what to do..??   found.. DAME (Dark Angel M.E.)

FreewheelinFrank · 2007-06-17T17:18:43.000Z

The location detected by avast! seems to be a database file containing info on your contacts: address, telephone number etc. There’s no obvious reason why it should contain malware.

Have a look in the following location and see what you find:

C:\Documents and Settings\christa\Local Settings\Application Data\Microsoft\Windows Live Contacts[snip]@hotmail.com\shadow\members.stg\792002404

If members.stg is not too large (max. 10MB), see what VirusTotal says about it:

http://www.virustotal.com/vt/

EDIT: Removed personal info.

Lisandro · 2007-06-17T17:20:39.000Z

I’m not an expert on HijackThis… But you can check the automatic analysis of your HijackThis log here.

You can find more info in the links of the last column of this table.
That info could guide you on the cleaning process.
Anyway, if you have doubts, just post here.
Also, take a careful look at the first column of the table:

If you don’t recognize a legit program in one of the items marked as FIX IF UNKNOWN, please post it back here and maybe we can help you. Or, if you’re sure it’s a malware item, you can remove it as posted bellow.
If you agree with the automatic classification of the infected items marked as FIX (CHECK NOTES!), you can turn back to HijackThis program, check the box of this item and then remove it using the button ‘Fix checked’.

Hope it helps.

essexboy · 2007-06-17T17:58:43.000Z

Well all I could find was the remnant of a trojan which shall now depart

REGISTRY FIX

REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
autoupdatev2=-

Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop
http://img127.imageshack.us/img127/433/regtg8.jpg

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\autoupdatev2.exe

Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

On completion

Double click OTMoveIt once again and you should see a CleanUp! button, press that button, you may get prompt by your firewall that OTMoveIt wants to contact internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself

system · 2007-06-18T01:15:19.000Z

FreewheelinFrank post:9:

The location detected by avast! seems to be a database file containing info on your contacts: address, telephone number etc. There’s no obvious reason why it should contain malware.

Have a look in the following location and see what you find:

C:\Documents and Settings\christa\Local Settings\Application Data\Microsoft\Windows Live Contacts\freedsxxx2@hotmail.com\shadow\members.stg\792002404

If members.stg is not too large (max. 10MB), see what VirusTotal says about it:

http://www.virustotal.com/vt/

Hey Frank, this is what virus total says…
odd that only avast picks it up…

STATUS: FINISHEDComplete scanning result of “members.stg”, received in VirusTotal at 06.18.2007, 03:33:49 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.9.0 06.08.2007 no virus found
AntiVir 7.4.0.32 06.17.2007 no virus found
Authentium 4.93.8 06.16.2007 no virus found
Avast 4.7.997.0 06.18.2007 DAME
AVG 7.5.0.467 06.17.2007 no virus found
BitDefender 7.2 06.18.2007 no virus found
CAT-QuickHeal 9.00 06.16.2007 no virus found
ClamAV devel-20070416 06.18.2007 no virus found
DrWeb 4.33 06.18.2007 no virus found
eSafe 7.0.15.0 06.17.2007 no virus found
eTrust-Vet 30.7.3721 06.15.2007 no virus found
Ewido 4.0 06.17.2007 no virus found
FileAdvisor 1 06.18.2007 no virus found
Fortinet 2.85.0.0 06.18.2007 no virus found
F-Prot 4.3.2.48 06.08.2007 no virus found
F-Secure 6.70.13030.0 06.17.2007 no virus found
Ikarus T3.1.1.8 06.17.2007 no virus found
Kaspersky 4.0.2.24 06.18.2007 no virus found
McAfee 5054 06.15.2007 no virus found
Microsoft 1.2607 06.18.2007 no virus found
NOD32v2 2334 06.15.2007 no virus found
Norman 5.80.02 06.15.2007 no virus found
Panda 9.0.0.4 06.17.2007 no virus found
Prevx1 V2 06.18.2007 no virus found
Sophos 4.18.0 06.12.2007 no virus found
Sunbelt 2.2.907.0 06.09.2007 no virus found
Symantec 10 06.18.2007 no virus found
TheHacker 6.1.6.134 06.18.2007 no virus found
VBA32 3.12.0.2 06.15.2007 no virus found
VirusBuster 4.3.23:9 06.17.2007 no virus found
Webwasher-Gateway

???

system · 2007-06-18T01:24:34.000Z

Tech post:10:

I’m not an expert on HijackThis… But you can check the automatic analysis of your HijackThis log here.

You can find more info in the links of the last column of this table.
That info could guide you on the cleaning process.
Anyway, if you have doubts, just post here.
Also, take a careful look at the first column of the table:

If you don’t recognize a legit program in one of the items marked as FIX IF UNKNOWN, please post it back here and maybe we can help you. Or, if you’re sure it’s a malware item, you can remove it as posted bellow.

If you agree with the automatic classification of the infected items marked as FIX (CHECK NOTES!), you can turn back to HijackThis program, check the box of this item and then remove it using the button ‘Fix checked’.

Hope it helps.

