system
January 16, 2006, 6:45pm
1
When i started the avast! antivirus, while the memory test is running, a virus was found. Here’s the info of the virus:
File name :c:\windows\kernerl32.dll
When I try to move to chest/repair/delete the infected file, a pop up screen ‘cannot process “c:\windows\kernerl32.dll” file’ was shown.
Logfile of HijackThis v1.99.1
Running processes:
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL@msdxmLC.dll ,-1@1028,收音機[&R] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXhttp://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio4_0_2_10a.cab http://www.crazy.com.tw/Game/shake2/ShakeGTW.cab http://messenger.msn.com/download/msnmessengersetupdownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab http://download.games.yahoo.com/games/clients/y/pote_x.cab https://nprotect.lineage2.com.tw/nprotect/keycrypt/npkcx.cab http://nprotect.lineage2.com.tw/nprotect/nprotect2004/ncsoft/npv.cab
Would anyone give me a hand? This virus has been annoying me for a week!!! Thanks alot.
DavidR
January 16, 2006, 8:56pm
2
Schedule a boot-time scan from witin avast, that way the file won’t be in use.
http://img.photobucket.com/albums/v325/for-dwr/boottime.jpg
system
January 17, 2006, 1:08am
3
pls help… the avast alert is driving me mad!!!
file name c:\windows\system32\rdriv.sys
i have tried running scans in safemode but that didn’t help…
here’s my hijackthis log
Logfile of HijackThis v1.99.1
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/ http://mail.yahoo.com/ http://profiles.yahoo.com/cristi_c3?intl=us&os=win&ver=7,0,0,437 http://bar.mywebsearch.com/menusearch.html?p=ZNxmk570YZRO http://download.games.yahoo.com/games/clients/y/yt1_x.cab http://go.microsoft.com/fwlink/?linkid=39204 http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1133311656062 http://download.games.yahoo.com/games/web_games/tikgames/pandacraze/gpcontrol.cab
all help is highly apreciated…
system
January 17, 2006, 4:20pm
5
I have already read the post be4 about the boot-time scan.
http://x0c.xanga.com/98bb3350c953229684173/b20776763.jpg
Should I install Avast for DOS mode and run the antivirus check in DOS?
DavidR
January 17, 2006, 6:20pm
6
You could try booting into safe mode and running an avast scan from there and see if it isn’t running in safe mode.
Yes, it’s OS related. Boot time scanning is only available into Windows NT (2k or XP).
system
January 18, 2006, 3:51am
8
Tried be4. But the problem still unsolved.
btw…another file is now infected by the same virus. >:(
Dunno what to do now. ???
It looks like you’re running two AV’s, which is not a good idea as they will fight over files like dogs over a bone. You need to decide which one you want to keep, and uninstall the other one.
Your HijackThis! log shows you have TROJ_SMALL.AY:
C:\WINDOWS\INERTINFO.EXE
http://uk.trendmicro-europe.com/consumer/vinfo/encyclopedia.php?LYstr=VMAINDATA&vNav=3&VName=TROJ_SMALL.AY
As Trend Micro will detect and remove this, I suggest you run Trend Micro Sysclean in safe mode:
You will need to download the latest virus definitions (Virus Pattern File- Official Pattern Release) and place it in the same folder as Sysclean.
http://www.geocities.com/dontsurfinthenude/antivir2.htm
http://uk.trendmicro-europe.com/enterprise/support/tsc.php http://uk.trendmicro-europe.com/enterprise/support/pattern.php
You could try running some anti-spyware programs. The following are all good and free:
Ad-Aware http://www.majorgeeks.com/download506.html
Spybot Search & Destroy http://www.safer-networking.org/
a-Squared anti-Trojan program will also run on ME:
a-Squared http://www.emsisoft.com/en/
system
January 18, 2006, 6:00pm
10
Finally I HAVE DEFEATED the annoying virus!!!
Logfile of HijackThis v1.99.1
Running processes:
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\PROGRAM FILES\ICQTOOLBAR\TOOLBAR.DLL@msdxmLC.dll ,-1@1028,收音機[&R] - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCXhttp://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/my/yiebio4_0_2_10a.cab http://www.crazy.com.tw/Game/shake2/ShakeGTW.cab http://messenger.msn.com/download/msnmessengersetupdownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab http://download.games.yahoo.com/games/clients/y/pote_x.cab https://nprotect.lineage2.com.tw/nprotect/keycrypt/npkcx.cab http://nprotect.lineage2.com.tw/nprotect/nprotect2004/ncsoft/npv.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
And are there any other problems now?
