My son has a laptop and reported a Trojan attack. Apparently he made the mistake of authorising download of a codec required by a video on UTube. Sigh.
Having travelled to his home I ran Avast which reported W32-Agent-LTS [trj] with the name syscore.dll. Avast duly transferred this to its chest, and I ran a complete check. Another three files were discovered and moved to the chest. All such files were then deleted and after several cold and warm reboots everything seemed clear.
Three hours later the Trojan returned. Unfortunately I was then travelling back – hence no HiJack report yet available. Any thoughts?
The laptop is running Windows Pro SP2 on a Cereron 1.8 GHz 512 RAM. On my recommendation he has been running Avast Home Edition v4.7 – which is why I reported this incident to this forum. I now have the laptop (with a ruined parental reputation), and am again running an Avast check after which I intend to run Ewido and SuperAntiSpyware. Question: can I safely copy a copy of HiJack log from his laptop to mine on floppy for printing? Is a text file reasonably safe, and could the floppy be used as a backgroung conduit to mine?
Usually a text file is not infected but exe, dll or scr executable files are the targets so viewing the HijackThis log should be safe but that assumes that your anti virus and anti trojan resident detectors are up to date.
The recommended scanners are good and I can also recommend a-squared that has both a Free and a Fee version and I use the Free version: http://www.emsisoft.com/en/software/free
Post the HijackThis log and I’m sure you will receive expert advice here.
Any computers connected could be vulnerable because depending on the malware some can travel over a network in the same way as you can navigate it. Using a floppy, USB drive or CD is generally safer so long as you don’t allow autorun and scan the floppy or CD before opening anything.
The text file is relatively safe as it isn’t executable, but there are some viruses that try to spread through removable media, so it isn’t the hijack.log file that is likely to be the problem. So avoid using autorun as that can launch other stuff on the removable media or USB drive.
A little trick (to avoid autorun) with floppies or CD, keep the Shift key depressed whilst the drive light is on when you load the floppy/CD. Once the drive light is off and no drive activity you can scan it with avast.
You can paste the contents of the HJT log here (you may need two or more posts to cut and paste it) and we will have a look at it. First run the other tools though as it may reduce the size of the problem and contents of the HJT log.
Apologies for what could become a major event, and the experience is leaving me somewhat jaundiced with all anti-virus programs. Consider progress to date:
On bootup (no available Internet connection), no apparent spyware reported.
Executed Avast computer check (thorough).
2 files identified, moved to chest, and deleted.
File Name c:\windows\memory.dmp
Malware Name W32-VB-EIJ [trj]
Recommended action was move to chest but disk capacity reported as insufficient, file deleted.
Summary of check, two files successfully deleted:
memory.dmp and msmdev.dll
Avast uninstalled.
Reboot
Installed and executed scan by Ewido v4.0
15 tracking cookies identified and deleted.
Repeat run, nothing found.
Ewido uninstalled.
Reboot
AdAware 2007 executed.
4 items identified and deleted.
Root: HKU Path: S-1-5-21-3757435101-3238835185-2771580065-500\software \microsoft\ windows\currentversion\policies\system value: disableregistrytools Data: , Belonging to windows
MRU: Path: c:\Documents and Settings\Admin…
MRU: Reg Key: S-1-5-21-3757435101-3238 ……
MRU: Reg Key: S-1-5-21-3757435101-3238 …… [apparent duplicate]
Reboot, repeat run.
1 item identified and deleted
Root: HKU Path: S-1-5-21-3757435101-3238835185-2771580065-500\software\microsoft\ windows\currentversion\policies\system value: disableregistrytools data: , belonging to windows
Reboot, repeat run.
2 items identified and deleted.
Root: HKU Path: S-1-5-21-3757435101-3238835185-2771580065-500\software\microsoft\ windows\currentversion\policies\system value: disableregistrytools data: , belonging to windows
MRU: Path: c:\Documents and Settings\Administ…
Whilst able to identify, AdAware unable to completely clean infection.
Reboot
Installed and executed scan by SuperAntiSpyware Ewido v3.9
44 tracking cookies identified and deleted. [!!]
9 Infected files identified in Internet Explorer cache, deleted.
Reboot, empty Internet cache, repeat run, nothing found.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:25:32, on 29/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Avast and Ewido were uninstalled because my original intention had been to work through each of about five programs. Avast (the ‘home’ program) was installed when I ran Ewido, but after Ewido had completed it run the computer froze. With much difficulty the laptop was switch off, but I considered that there may be possible conflicts so for subsequent testing each software program was uninstalled after use. The computer is now back to Avast, awaiting diagnosis of the HiJack log. My reliance in these programs is shaken – why would they produce such varied results? My fear is that the dreaded rootkit may be with me …
Due to a lot of factors: different malware database, different detection methods, deepness of the scanning, different features and purposes of each program… not a software is perfect or complete.
Repair (clean) is most of the times more difficult than to detect.
AVG antivirus and (taking care) a-squared have better cleaning methods.
SuperAntispyware is good on cleaning.
If AdAware 2007 finds a trojan, what is its file name and location, e.g. (C:\windows\system32\infected-file-name.xxx) ?
There are often reasons why it can be dealt with, file in use, protected, etc. but you should most certainly confirm it is a good detection first (which may be why others didn’t detect it).
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive.
I’ve tried the programs that I had to hand. Unfortunately, until the HiJack file is cleaned I’m loath to return it for wireless internet connection. I am broadband. I’ve had enough for today after seven hours, tomorrow I’ll try A-Squared and others.