Trying to remove Trojan-Gen & Rootkit

Viruses and worms
1

I am having problems trying to remove a virus or spyware.
Here is a copy of System Info:

OS Name Microsoft Windows XP Professional
Version 5.1.2600 Service Pack 3 Build 2600
OS Manufacturer Microsoft Corporation
System Name MAIN-OFFICE
System Manufacturer System manufacturer
System Model System Product Name
System Type X86-based PC
Processor x86 Family 15 Model 107 Stepping 1 AuthenticAMD ~2210 Mhz
BIOS Version/Date Phoenix Technologies, LTD ASUS M2NBP-VM CSM ACPI BIOS Revision 0601, 1/29/2007
SMBIOS Version 2.4
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\system32
Boot Device \Device\HarddiskVolume2
Locale United States
Hardware Abstraction Layer Version = “5.1.2600.5512 (xpsp.080413-2111)”
User Name MAIN-OFFICE\Ken
Time Zone Eastern Standard Time
Total Physical Memory 2,048.00 MB
Available Physical Memory 1.36 GB
Total Virtual Memory 2.00 GB
Available Virtual Memory 1.96 GB
Page File Space 5.78 GB
Page File C:\pagefile.sys

I believe all updates have been applied.

I tried to post a log from Avast here but I get an error message that says I cannot post a message with more than 10,000 characters!!! So I have edited the log to just show 12/13/08 entries.

12/13/2008 9:48:59 AM 1229179739 Ken 3724 Sign of “Win32:Trojan-gen {Other}” has been found in “F:\Temporary Internet Files\Content.IE5\RN79K38N\index[1]” file.
12/13/2008 10:18:38 AM 1229181518 Ken 3724 Sign of “Win32:Rootkit-gen [Rtk]” has been found in “G:\Downloads\WinRAR.exe\explore.exe” file.
12/13/2008 10:23:51 AM 1229181831 Ken 3724 Sign of “Win32:Rootkit-gen [Rtk]” has been found in “G:\System Volume Information_restore{7CD0DAF7-7176-48A5-8A9F-4442A3E3DA30}\RP372\A0053015.exe\explore.exe” file.

I see that this log goes all the way back to 12/29/2007, but I have only been having problems in the last week or so (Since about 12/7/2008).
Problems started when I followed a link to www-wvfiremarshall-org or something close to this. Avast popped up a warning about a virus and I have not been able to get rid of it since then. I have scanned with Ad-Aware, SpyBot S&D, Avast and Verizon PC Checkup.
I ran the Avast Cleaner several days ago but it did not help.
It seems that the more I use the computer after a scan, the worse the problems get; i.e. Internet Explorer keeps getting re-directed to junk websites and I can’t even log on to check my e-mail.
If you respond to this topic and I do not answer please be patient and I will try to do more scanning and cleaning until I can get net access again!

I would appreciate your help.
Ken

2

Try a boot time scan with avast! Right click the scanner screen, select ‘schedule a boot time scan’ and reboot when requested. (Or open the tab at the top left of the scanner screen and select the boot time option from there.)

Try the usual free adware/spyware scanners.

SUPERAntiSpyware Free
a-Squared Free
Malwarebytes’ Anti-Malware

3

I have run all the programs you suggested, in safe mode, and run twice.
Seems much better but browser is still being messed with. If I try to go to www.google.com I get a screen that says:
Alert : Your computer have been attacked by spyware or viruses!
Note the incorrect English “have”.
This page has the Microsoft Logo on it and is apparently a spoof.
I have NOT clicked on anything on this page.
I tried to attach a file with a screen shot but the file is too large for this forum.
Thanks for your help.

4

OK, I have gotten everything fixed and back to normal :slight_smile:
Since I could not use Google, I used Yahoo Search and searched on “Your computer have been attacked”
which led me to this website:
http://jamesrohal.com/2008/12/02/removing-the-interval-hehehe-virus/

Scroll down until you find this:
Matthew Seville wrote:
Follow these steps and you will rid your computer of this basic virus. People are deleting drives, cleans are going on. It just is not needed - do this and thank me later!

1:DO NOT download what it sais to download on the internet explorer.

2:Uninstal the fake winrar
3:In system32 folder theres a exe labled explore.exe, and has a winrar file icon if you try to delete it it wont let you, so open task manager and go to “Processes” and end the prosess tree for “explore.exe”
DO NOT CONFUSE WITH “explorer.exe”, which has an “r”

As soon as youve ended the processes tree delete the “explore.exe” from system32.

4:Empty the recycle bin or shred it if you can

5:Now go to system32/drivers/etc/host
open the host file with notepad
delete everything and save.
6: Reboot, open iexplorer and you’re done. It should be back to normal

I got rid of it without use of anitivirus.

Note: If dosnt work, do a file search for HOSTS, there may upto 3 or 4. Look in them all with note pad, and delete the ones with tons of websites listed. Save as under all files.

Reboot: Hey Presto!
December 11th, 2008 at 4:53 pm