For now schedule a boot time scan. Send anything avast find to the chest, don’t delete! Report back what you have found. File names and paths, and what avast detected them as.
If you have already deleted these files, and they have returned, then turn off system restore before the boot time scan.
Install it in it’s own folder on c:\ Run the scan and save the report. don’t fix anything. Post the report here. You may have to break it down into a couple of post due to it’s size.
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
C:\Documents and Settings\Admin\Local Settings\Temp\Ngsys.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\rvshost.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\runer.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\userint.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\windxp.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\winzipt.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\system31.exe is infected with W32.SillyDC
C:\Documents and Settings\Admin\Local Settings\Temp\Vel.exe is infected with W32.SillyDC
C:\WINDOWS\system32\Restoration.msd is infected with W32.SillyDC
AND ITS INFECTING ALL WINDOW FILES!!!
Why does Avast! can’t detect the worm W32.SillyDC???..
Once executed, the worm create a copy of itself in the %Windir% or %System% folder.
The worm then modifies the registry so that it is executed every time Windows starts. In most cases, the worm uses one or more of the common loading points to make sure that it runs when you start Windows. For information about common loading points, read one of these documents:
Is this a bug!???
Please… make some move… Need more VPS update…
Can avast! detect worm / spyware ?? or only Trojans and viruses??
Thank’s avast!.
Hoping for response… :-\ :-\ :-\
[I’m not in hurry, ;D ;D it is just my expression] ;D ;D ;D Long live! Avast!
Can you send the samples to virus@avast.com ?
You can zip and password the files… Inform a link to this thread and the password used.
You can send the files to Chest and, from there, resend to Alwil for analysis.
Thanks for helping improving detection.
@ Virus analyst team: what about hurry up? ???
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
send the infected files from your temp directory to virus[at]avast[dot]com… i guess it’s a new variant of old polymorphic SillyWR… i need your samples to make some reliable detection… it will be added to some of the next virus databases
