War inside my computer! Win32:Agent-LNK [Wrm]

oldman960 · 2007-12-31T01:15:40.000Z

That was a fresh copy of combofix, right?

Ok do an online scan with kaspersy

http://www.kaspersky.com/service?chapter=161739400

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT

Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:
Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste or attach that information in your next post.

Note: pause or stop avast’s standard shield during the scan, re-enable afterwards.

Edit to add: you may as well give me another WinPFind3U log to look at while you are doing the online scan.

system · 2007-12-31T06:43:58.000Z

Here are the results, I just got another virus warning before I started actually…

That was the latest version of combo fix before, I re-downloaded it.

oldman960 · 2007-12-31T07:14:38.000Z

It shows a zip file as infected

C:\program files\Trax2Burn\traxjar.jar

see if you can find it and submit to www.virustotal.com

and this one too

D:\Clients\Traxs2Burn\setup.exe

Submit those files and post the results, we’ll see what they have to say.

Seeing how avast if picking these up and there is one in system restore, I’d like you to do this

Remove old restore points

Disk Cleanup

Go to Start - All Programs - Accessories - system tools. Launch the Disk Cleanup tool and let it run. When it finishes a box with tabs will appear, select the more options tab. On this tab you will find a section for System Restore. If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

Then schedule a boottime scan.

Right click the “a” icon, select start avast, when the simple user interface opens, right click on the skin and select schedule a boottime scan. Check archives and all disks. After you are done setting it up reboot.

You will have to be by the computer when you do this, because avast will ask you for an action and won’t continue until you have selected one. move to chest please.

OR

You can chose no action, and don’t show again. The scan will run to completion and give you a report so you can deal with any infected files afterwards.

system · 2007-12-31T09:11:35.000Z

I uploaded the first one, The second I got a message saying that it does not exist. I will do the rest tomorrow morning…

Thanks!

oldman960 · 2008-01-01T11:11:00.000Z

Please start WinPFind3U.

Copy/Paste the information in the quotebox below into the pane where it says “Paste fix here” and then click the Run Fix button.

[Files/Folders - Created Within 90 days]
NY → 3_exception.nls → %System32%\3_exception.nls
[Files/Folders - Modified Within 90 days]
NY → Uploads → %SystemDrive%\Uploads
NY → imsins.BAK → %SystemRoot%\imsins.BAK]
NY → 3_exception.nls → %System32%\3_exception.nls
[File String Scan - Non-Microsoft Only]
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-162645.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-165145.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-180536.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071215-213630.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071215-213641.backup

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here.

oldman960 · 2008-01-02T07:44:03.000Z

To submit a file to virustoal, please click om this link

www.virustotal.com

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for

scroll down a bit and click “send file”, wait for the results and post then in your next reply.

system · 2008-01-03T00:15:17.000Z

[Files/Folders - Created Within 90 days]
NY → 3_exception.nls → %System32%\3_exception.nls
[Files/Folders - Modified Within 90 days]
NY → Uploads → %SystemDrive%\Uploads
NY → imsins.BAK → %SystemRoot%\imsins.BAK]
NY → 3_exception.nls → %System32%\3_exception.nls
[File String Scan - Non-Microsoft Only]
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-162645.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-165145.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071211-180536.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071215-213630.backup
NY → abetterinternet.com , web-nex , ad-w-a-r-e.com , → %System32%\drivers\etc\hosts.20071215-213641.backup

system · 2008-01-03T00:16:50.000Z

For both files I get…

File has already been analysed:
MD5: dba91cd5a3a68302967c03213e52bde8
Date: 03.15.2007 22:43:16 (CET) [>293D]
Results: 1/31
Permalink: analisis/1d66bdab681455bb46ac16c166a1440c

File has already been analysed:
MD5: dba91cd5a3a68302967c03213e52bde8
Date: 03.15.2007 22:43:16 (CET) [>293D]
Results: 1/31
Permalink: analisis/5220e772d1d40b21e8f45f3312c12eab

oldman960 · 2008-01-03T03:53:51.000Z

Did you run the WinPFind3U fix? What you posted was a copy of the fix not the results.

oldman960 · 2008-01-03T06:18:13.000Z

Download avz4.zip from here

[*]Unzip it to your desktop to a folder named avz4
[*]Double click on AVZ.exe to run it.
[*]Run an update by clicking the Auto Update button on the Right of the Log window:
http://rathat.geekstogo.com/images/AVZupdate.jpg

[*]Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

[*] Start AVZ.

