URL:mal

Viruses and worms
1

I’am getting this message mb every 30 min or so.

http://img809.imageshack.us/img809/676/avastd.jpg

I use chrome , i dont use IE , also there is no iexplorer process in processes.

plz help

2

Follow this guide and attach logs from malwarebytes quick scan / OTL / aswMBR
http://forum.avast.com/index.php?topic=53253.0

3

Malwarebytes log : ( did restart and again got same message )

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org

Database version: v2012.04.03.08

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Mirko :: MIRKO [limited]

Protection: Enabled

3.4.2012 18:03:13
mbam-log-2012-04-03 (18-03-13).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 239835
Time elapsed: 13 minute(s), 30 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) → Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) → Bad: (1) Good: (0) → Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 4
C:\Documents and Settings\Mirko\Local Settings\Temp\7zO152.tmp\Phx_data\Res\EmuCfg.exe (Trojan.Agent) → Quarantined and deleted successfully.
C:\Documents and Settings\Mirko\Local Settings\Temp\7zO152.tmp\Phx_data\Res\GCFMgr.exe (Trojan.Agent) → Quarantined and deleted successfully.
C:\Documents and Settings\Mirko\Local Settings\Temp\7zO152.tmp\Phx_data\Res\RICO.exe (Backdoor.Bot) → Quarantined and deleted successfully.
C:\Documents and Settings\Mirko\Local Settings\Temp\7zO152.tmp\Phx_data\Res\ss.exe (Backdoor.Bot) → Quarantined and deleted successfully.

(end)

4

I did otl , and again getting same message

5

did aswMBR and again i got same message

6

any help with my problem ?

7

Essexboy usually arrive here late UK time…so it may be some 10hours before he arrive
so be paitient, he is notified :wink:

8

OK I can see it, but before I remove it I would like to check the registry for the net drivers

As if it has subborned it I want to ensure that removal will not disconnect you

run farbar service scanner

http://i1224.photobucket.com/albums/ee362/Essexboy3/Farbar/FSS-1.jpg

Tick “All” options.
Press “Scan”.
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

9

FSS file

10
NetBt Service is not running. Checking service configuration: Checking Start type: Attention! Unable to open NetBt registry key. The service key does not exist. Checking ImagePath: Attention! Unable to open NetBt registry key. The service key does not exist.
OK I will need to create a registry fix and then I can delete the driver

Bear with me

11

Could you go to my site and download the zip file with your name to your desktop
To get to the site click the Globe under my Avatar
Extract the two reg files
Right click each one and select Merge
Accept the warnings

Then

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL DRV - File not found [Kernel | On_Demand | Unknown] -- -- (.netbt)

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]


[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

12

when i tried to merge legacy file i get error ( attachment ), but other one did ok.

I have disabled Malwarebytes and then run OTL with code u provided.

pressed Run Fix , icons gone, in status bar of OTL was “killing process dont interrupt” , i left it like that for more then 1h , and nothing , progress bar didnt move from start there was message “killing process dont interrupt” . I had to restart it , and then again am getting avast message.

13

OK the malware is getting uppity

Keep the reg fixes handy as you may need them on completion of this run if you are unable to connect

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[]Accept the disclaimer and allow to update if it asks
[]Allow the installation of the recovery console

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

14

Here is the log. I think program restarted twice . NOTE: after he finished my avast did not start on windows start so i just turned it on.
Again am getting same message.

15

Aye it is still there

With malware infections being as they are today, it’s strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Go to Microsoft’s website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that’s appropriate for your Operating System. Download the file & save it as it’s originally named.

Note: If you have SP3, use the SP2 package.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

http://img.photobucket.com/albums/v666/sUBs/RC1-4.gif

[*]Drag the setup package onto ComboFix.exe and drop it.

[*]Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

http://img.photobucket.com/albums/v706/ried7/whatnext.png

[*]At the next prompt, click ‘NO’ to run the full ComboFix scan.

THEN

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:
MIA:: c:\windows\system32\drivers\netbt.sys
Save this as [b]CFScript.txt[/b], in the same location as ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exeWhen finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.