DavidR
January 18, 2006, 6:29pm
11
As Frank said you appear to be running two resident AVs, this doesn’t provide twice the protection, just more potential for conflict. You really need to choose and uninstall one. Norton can be almost as hard to get rid of as any virus.
You don’t appear to be using a software firewall, this is an essential piece of security software, without it you are pushing a pea uphill with your nose. As fast as you get rid of something, there is likely to be more to replace it.
Since you are using winME you aren’t able to run the latest version of IE 6 SP2 (which is only available if you have winXP SP2), so with an older version of IE you may be more vulnerable to malware. I suggest that you look at an alternative non-ie browser, firefox, opera, k-melon, etc.
Other than that things look clear.
system
January 18, 2006, 6:48pm
12
As Frank said you appear to be running two resident AVs, this doesn’t provide twice the protection, just more potential for conflict. You really need to choose and uninstall one. Norton can be almost as hard to get rid of as any virus.
Well actually my norton is not working properly, so I have disabled its function. I will only use Avast as the only AntiVirus software. At this moment no conflict has occured yet.
You don’t appear to be using a software firewall, this is an essential piece of security software, without it you are pushing a pea uphill with your nose. As fast as you get rid of something, there is likely to be more to replace it.
I’m using a router but dunno if it has a firewall function. It’s a RoadLanner BRL-04F Router. I guess it has the firewall function but not quite sure.
Since you are using winME you aren’t able to run the latest version of IE 6 SP2 (which is only available if you have winXP SP2), so with an older version of IE you may be more vulnerable to malware. I suggest that you look at an alternative non-ie browser, firefox, opera, k-melon, etc.
I’ve another browser called Sleipnir166 but I think it is IE-based browser. Should I use firefox now?
Anyway, thx for all your help ;D
DavidR
January 18, 2006, 9:31pm
13
Two resident AVs on the same system even with one disabled, especially when one is Norton is not recommended. The fact that you haven’t had any conflict is more luck than judgment, conflicts can cause a system lock-up and that if it occurs is a real pain to resolve.
Many routers do have a firewall but it is normally limited to inbound protection, anything that gets past your defenses is able to connect and transfer data or download more of the same. I suggest you investigate what protection your router gives you.
An IE-based browser is to my mind better than IE, if it has additional functionality and easier setting for security, but it is still based on IE so if you can’t get the latest version of IE you may well still be vulnerable.
There are some who are experiencing issues with the latest firefox 1.5, I’m not, but as I said there are others. The main reason for choosing a non-ie based browser is no activeX, no Browser Helper Objects (BHO) and not integration into the OS, so if IE is exploited it is possible your OS is also compromised, but the choice must be yours.
system
May 13, 2008, 7:29pm
14
Hey Guys!!
I just got this annoying virus on my PC and I have no way of getting rid of it! I read about providing a HJT log file and will post that as soon as I can get my damn computer to give me control over it!
Is there any way I can speed up the process??!?!?
N E help will be appreciated! Urgently need to sort this out the virus has been screwing up my computer bit by bit!!!
system
May 13, 2008, 7:38pm
15
Hey!
Here is the HJT Log File. I have to split it up cause it’s too long to post!!!
If anybody could please help!!!
Logfile of HijackThis v1.99.1
Running processes:
system
May 13, 2008, 7:39pm
16
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)http://go.microsoft.com/fwlink/?linkid=58813 https://www.windowsonecare.com/install/cli/0.9.0929.18/WinSSWebAgent.CAB http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab http://upload.facebook.com/controls/FacebookPhotoUploader.cab http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
system
May 13, 2008, 7:40pm
17
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab https://rtc1.webresponse.one.microsoft.com/media/xp/TLIEFlash.CAB http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab http://mvnet.xlontech.net/qm/fox/06101102/qsp2ie06101001.cab https://secure.gopetslive.com/dev/GoPetsWeb.cab
system
May 13, 2008, 7:41pm
18
That’s the end of the file!!!
Please any help will be appreciated!!!
Thanks
You’ll probably need to disable Windows Defender before removing the malware.
These are all bad. I don’t know why avast! doesn’t detect them.
O4 - HKCU..\Run: [ttool] C:\WINDOWS\9129837.exe
Please disable ‘Hide protected operating system files’ ‘View Hidden Files and Folders’ VirusTotal
You can then run HijackThis! again and fix the entires, reboot into safe mode and delete the files.
Run another HijackThis! scan to make sure the entries have gone- more sophisticated malware may protect itself and need stronger removal methods.
system
May 13, 2008, 8:24pm
20
Thanks i’m going to try that stuff right now! Hopefully it’ll work. The file that avast keeps picking up that has the virus is new_drv.sys located in C:\WINDOWS
every time it picks up the virus and i delete, it returns on the reboot!!!
