system
March 6, 2009, 6:27am
1
Hey guys I am after some help with dealing with a problem Im having. This problem comes under the name of ‘x.exe’ and is found in the directory C:\windows\system32\x.exe , I would get this detected by avast about every 10 to 15 minutes or so, always send it to chest and 10 or so mins later its back… :S Ive tried doing a full avast scan several times with no luck, tried spybot scan, adaware, and have also just finished reformatting my hard drive for the 2nd time and thought I had finally cleared it because nothing happened for about a day or two then it was back
I believe it is a similar thing to this post I found http://forum.avast.com/index.php?topic=40551.0 except the problem I am having has only been ‘x.exe’ (so far) none of the others…http://forum.avast.com/index.php?topic=40611.0
Any help would be greatly appreciated because I have no idea what to do next !
Does the general cleaning procedure help?
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
Use SUPERantispyware , MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
Test your machine with anti-rootkit applications . I suggest avast! antirootkit or Trend Micro RootkitBuster .
Make a HijackThis log to post here or this analysis site . Or even submit the RunScanner log to to on-line analysis.
Disable System Restore and then reenable it again.
Immunize your system with SpywareBlaster .
Check if you have insecure applications with Secunia Software Inspector .
system
March 21, 2009, 11:58pm
3
Hi sorry about late reply been away. Ok tried everything you listed still no luck. It seems the occurance of x.exe getting detected by avast has slowed down a bit but its still definately there.
system
March 21, 2009, 11:59pm
4
Hijack This Log
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
Hi grizz,
You have no active firewall running there apparently, this is endangering your online activities.
For successful remove of MPCSTAR.EXE , following the instruction:
Temporarily Disable System Restore .
Update the virus definitions. Reboot computer in SafeMode, delete the infected files according the detail above, run a whole scan, or use the free DrCureIt from here: http://www.freedrweb.com/download+cureit/
3.Please download ATF Cleaner from here: http://www.atribune.org/ccount/click.php?id=1
That is all,
polonus
system
March 23, 2009, 3:40am
6
Hi, no MPCstar is my video player i had it open at the time I did the log…
system
March 23, 2009, 6:19am
7
Please run HJT again without any programs running other than what is running at normal start-up. Also be sure no windows are open. In other words, do nothing after start-up other than run HJT.
system
March 23, 2009, 8:25am
8
Post a complete HijackThis log starting at the top.
system
March 23, 2009, 9:42am
9
Yes, that too. Thanks, Yokenny.
system
March 24, 2009, 7:24am
10
sorry my mistake.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
system
March 24, 2009, 7:26am
11
restarted my computer and did HJT scan.
system
March 24, 2009, 7:52am
12
File name: C:\WINDOWS\system32\x.exe
(from avast when x.exe detected)
system
March 25, 2009, 3:45am
13
An analysis of your HJT log shows the following :
We didn’t detect any active process of a firewall on your system. Reasons maybe:
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) http://www.systemlookup.com/CLSID/54865-wlchtc_dll.html
O17 - HKLM\System\CCS\Services\Tcpip..{D619F1A7-5293-48DE-9D6E-C6CBFE144489}: NameServer = 202.27.158.40,202.27.156.72
O23 - Service: Windows Telephony (WindowsTelephony) - Unknown owner - C:\WINDOWS\system\svhost.exe
http://www.auditmypc.com/process/svhost.asp
http://www.threatexpert.com/files/svhost.exe.html
http://www.prevx.com/filenames/1454723166925220265-X1/SVHOST.EXE.html
system
March 25, 2009, 5:56am
14
I dont use any firewall at all :S just use avast. What can you recommend?
Am i meant to fix the svchost.exe with HJT? Cause did the fix option and doing more scans it shows it still there… :S
/edit - pretty much as soon as i read what you said about svchost.exe avast detected it, hows that for weird haha , quarantine it?
system
March 25, 2009, 6:15am
15
http://img.photobucket.com/albums/v644/mmmsure/untitled-1.jpg
installed the scanner you linked to, it found a few problems but hve to pay to clean them D:
system
March 25, 2009, 6:31am
16
grizz, notice the spelling of svhost.exe as this is a method of malware writers to confuse users as svc host.exe is a needed Windows service that does several things and I notice that you have HijackThis on your Desktop which is not a good place for it.
When you download HijackThis then run its installation application it creates a Folder where it should remain as that is where it stores its Log files to not clutter up the Desktop with its Log files.
Un-install the old HijackThis in Add/Remove Programs and download a fresh copy and install it correctly and run it from the Shortcut created on the Desktop:http://download.cnet.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
End all browsers then run HijackThis then select the following then select Fix checked :
Then reboot.
I recommend downloading Malwarebytes MBAM which is Free then install it then run it and update it with its built in Update function then run a Quick scan and have it remove all that it finds and a reboot may be required to remove locked files:http://www.malwarebytes.org/mbam.php
I find that Windows firewall is adequate as I am behind a hardware firewall and I monitor what is running on my system carefully with Windows Defender and WinPatrol.
system
March 26, 2009, 3:46am
17
Turned windows firewall back on
Reinstalled HJT and did a scan to find the svhost (sorry bout wrong spelling before:P) wasnt there…
Scanned with MBAM and cleaned infected files. Didnt detect svhost but detected a few other backdoor.bot things. Will update on how everything looks a bit later
I am out of things to do, tried searching google for help with it but cant really find any information.
thanks.