PDA

Просмотр полной версии : Infection in network 2



copperray
28.04.2007, 18:26
I will reinstall AVG antispy because it also gets no connection to its server only with deleting the rules.

I will continue with the 2nd PC. It's WinXP SP2. AVG-Free report 2 changes:
ntoskrnl.exe and user32.dll.
Escan and DrWeb did not mention this. Here the attached files.

Updated AVG also reports changed boot sector!

drongo
28.04.2007, 18:55
Please run AVZ, go to File - Custom scripts, copy the Code, paste it to Custom scripts window and Run the script.




begin
QuarantineFile('C:\WINDOWS\system32\LIBEAY32_0.9.6 l.dll','');
QuarantineFile('C:\Programme\Topfield to DVD\Mpeg2Schnitt\Muxen\IfoEdit\Run_IfoEdit.exe','' );
end.

After that please upload quarantined file(s) according to the Rules.( http://virusinfo.info/upload_virus.php?tid=9362)

About ntoskrnl.exe and user32.dll.- can you be more specific ? what avg told you about them ? Can you copy and archive (using winzip )them with password virus and upload to us using the link :http://virusinfo.info/upload_virus.php?tid=9362

copperray
28.04.2007, 20:15
ok. This was done.
The attached image shows what AVG tells me. Previous scan showed also 'Boot sector C: change'

NickGolovko
28.04.2007, 20:32
I'd like to note that it is not necessary a virus problem. AVG can show this after a Windows update, for example.

Rene-gad
28.04.2007, 20:42
Previous scan showed also 'Boot sector C: change'
These sentences are not really significant. My NOD found nothing in your files, the upload at virusinfo is queued now; it could take some more time, as usual because of WE.
BTW: It's not correct, to upload the files itself. Pls. use for quarantining only the scripts from helper. If a helper forget to give you one, pls. remind him here.
PS: You have a PM :).

drongo
28.04.2007, 23:56
Answer from vir.lab Kaspersky :


Hello.

No malicious software was found in the attached file.
-----------------
Regards, Roman Gavrilchenko
Virus Analyst, Kaspersky Lab.

copperray
01.05.2007, 12:59
That's very good. The problems are less than expected. I scanned also from an OS on live-CD and did not find any problem. But for the future I will kepp this under investigation.
For my 3rd PC I found infection in the programs REG1stAid and SPYBOT. I decided to make a new installation in order to profit from a virgin system. Data are on a 2nd drive and clean!
So, for the moment I thank all kindly helpers and I hope not to come back with new problems.

drongo
01.05.2007, 13:26
You are welcome :) Anytime!
You are the first user in our english section.I just wonder, how did you find our site ?

copperray
02.05.2007, 11:03
I have to thank Rene-gad. He refered me to AVZ4.