Several Trojans

[jgudiel99]

My laptop is very infected by trojans. I already ran several antivirus programs, as Symantec Antivirus Corporate Edition 9.0, MalwareBytes' Anti-Malware and Kaspersky Virus Removal. The last one found a lot of trojans than the others didn't catch and removed. However I found several intercepted processes in the manual cure option. Here you will find the results, I wan to know if everything is oK with my laptop now or if I need to follow several steps still. Please help me.Please, help me.Thanks, Julio

[ScratchyClaws]

Please read the rules here - http://virusinfo.info/showthread.php?t=9184 once again and upload your logs the right way

[jgudiel99]

Attached you will find the logs.

[drongo]

Execute this script in avz:

begin
Clearquarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\Documents and Settings\Drs.Cifuentes\Mis documentos\LimeWire\Saved\Beatles - P.S. I love you.mp3','');
 QuarantineFile('D:\Palm ChifLGCV\Hotsync.exe','');
 QuarantineFile('D:\Palm ChifLGCV\register.exe','');
 QuarantineFile('C:\WINDOWS\system32\explorer.exe','');
 QuarantineFile('C:\WINDOWS\system32\0136C0\6376A3.EXE','');
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys','');
BC_ImportAll;
BC_Activate;
RebootWindows(true);
end.

Upload the quarantine over the link Upload quarantined files on the top of this page.
Let us know, when you done.

[jgudiel99]

I already uploaded the quarantine files, but it was not password encrypted, because the winzip ask for an 8 characters password.

File saved as090313_004947_quarantine files_49b9837b421ce.zipFile size890068MD59603ed707a52e49b31db250134e9c63a

[drongo]

use avz- it will create password protected archive automatically
fssfltr_tdi.sys, Hotsync.exe_, register.exe_, you.mp3- are clean.
C:\WINDOWS\system32\0136C0\6376A3.EXE- please find this file with avz, i just wonder what is this.Perhaps it is just traces.

Добавлено через 2 минуты

Files that you did send us, are clean.
C:\WINDOWS\system32\0136C0\6376A3.EXE could you find it manually, read app#2 of rules

[jgudiel99]

The file you are requiring doesn't exist anymore. I remember it was into the script than you sent yesterday, but when I execute it, the Symantec antivirus detect a virus and deleted the file (I supposed than it deleted this file, because avz can not find it and manually I couldn' locate it to). The same happened with C:\WINDOWS\system32\explorer.exe, it doesn't exists anymore.

[drongo]

Before execution any script you should always disable antivirus.
Activate avzpm, ( you can do it by execution this script in avz:

begin
SetAVZPMStatus(true);
RebootWindows(true); 
end.

) and after restart do repeat avz logs.

[jgudiel99]

I know that for the future, but now these files doesn't exist. What else can we do?

[Rene-gad]

I know that for the future, but now these files doesn't exist.

What the files do you mean? Pls. read-an-do the post of drongo!!!

[jgudiel99]

here you will find the last avz log, after avzpm was activated.

Thx

[drongo]

Do remember deactivate your antivirus before lunching avz.( if you can't, uninstall it)
Execute this script in avz:

begin
Clearquarantine;
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('C:\WINDOWS\system32\explorer.exe','');
 QuarantineFile('C:\WINDOWS\system32\0136C0\6376A3.EXE','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Serial.SYS','');
BC_ImportAll;
BC_Activate;
RebootWindows(true);
end.

Upload the quarantine over the link Upload quarantined files on the top of this page.
Let us know, when you done.

[jgudiel99]

I disable the antivirus. The script was executed and the quarantined files was uploaded.

[Rene-gad]

There were only ini-files in archiv
Execute this script in avz:

begin
Clearquarantine;
 QuarantineFile('C:\WINDOWS\system32\explorer.exe','');
 QuarantineFile('C:\WINDOWS\system32\0136C0\6376A3.EXE','');
 QuarantineFile('C:\WINDOWS\System32\Drivers\Serial.SYS','');
end.

Upload the quarantine - if the *.dta files will be there - over the link Upload quarantined files on the top of this page.
Let us know, when you done

[jgudiel99]

The quarantine folder appears empty after running the script. The log of the script shows this:
Quarantine file: failed (error), attempt of direct disk reading (C:\WINDOWS\system32\explorer.exe)
Quarantine file (direct disk reading) "%S" - failed (error)
Quarantine file: failed (error), attempt of direct disk reading (C:\WINDOWS\system32\explorer.exe)
Quarantine file (direct disk reading) "%S" - failed (error)
Quarantine file: failed (error), attempt of direct disk reading (C:\WINDOWS\system32\0136C0\6376A3.EXE)
Quarantine file (direct disk reading) "%S" - failed (error)
Quarantine file: failed (error), attempt of direct disk reading (C:\WINDOWS\system32\0136C0\6376A3.EXE)
Quarantine file (direct disk reading) "%S" - failed (error)
File quarantined C:\WINDOWS\System32\Drivers\serial.sys

Supposedly the previous script generated 6 ini files and 2 dta files, that was uploaded, it was not just ini files...I will try to run it agan in safe mode.

Добавлено через 10 минут

Same result in safe mode. The quarantined folder is empty. As I told you the quarantined folder of the original script, contains 2 dta files submited, both dta files were created for serial.sys file, and it was posted together with the ini files.

[jgudiel99]

OK., guys, thanks for your help. I decided reformat my laptop, because it is taking too much time. Please close this case.

Thanks again.