Win32:Vidlo-H [Trj]

Viruses and worms
1

Hey guys, i’ve got a problem.
I can’t get rid of these:
Win32:Vidlo-H [Trj]
Win32:Adan-094 [Adw]
Win32:Adan-078 [Adw]

All i can do is stop the connection. I scanned my hdd, nothing was found. I use WinXP Pro/SP2 & avast! 4.6 home edition.

avast! log: http://img231.imageshack.us/img231/3342/avastlog3ce.gif
HijackThis log attached.

Thanks in advance for any help.

2

Can you post the name and path of the infected files?

I mean, I can’t see exactly in the log you’ve posted.

3

http://195.95.218.100/users/serg/web/files/images/bndmod.jpg

http://195.95.218.100/users/serg/web/files/images/hlmicro.jpg

http://195.95.218.100/users/serg/web/files/images/logo_small.jpg

4

Masterofdisaster, I’ve tried to scan these files with Dr. Web… The files isn’t there.
Is this a local file (a file in your computer)?

[i]
Error
Cant fetch file pointed by your url. This may be caused by several reasons:

Remote file not available (not found, requires authentication, permission denied)
Remote site is down or very slow or busy
No network connectivity between Dr.Web online server and remote site
See details below:
Details:

404 Not Found[/i]

5

HI at all!

My avast scanner screams every 15 minutes with the message the a virus is on my pc:

http://195.95.218.100/users/serg/web/files/images/bndmod.jpg

Win32:Adan-094 [Adw]

vps version: 0538-2, 19.09.2005

what i must do that i can stop it???

6

hi!

i have found a second virus when i shut the avastwindow witch is:

http://195.95.218.100/users/serg/web/files/images/hlmicro.jpg

Win32:Adan-078 [Adw]

vps wersion: 0538-2, 19.09.2005

pleas help me!!! ???

7

The URL that you have supplied produce a
[b]404 Not Found

The requested URL /images/404.html was not found on this server.

Apache/1.3.31 Server at 195.95.218.100 Port 80[/b]

Please check very hard to offer advice without more specific detail

8

Guys,

Nobody will be able to see or get in because you have to be an authorized user. This seems to be an images only server. If you back up each path you will be denied entry:

Forbidden
You don’t have permission to access /users/ on this server.
Apache/1.3.31 Server at 195.95.218.100 Port 80

If you go to the main IP for the entire path you get a page loaded response but no web page shows up.
http://195.95.218.100/

9

Hi masterofdisaster,

This is the line of action to be taken by you,

  1. Disable system restore;
  2. Run a full system scan, and repair all the files detected;
  3. Delete all the values added to the registry.

Do these three steps, and you have overcome these worms.
How were you infected, the video H for instance is a mass-mailing worm?

greets,

polonus

10

Hi masterofdisaster In addition to polonus good advice it may also pay to to download

Ewido Security Suite Free and run a scan with that as well

Ewido Security