system
December 11, 2008, 6:52am
1
Hello,
I am having troubles, and Avast is not seeming to find and remove the little bugger.
I first noticed something funny when all my hidden folders became hidden, and I couldn’t change the option to show them.
Then, I couldn’t open C through file manager, and I found a rogue “autorun.inf” on c:\
Every time I try to remove it, it comes back.
;4
I have done a bootscan, and a full scan using the free edition of Avast. They found a few things (they were out of date), but I am still having the autorun.inf problem. I am currently running “Virus Cleaner”, and it found no virus in memory.
What do I do next??
system
December 11, 2008, 6:56am
2
Logfile of HijackThis v1.99.1
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/ http://pc.support.global.toshiba.com/
system
December 11, 2008, 6:57am
3
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab http://zone.msn.com/bingame/pppp/default/PiratePoppers.1.0.0.39.cab http://by106w.bay106.mail.live.com/mail/resources/MsnPUpld.cab http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab http://zone.msn.com/bingame/chnz/default/mjolauncher.cab http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab http://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab#version=1,0,0,10 http://zone.msn.com/binframework/v10/StProxy.cab55579.cab http://zone.msn.com/bingame/popcaploader_v10.cab https://online.westpac.com.au/wtoa/wtOtherAccounts/portfoliomanagerwt.cab
system
December 11, 2008, 7:25am
4
I suggest you try Autorun Eater
Plus your java is down 4 levels.
Uninstall the old version of Java.
Download JavaRa to remove the remaining files of the old version.
Install Java 6 Update 11 (uncheck the MSN Toolbar at installation).
You need to upgrade your HiJackThis.
Uninstall HJT 1.99.1 and install 2.0.2 here .
Edit: It also appears you have PopCapLoader which is a piece of adware.
system
December 11, 2008, 10:15am
5
Thanks for your info.
I have done all the windows updates.
I have updated Java.
And Hijack this.
Popcaploader is needed by msn games, I believe, but I haven’t used that for a long time, so it is going.
“Autorun Eater” removes the autorun, but a new one ends up there about 5-10 seconds after removal.
Results of Hijack this:
[b]
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ninemsn.com.au/ http://pc.support.global.toshiba.com/ @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
system
December 11, 2008, 10:15am
6
[b]O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab http://zone.msn.com/bingame/pppp/default/PiratePoppers.1.0.0.39.cab http://by106w.bay106.mail.live.com/mail/resources/MsnPUpld.cab http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab http://zone.msn.com/bingame/chnz/default/mjolauncher.cab http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1228989988659&h=d0bef662e5168148f456c9a2e99da79f/&filename=jinstall-6u11-windows-i586-jc.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab http://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab#version=1,0,0,10 http://zone.msn.com/binframework/v10/StProxy.cab55579.cab http://zone.msn.com/bingame/popcaploader_v10.cab https://online.westpac.com.au/wtoa/wtOtherAccounts/portfoliomanagerwt.cab
–
system
December 11, 2008, 12:04pm
7
Further update:
I have managed to stop the autorun.inf cycle.
C:
If you do it quick enough (or in a batch file, or separate the steps with ^ (is that std)), then the worm doesn’t have a chance to clobber the dummy autorun.inf you create.
However, I obviously still have the worm. I also, cannot get system files to display in Folder Options (I have tried about 4 or 5 “regedit” fixes, none of which work).
system
December 11, 2008, 12:50pm
8
A final update before I go to bed - A google search for 6fnlpetp returns a few hits in Polish, and one in Vietnamese, but unfortunately nothing in English.
My head hurts… Thanks in advance to anyone who is looking at this to try and help me.
system
December 11, 2008, 1:17pm
9
I know I said I was going to bed…
Here is a list of all the hidden files in my windows\system32 folder - Some are very questionable
9B9892CFA4.sys
any ideas what vamsoft.exe is???
Upload this and any other suspicious file to www.virustotal.com and post back the link of the results.
system
December 11, 2008, 7:56pm
11
Fixed!
But I am sorry, in a fit of desperation, I lost vamsoft.exe and vbsdfe0.dll - I was trying to quarantine them (I was in safe mode, and got an error trying to put them in quarantine) - but they were gone after that. The good news was that after the next reboot, I got control of my system back.
I still had to manually set:
My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue = 1
with regedit, to get all of that correct. (Thought I may as well put up what I did so anyone else can see it).
I also created an “autorun.inf” directory on each of my USB pendrives / thumbdrives (each with a subdirectory).
Autoruneater has been quiet again ever since I did all of that.
Thanks to everyone who looked at / thought about my problem, especially Jtaylor83 and Tech. I ended up getting on top of it by reading through the forums, and google searching, and I must say, I now know a LOT more about my computer and how it works than I did 24 hours ago!!!
system
December 11, 2008, 8:09pm
12
Welcome to the forums, demeester.
I was typing the below when you last posted. I am glad you got it fixed. Read the below for information and it still would not be a bad idea to run MBAM.
vamsoft.exe was easy enough to find using a ScanDoo/google search.
http://g.s.scandoo.com/search?hl=en&meta=on&q=vamsoft.exe
Information from a few of the search results can be found at the links below :
Prevx:http://www.prevx.com/filenames/X1811314716733461838-0/VAMSOFT2EEXE.html
ThreatExpert:http://www.threatexpert.com/report.aspx?md5=1b1de635c3a88e23c35ffa339644de4d
VamSoft says it is a spam agent in the link below:http://blog.vamsoft.com/?m=200701
This one … vbsdfe0.dll … is a part of VamSoft.
IMHO, the one below is highly suspect since there are no results:
9B9892CFA4.syshttp://g.s.scandoo.com/search?hl=en&q=9B9892CFA4.sys&btnG=Search
This one … ezsidmv.dat … could be an email contact list stealer. Probably part of VamSoft.http://g.s.scandoo.com/search?hl=en&q=ezsidmv.dat&btnG=Search
This one … KGyGaAvL.sys … belongs to DIVX video sustem.http://www.bleepingcomputer.com/filedb/kgygaavl.sys-8527.html
This one … vsconfig.xml … should be a part od ZoneAlarm firewall. Is that the firewall you use?
I suggest you use malwarebytes antimalware. Download from the link below, update it, and then run.
http://www.malwarebytes.org/mbam.php
Thanks to everyone who looked at / thought about my problem, especially Jtaylor83 and Tech. I ended up getting on top of it by reading through the forums, and google searching, and I must say, I now know a LOT more about my computer and how it works than I did 24 hours ago!!!
You’re welcome. Feel free to come back any time you need help or just to change experiences 8)
system
December 19, 2008, 11:10am
14
CharleyO, we (at Vamsoft) never released any file called vamsoft.exe or vbsdfe0.dll. Also, all our officially binaries are digitally signed (except for .NET ones). Our installers do not copy program binaries to System32 either, so I am confident these files are not related to any of our products. Unless, well, someone intentionally renamed the files, but I do not see how that would be fun
system
December 20, 2008, 9:35am
15
hi Peter -
Thanks for posting. I was only giving the information from research. I am sorry if I posted the wrong information and thankful for your correction.
Yes, it is certainly possible some malcreant modified/renamed your files. They do not do this kind of thing for fun but instead to gather information for malicious reasons.
