41

Oh wait, silly me

42

DUH…

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\tswaufuh

Script file located at: ??\C:\qdqcwemo.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

Beginning to process script file:

Could not open file C:\WINDOWS\system32\drivers\Fub04.sys for deletion
Deletion of file C:\WINDOWS\system32\drivers\Fub04.sys failed!

Could not process line:
C:\WINDOWS\system32\drivers\Fub04.sys
Status: 0xc0000022

Completed script processing.

Finished! Terminate.

43

Well, let’s take a deeper look

Pay particular attention to notepad’s format as given in the instructions.

Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Under Additional Scans click the checkboxes in front of the following items to select them:

NOTE: no additional scan required at this time

[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

This log will be quite long. You can either use multiple post or attach the log file if its easier. In either case make sure the last line is < End of Report >.

Just set it like in the image in the picture in this link, except change the two dates from 30 days to 90 days

http://forum.avast.com/index.php?topic=31261.msg260811#msg260811

click the pic to enlarge

44

I am fairly certain that I got the options correct, I did the same as the image except I changed the two dates from 30 to 90…

THANK YOU FOR ALL THE SPECIAL ATTENTION!

Attached is the Log

45

Thanks, I’m at work right now, so I won’t be able to go over it "till later.

How is everthing on your end?

46

Everything here seems really well, I have no signs of any viruses as far as I can tell!!! Thank You Thank you!!

47

Hi, I haven’t forgotten about you. Just takes time to read that log. Another member (mauserme) will be stopping by to comment on the log.

48

Hi guys - here I am.

djmichaelwenz - please start WinPFind3U.

Copy/Paste the information in the quotebox below into the pane where it says “Paste fix here” and then click the Run Fix button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new WinPFind3u scan (90 day option again).

Also let me know of any problems you encounter performing these steps or any continuing problems you are having with the computer.

49

I ran WinPFind3U and it made me reboot pretty quickly. I went into the folder where I had it and I saw the log. Here is the log, there were seemingly no problems when running it. Thank you all so much!

[Files/Folders - Created Within 90 days]
C:\b.tmp moved successfully.
C:\dump_dvd.vob moved successfully.
C:\WINDOWS\STMMain.INI moved successfully.
C:\WINDOWS\SYSTEM32\8_exception.nls moved successfully.
C:\WINDOWS\SYSTEM32\iymqopmu.ini moved successfully.
C:\WINDOWS\SYSTEM32\nadfilkb.ini moved successfully.
C:\WINDOWS\SYSTEM32\orutv.ini moved successfully.
File move failed. C:\WINDOWS\SYSTEM32\drivers\Fub04.sys scheduled to be moved on reboot.
[Files/Folders - Modified Within 90 days]
C:\WINDOWS\custvoic.ini moved successfully.
< End of log >
Created on 12-19-2007 08:27:59

50

Hi djmichaelwenz

Could you re-run WinPFind3u as requested by mauserme

Post that information back here along with a new WinPFind3u scan (90 day option again).
51

I got this in the log…

[Files/Folders - Created Within 90 days]
File C:\b.tmp not found!
File C:\dump_dvd.vob not found!
File C:\WINDOWS\STMMain.INI not found!
File C:\WINDOWS\SYSTEM32\8_exception.nls not found!
File C:\WINDOWS\SYSTEM32\iymqopmu.ini not found!
File C:\WINDOWS\SYSTEM32\nadfilkb.ini not found!
File C:\WINDOWS\SYSTEM32\orutv.ini not found!
File move failed. C:\WINDOWS\SYSTEM32\drivers\Fub04.sys scheduled to be moved on reboot.
[Files/Folders - Modified Within 90 days]
File C:\WINDOWS\custvoic.ini not found!
< End of log >
Created on 12-19-2007 11:23:48

52

Sorry, I should have been clearer. We need you to re-run the scan, not the fix.

Just set it up like you did the first time you ran it. Please set it to 90 days.

See reply #42

http://forum.avast.com/index.php?topic=32022.msg268167#msg268167

:wink: :smiley:

53

I can’t tell from the WinPFind results if C:\WINDOWS\SYSTEM32\drivers\Fub04.sys is still on your computer or not, but I’m guessing it is.

Please boot to safe mode and navigate to the file. If you find it, try to rename it Fub04.vir, then reboot to normal mode. If you found the file and were able to rename it upload it to Virus Total and post the results.

54

I rebooted in safe mode, I searched and Found C:\WINDOWS\SYSTEM32\drivers\Fub04.sys I attempted to rename it and it said “cannot rename C:\WINDOWS\SYSTEM32\drivers\Fub04.sys Access Denied” I tried to delete it too, it said access denied.

I attempted to upload to virus total and got a white page with only the text…

0 bytes size received / Se ha recibido un archivo vacio

Thank you for all your trouble
Michael

55

Ok, just hang tough,we gotta find another way to see what this file is all about.

Experiencing any problems?

56

No problems here, everything seems really good actually…

57

If you don’t mind, let’s try a little different approach that might give us some clues.

1. Launch Notepad, and copy/paste the contents of the quote box below into a new Notepad file. Save it with file name options.txt and save as file type: all files to your desktop.

RegSearch Options File

[Search]

Fub04.sys

[Exclude]

[Options]
Filter=KVDLUI

2. Download Registry Search to your desktop.
[*]Right click on the compressed RegSearch folder, and choose “Extract All”. In the box that pops open, click “Next”, then “Next” again, and then “Finish”. You now have another RegSearch folder on your desktop.
[*]Open the new folder, and double click on regsearch.exe
[*]Click “Import” in the lower left corner and browse to the options.txt file that you just saved on your desktop. Do not choose the one in the RegSearch folder itself.
[]Click OK and Registry Search will scan your registry for the file(s), and a Notepad box will open with a report.
[] Please reply here with the entire contents of the Notepad file from RegSearch.

58

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.5.0

; Results at 2007-12-20 8:46:00 AM for strings:
; ‘fub04.sys’
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Fub04]
; Contents of value:
; System32\Drivers\Fub04.sys
“ImagePath”=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,46,00,75,00,62,00,30,00,34,00,2e,
00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Fub04]
; Contents of value:
; System32\Drivers\Fub04.sys
“ImagePath”=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,46,00,75,00,62,00,30,00,34,00,2e,
00,73,00,79,00,73,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fub04]
; Contents of value:
; System32\Drivers\Fub04.sys
“ImagePath”=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,46,00,75,00,62,00,30,00,34,00,2e,
00,73,00,79,00,73,00,00,00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs]
“url2”=“C:\WINDOWS\SYSTEM32\drivers\Fub04.sys”

[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
“000”=“Fub04.sys”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU*]
“f”=“C:\WINDOWS\system32\drivers\Fub04.sys”

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\sys]
“b”=“C:\WINDOWS\system32\drivers\Fub04.sys”

; End Of The Log…

Thanks!

59

Thanks. Hopefully that will give mauserme what he was looking for.

translated
““ImagePath”=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,46,00,75,00,62,00,30,00,34,00,2e,
00,73,00,79,00,73,00,00,00”

system32\drivers\fub04.sys

There’s a lot of things pointed at that file.

60

I cant seem to find any info on the file either… Maybe its some hardware I have installed???

Thanks you guys!!!