So this morning I wake up and check my email as usual, after finishing my work later the same day, when I open the IE avast tells me that it has found a trojan with original file name: wkgszvx.exe, in system32. I do as avast suggested and move it to the chest. The problem is that after moving this file to the chest my IE won’t open, I get a pop up that internetexplorer.exe cannot be found. Though I go to C:/program files/internet explorer/ and see that the exe is actually there, even when I click it from inside the file it says that it cannot be found.
So what can I do to fix my IE? I tried reinstalling it but I get the same thing again (exe cannot be found).
Some extra info about the virus: Virus description: Win32:Small-MMH [trj]
Also I don’t know if it matters, but the last modification time of the file was like 2 months ago, I had done some virus scans between today and that time but there was no virus found.
Forgot to tell that between the 2 times that I opened IE the computer was online but no one was using it, so the only thing that could have changed was avast with an update.
I am using Windows XP SP3 home edition and IE7.
Thanks for your time, hopefully you can help me out.
It looks like your file association/shortcut to iexplore.exe have been
Upload internetexplorer.exe to VirusTotal - Multi engine on-line virus scanner and report the findings of these files here. If any are detected by multiple scanners send example to avast, see below.
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
Program & Tutorial - Also useful as a diagnostic tool - FileHippo Download - HiJackThis and post the contents of the HJT log file here. - HJT Information HiJackThis Tutorial.
Download and run HJT and post the contents of the log file (cut and paste or attach the log file) into this topic, you may need to split it over two or more posts depending on how large it is.
Yes i made a mistake iexplorer.exe is the executable that cannot be found, even though it is there when I open the internet explorer file.
Basically my problem is that the file from system32 that I moved to the chest is needed for the IE to run, and because it is in the chest I cannot use it.
I have already sent the file to Alwil Software by right while it was at the infected files section, not user files.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:13:03 μμ, on 6/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Yes if avast had detected it it would be iun the Infected Files section and as such it didn’t really need to go to avast since it is already able to detect it. I was talking about the internetexplorer.exe you mentioned, which you say was an error.
Fix (close browser windows, run HJT again, tick the box to the left of the entry and click the Fix selected button):
[b]First find the file and upload it to virustotal for scanning, add it to the user files section of the chest, send it to Alwil.
[/b]O2 - BHO: D - {07960106-BF5F-3CF5-AFE0-375A999947C0} - C:\WINDOWS\system32\xel50531.dll
Zero hits for this file name on a google search and for something in the system32 folder that is suspicious.
Other than that I don’t see anything obvious, though the log is relatively small, something could be hiding from hijackthis.exe, rename the hijackthis.exe file to say grcpan-HJT.exe and run it again.
You don’t appear to have an active firewall - It should be capable of blocking unauthorised outbound Internet Connections. - What is your firewall ?
Step 1 : Use Windows File Search Tool to Find Trojan.Agent-ZD Path
Go to Start > Search > All Files or Folders.
In the “All or part of the the file name” section, type in “Trojan.Agent-ZD” file name(s).
To get better results, select “Look in: Local Hard Drives” or
“Look in: My Computer” and then click “Search” button.
When Windows finishes your search, hover over the “In Folder” of “Trojan.Agent-ZD”,
highlight the file and copy/paste the path into the address bar.
Save the file’s path on your clipboard
because you’ll need the file path to delete Trojan.Agent-ZD in the following manual removal steps.
Step 2 : Use Windows Command Prompt to Unregister Trojan.Agent-ZD DLL Files
To open the Windows Command Prompt, go to Start > Run > type cmd and then click the “OK” button.
Type “cd” in order to change the current directory, press the “space” button, enter the full path to where you believe the Trojan.Agent-ZD DLL file is located and press the “Enter” button on your keyboard. If you don’t know where Trojan.Agent-ZD DLL file is located, use the “dir” command to display the directory’s contents.
To unregister “Trojan.Agent-ZD” DLL file, type in the exact directory path + “regsvr32 /u” + [DLL_NAME] (for example, :C\Spyware-folder> regsvr32 /u Trojan.Agent-ZD.dll) and press the “Enter” button. A message will pop up that says you successfully unregistered the file.
Search and unregister “Trojan.Agent-ZD” DLL files: xel50531.dll
Step 3 : Detect and Delete Other Trojan.Agent-ZD Files
To open the Windows Command Prompt, go to Start > Run > type cmd and then press the “OK” button.
Type in “dir /A name_of_the_folder” (for example, C:\Spyware-folder), which will display the folder’s content even the hidden files.
To change directory, type in “cd name_of_the_folder”.
Once you have the file you’re looking for type in “del name_of_the_file”.
To delete a file in folder, type in “del name_of_the_file”.
To delete the entire folder, type in “rmdir /S name_of_the_folder”.
Select the “Trojan.Agent-ZD” process and click on the “End Process” button to kill it.
Remove the “Trojan.Agent-ZD” processes files: xel50531.dll
Yes as I suspected it is malware, make sure that you send the sample to avast to help improve detections.
Whilst the windows XP firewall is usually good at keeping your ports stealthed (hidden) it provides no outbound protection and you should consider a third party firewall.
Any malware that manages to get past your defences (and it just has) will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.
There are many freeware firewalls such as, Comodo (care required now it is a suite not to install the anti-virus element), PCTools Firewall Plus, Jetico, etc. - Zone Alarm free works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated with trial ware and is also crippled as far as outbound protection goes In the Program Control, configuration area, the slider will only goes as far as Medium protection, if you want more you have to buy the Pro version.
After a standard search there were no signs of a virus.
I still can’t use IE, I guess the dll that is at the chest is infected and needed to run IE.
Well I use opera to browse anyway, I am just used to watch my emails using IE by clicking the email button at msn.
I also used hijackthis to delete the dll.
Well I will be formating in a month, I just want to be sure that I have no virus till that time in my computer. Though I do most of my work on UNIX so I don’t have anything of great improtance on windows anyway.
After deleting it I expect that IE will work again (it did the job for me).
I do not know if you have to make other changes to the registry.
Before making changes to the registry make a copy of it!
Where you find this to do, well see the picture attached:
Do everything meticulously, first make a print out of what to do, and do it step by step.
The copy will stay there to be restored if you made a mistake.
It is not really all that difficult and after it has been accomplished,
you feel a lot better you have acquired this new skill, loads of success!
