Win32:Dropper-EPI [Drp] virus in explorer.exe and winlogon.exe

Viruses and worms
21

Cool. It is all gone?

I ran Avast quick scan and it found the virus in the system restore points.

Ran your OTL clean up fixes and then did full scan on reboot.

Now it finds the virus at:

C:\Qoobox\Quarantine\C\Windows\explorer.exe.vir
C:\Qoobox\Quarantine\C\Windows\system32\winlogon.exe.vir

Is this the Avast chest? Do I have to worry about it? Figured I would ask before proceeding with the final cleanup procedures.

Thanksthanks.

22

No it isn’t the avast chest it is the combofix quarantine I believe.

So avast is finding the stuff that combofix renamed and placed in quarantine. When did this alert happen, I’m guessing when you ran the ComboFix /Uninstall command that essexboy had you run to remove it and its contents ?

Or you didn’t run that command and combofix plus the quarantine is still installed and an avast on-demand scan detected them, if so then you should run the ComboFix /Uninstall that essexboy put in his clearup instructions.

23

DavidR,

You were right.

Everything looks A-OK. I almost don’t believe it lol.

24

@ russiancarl,

I’m glad things are finally looking good for your machine! :slight_smile:

As Essexboy suggested, we usually recommend that you keep your machine running for a good 24 hours after malware removal to make sure everything is working properly and give it a good test drive. After this period, please report back in this thread to let us know how things are going (good or bad).

In the meantime, here are a few suggestions in addition to the ones given to you by Essexboy to keep you and your machine safer in the future:

  1. Keep your definitions up to date for both Avast and MBAM (Malwarebytes’ Anti-malware).
  2. Keep all your shields on with Avast.
  3. Update MBAM prior to scanning, then do Quick scans.
  4. Keep your MS Updates current.
  5. Add security related Add-on’s to your browsers for safer browsing. See my Signature as an example.
  6. Use common sense when browsing and do not go to risky sites.
  7. When downloading software, read what you are clicking and do not download adware toolbars which are commonly opted in; look before you click or do a Custom install to avoid putting unwanted toolbars on your machine that lead to spyware tracking or adware.
  8. Check to see that your software is up to date with the free Secunia Software Inspector http://secunia.com/vulnerability_scanning/personal/ since software is changing all the time. This site gives you the vendor’s direct download link making it easy to upgrade your software. Many of us here scan our machines weekly.

Please let us know if you have any issues in the meantime. If all goes well, please report back and let us know. In your final post if all goes well, if you feel that your issue was resolved/fixed, please go back to the first open post in this topic, click the modify button in that Post and change the title/subject, add [Resolved] to the beginning of the title so this thread can be closed. Thank you.

25

You’re welcome.

26

My bad if I didn’t say thanks DavidR.

Thanks also to you SafeSurf and Essexboy x100.

The strange this I do all of those things in your post. It is my mum’s computer so I don’t really use it but I have MBAM, Avast up, Firefox and all the security tools and as far as I can tell I got this virus looking at a Serious Eats food blog site.

I’ll have to maybe look into keeping things more up to date though.

Also, by test drive what do you mean? Just to use normally? All my mum does is play some card games and read emails

27

Okay, I tried to connect the computer directly to the modem instead of through the router. It has limited or no connectivity and is missing the Internet Connection Gateway under the Network Connections folder in the control panel. Could not repair the connection because it is unable to renew the IP address.

I checked the TCP/IP properties and it is set to obtain IP address and DNS server address automatically. Tried to run ipconfig but the screen auto closes before I can even see it. Didn’t want to do much fooling around after that since I am not sure if this is something caused by the virus or by one of the fixes you provided.

Since I don’t want to break anything further I digress to your wisdoms. Thanks again.

28

ok ik you guys dont use hjt on here anymore. but u can delete the ip setting from in the scan. just a suggestion

29

MS has a little fix it here http://support.microsoft.com/kb/299357

Press the big Fixit button and let the programme run - then see if that has helped

30

Yeah, that didn’t work.

ipconfig /renew didn’t work. It was unable to contact the DHCP server. /flushdns didn’t work.

is this a winsock thing or do i have to uninstall / reinstall my network adapter drivers?

31

OK next trick is to reset the winsock

http://majorgeeks.com/WinSock_XP_Fix_d4372.html download and run this programme - if it fails we will need to look at the running services

32

Hey essexboy,

It didn’t work. Still getting the same Limited Connectivity error and can’t renew the IP.

33

Have you reset your router: stick the tip of a paperclip or the end of a pen into the reset hole of the router while it is off? Then try to manually renew your IP?

Check to make sure all connections are secure.

You can also manually do the following to renew your IP:

  • Start > Run > type “cmd” > type “ipconfig/release” > wait at least a minute
  • Start > Run > type “cmd” > type “ipconfig/renew” > wait at least a minute
  • Then try to renew your IP on your own. If this fails, contact your ISP and they have no choice but to give you a new one.

Also, make sure you have under Add/Remove Programs the Microsoft Visual C++ Redistributable Packages and let us know which ones you have; you should have several listed by year. If you only see one listed, go to Windows Updates and see if you need an update. If you see none listed, post back and we will give you the link for the Packages you need for your machine.

Otherwise, Essexboy is your best option.

34

essexboy. with the updated version of combofix, when you were helping me with my problem, i accedently left avast shields on and when it started it went to the bsod. shouldnt combofix fix the connectivity problem, btw i have a different problem with a new comp im working on, but i wont go into it on this thread.

35

First run the fixit on this page

Then go to Control Panel > Administrative tools > Services and ensure that the DHCP service is set to automatic.

Then retry

If that fails then try the following

[*]To open a command prompt, click Start > All Programs > Accessories and then right click command prompt and select run as administrator.
[*]Copy and paste (or type) the following command in the command box box and then press ENTER:
netsh winsock reset c:\resetlog.txt
[*]Reboot the computer.
[*]In next reply please post content of the file c:\resetlog.txt

36

It didn’t work. Also, no reset log was created for the 2nd command but one was created for the first. Did you still want it?

37

Yes please

Is the dhcp service set to autostart ?