Hey Tech, im wondering now should i do what you were saying first, or should i do as essexboy said and fix the registry value first… im new to all of this [playing with registry values]… but im willing to learn… Thanks for all your patience, all of you!! ;D

FreewheelinFrank · 2007-06-18T07:49:41.000Z

Looks like a false positive. You should send the file to virust@avast.com with a link to this thread- they will update the definition to prevent the detection.

Also, you should probably edit your email address to avoid spam.

DavidR · 2007-06-18T14:22:54.000Z

Adding to what FWF said, add it to the exclusions until corrected.

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

Also see False Positives, how to report it to avast! and what to do to exclude them until the problem is corrected.

Lisandro · 2007-06-18T19:14:17.000Z

christa post:13:

Hey Tech, im wondering now should i do what you were saying first, or should i do as essexboy said and fix the registry value first… im new to all of this [playing with registry values]… but im willing to learn… Thanks for all your patience, all of you!! ;D

Always follow essexboy first than I. He’s a cleaning/malware expert. I’m not. I was just trying to give you a follow up of the cleaning procedure. But, care, maybe it’s a false positive as Frank said. You can update your virus database (VPS) again and see if the last ones correct this detection or, on contrary, confirms the infection.

system · 2007-06-20T16:22:44.000Z

hi all

i am new to this site. didn’t know it existed. :

anyway im experiencing the same problem as christa and was wondering whether i should follow the same procedures.

thank you all.

kaz

FreewheelinFrank · 2007-06-20T18:41:27.000Z

Hi KAZMANIA,

If it’s DAME in members.stg, it looks like a false alarm. Follow David’s advice here:

http://forum.avast.com/index.php?topic=28883.msg236485#msg236485

system · 2007-06-20T23:01:31.000Z

thank you fwf,

but you wont believe this. i left the pc on, my gf did something and its gone! ive run the avast virus checker on standard and thorough and still picked up nothing! is this possible with “DAME” or has it hidden somewhere were it cannot be found? she said she deleted it or moved it to the chest but there is nothing in the chest. i don’t know. let me know what you think.

kaz

DavidR · 2007-06-20T23:48:10.000Z

Where was it located originally, then check if it is still there ?
check the avast! Log Viewer (right click the avast icon), Warning section, this contains information on all avast detections.

It is possible that she moved/renamed and not moved to the chest, check the C:\Program Files\Alwil Software\Avast4\DATA\moved folder ?

system · 2007-06-21T11:03:32.000Z

hi david

i checked the moved folder and there is nothing there.

this is where the file is:

c:\documents and settings\kaz\local settings\application data\microsoft\windows live contacts[so and so]@hotmail.com\real\members.stg\ -55735052" file

i believe this file is still there. i found it. but under properties of that folder i cant find the numerics ‘-55735052"file’. i don’t know if these numerics need to be found to identify but the rest of file path takes me to “members.stg”

thank you for your help
kaz

FreewheelinFrank · 2007-06-21T11:17:50.000Z

The false positive may well have been corrected.

members.stg is a database file of contact’s personal information. The numerical tag is probably not a file but probably some sort of descriptor.

DAME is a virus dating back to 1993- such detections are often FP’s.

If the FP hasn’t been corrected by avast!, changes to the database file caused by adding, removing or updating contact details may have changed the character sequence causing the detection.

If avast! has moved the file, you will have lost you contact details in Windows Live Messenger, so you will need to restore the file.

Add it to the exclusions list to prevent detection if the FP has not been corrected.

DavidR · 2007-06-21T13:32:17.000Z

I would agree with Frank, if the file is still in the original location and undetected then the FP looks like it has been corrected. Do a right click context menu scan (in explorer) on the members.stg file to confirm it is clear.

The numerics file, \ -55735052, I believe is inside the members.stg that is why you can’t see it.

system · 2007-06-22T14:19:21.000Z

hi all

another prob. my pc has slowed down dramatically when using the internet since the virus. it has never run this slow. could there be any relation at all?

i just use my laptop for assignments and some surfing.

thank you

Lisandro · 2007-06-22T14:30:09.000Z

KAZMANIA post:24:

could there be any relation at all?

Yes, it could. But you need to scan your computer again (avast, AVGas, a-squared, Spyware Terminator…) and take a new HijackThis log.

system · 2007-09-09T22:04:30.000Z

Hi there,

Same problem and since it was more than 2-3 months when this topic was made and there were no adjustments to viral database in Avast,can anyone tell me is this still false positive cuz i got this same virus alert yesterday. ???

i checked it on virustotal and avast was the only one who detected it.

Any suggestions?Help?Oh yes,maybe i’m trippin but my pc slowed down.

EDIT : HJT log is attached

Lisandro · 2007-09-09T23:05:13.000Z

vladabgd post:26:

i checked it on virustotal and avast was the only one who detected it.

Most probably…
To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
VirusTotal and Jotti both have file size limits 10 and 15MB each.

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.
After that, please, periodically check it - scan it into Chest, right clicking the file - there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.

This link is a tutorial on how to help correct a virus detection that you believe to be false:
http://forum.avast.com/index.php?topic=25009.msg204838#msg204838
or http://forum.avast.com/index.php?topic=7779.msg62586#msg62586

system · 2007-09-09T23:59:55.000Z

Thanks,I just did that.

Can you please check my HJT log to see if there’s something wrong going on there?

big thnks in advance. ;]

Announcements