[] Choose from the menu “File” => "Standard scripts " and mark the “Healing/Quarantine and Advanced System Investigation” check box.
[] Click on the “Execute selected scripts”.
[] Automatic scanning, healing and system check will be executed.
[] A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
[] It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
[] All applications will work properly after the system restart.

.

When restarted

[*] Start AVZ.

[] Choose from the menu “File” => “Standard scripts " and mark the “Advanced System Investigation” check box.
[] Click on the “Execute selected scripts”.
[*] A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

.

Mail both zips to me. I’ll PM you my e-mail address.

system · 2008-01-04T02:43:09.000Z

I tried to download it and the link didn’t work… Im going to get you those results…

oldman960 · 2008-01-04T03:01:47.000Z

There’s glich in the syntax of that original one I gave you. This one works.

http://z-oleg.com/avz4.zip

actually either one works now, ah the power of edit

system · 2008-01-05T22:06:03.000Z

got it mailed to ya…

essexboy · 2008-01-06T14:39:53.000Z

Ref AVZ

AVZ FIX

[*] Double click on AVZ.exe
[*] Click File > Custom scripts
[*] Copy & paste the contents of the following codebox in the box in the program (start with begin and end with end )

begin SetAVZGuardStatus(True); SearchRootkit(true, true); DeleteFile('C:\Documents and Settings\Michael\Application Data\Microsoft\Installer\{57DC8980-73DA-481E-AFD4-5E2D44B7F1AD}\ARPPRODUCTICON.exe'); DeleteFile('C:\Documents and Settings\Michael\Application Data\Microsoft\Installer\{57DC8980-73DA-481E-AFD4-5E2D44B7F1AD}\SitExpander.exe_57DC898073DA481EAFD45E2D44B7F1AD.exe'); DeleteFile('C:\WINDOWS\Installer\512ff2.msi'); DeleteFile('C:\WINDOWS\system\WINASPI.BAK'); DeleteFile('C:\WINDOWS\system\WOWPOST.BAK'); DeleteFile('C:\WINDOWS\system32\WNASPI2K.BAK'); BC_ImportDeletedList; BC_Activate; RebootWindows(true); end.

[*] Note: When you run the script, your PC will be restarted [*] Click Run [*] Restart your PC if it doesn't do it automatically.

ON COMPLETION

[*] Start AVZ.

[] Choose from the menu “File” => “Standard scripts " and mark the “Advanced System Investigation” check box.
[] Click on the “Execute selected scripts”.
[*] A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZ directory as virusinfo_syscheck.zip.

Attach the zip file to your next post

system · 2008-01-06T17:11:28.000Z

got it done, It says I cannot attach a zip file…

I uploaded it here…

http://www.sendspace.com/pro/dl/iwd9gh

essexboy · 2008-01-06T17:15:42.000Z

I’ll hand you back to Oldman now as that was clean

essexboy · 2008-01-06T17:29:30.000Z

Just been reading the rest of your thread and it appears that this the file that is causing you problems C:\WINDOWS\system32\drivers\smtpdrv.sys

If so

Please download The Avenger by Swandog46 to your Desktop.
[*]Click on Avenger.zip to open the file[*]Extract avenger.exe to your desktop
Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

[QUOTE]drivers to unload:
smtpdrv

Files to delete:
C:\WINDOWS\system32\drivers\smtpdrv.sys
[/quote]

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Now, start The Avenger program by clicking on its icon on your desktop.
[*] Under “Script file to execute” choose “Input Script Manually”.
[*]Now click on the Magnifying Glass icon which will open a new window titled “View/edit script”
[*] Paste the text copied to clipboard into this window by pressing (Ctrl+V).
[*] Click Done
[*] Now click on the Green Light to begin execution of the script
[*] Answer “Yes” twice when prompted.
The Avenger will automatically do the following:
[*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Unload”, The Avenger will actually restart your system twice.)
[*]On reboot, it will briefly open a black command window on your desktop, this is normal.
[*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
[*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply

system · 2008-01-06T19:12:11.000Z

Sounds good, here they are…

oldman960 · 2008-01-06T19:38:30.000Z

Thanks essexboy, that’s the file that just won’t die.

Hi djmichaelwenz

I seems avenger didn’t find the file. So it’s either indeed gone or very well hidden.

Are you still experiencing virus warnings?

system · 2008-01-06T23:39:40.000Z

I have not had any warnings in a long time. Thanks for all your help!!!

MW

Announcements