 1.0.13 ----
SSDT ??\C:\WINDOWS\system32\drivers\procguard.sys ZwCreateFile
---- User code sections - GMER 1.0.13 ----
.text C:\Program Files\Internet Explorer\iexplore.exe[3324] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 42F0F2A1 C:\WINDOWS\system32\IEFRAME.dll
system
October 4, 2007, 11:54am
10
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [B6790812] aswMon2.SYS
system
October 4, 2007, 11:55am
11
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F75278E6] aswTdi.SYS
system
October 4, 2007, 11:55am
12
AttachedDevice \Driver\Tcpip \Device\RawIp IRP_MJ_CREATE_NAMED_PIPE [F75278E6] aswTdi.SYS
---- Files - GMER 1.0.13 ----
---- EOF - GMER 1.0.13 ----
system
October 4, 2007, 12:08pm
13
I should note that everytime I reboot the computer, Avast stops me from doing anything until I decide what to do with PDHER.SYS.
So I vaulted it before I ran that last test. Should I have let it go and then run that last test?
you can move the file to chest… try to reboot then and tell me, if everything is ok…
system
October 4, 2007, 12:16pm
15
That’s the problem. Everytime I reboot, even after having vaulted that file, it reappears again in the same directory, same file name with the same Avast virus alert. I then have to re-decide what to do with the file again.
It seems it’s copying itself back but I can find what is doing that.
oh, i see… maybe someone has the same problem and know a solution… wait until some other ppl validate your logs (i’ve maybe overlooked something)…
system
October 4, 2007, 12:39pm
17
Ok, and I’ll try running Avast again in Safe Mode after having turned off system restore this time and see if that makes a difference.
Thanks for all your help, Max!
polonus
October 4, 2007, 12:47pm
18
Hi Michelet,
Here is an example of a cleansing routine for aforementioned malware:http://forums.spybot.info/showthread.php?p=102798
polonus
not related to ‘cure’ your problem but you seems to use obsolete Java build, latest is 1.6.0_03
