Printable View
hi, my pc keeps crashing (especially when trying to upload this message!)
also i am getting fake scans and redirected IE pages.
some antivirus software is also crashing before completion (including AVZ)
GMER has ran and says that there are lots of GEYEK files in my registry but i cannot remove them using regedit or GMER.
here are the log files (excluding syscure which crashes)
1. Please, disable System Restore and antivirus (if you have).
2. Execute this script in avz or avptool:
[CODE]begin
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}');
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}');
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{360E40AA-EE8B-4101-BA67-0CAD3F7A48DD}');
RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{32FA9DC4-8CB0-4849-8A9A-D201F8B21EEE}');
ExecuteRepair(13);
RebootWindows(true);
end.[/CODE]
3. [URL="http://virusinfo.info/showthread.php?t=9206"]Fix in HijackThis:[/URL]
[QUOTE]O20 - Winlogon Notify: bYoLFxyW - C:\WINDOWS\[/QUOTE]
4. Attach a new logs to your new post.
I thought that winlogon entry looked suspect.
taken off now. and new logs posted.
also my version of AVZ does not have a Healing / Quarantine option in standard scripts
[QUOTE=Richard1;513887]also my version of AVZ does not have a Healing / Quarantine option in standard scripts[/QUOTE]It cannot be truth
[IMG]http://freenet-homepage.de/rene-gad/AVZ/AVZ5.jpg[/IMG]
Uninstall Ad-Aware
Close/disable all the applications excluded AVZ and Internet Explorer.
- Disconnect your PC from network (internet/intranet)
- Disable antivirus, firewall and other memory resident security tools
- Disable System Restore
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
StopService('MEMSWEEP2');
QuarantineFile('C:\WINDOWS\system32\10D.tmp','');
DeleteFile('C:\WINDOWS\system32\10D.tmp');
DeleteFileMask('C:\WINDOWS\system32','*.tmp',false);
DeleteService('MEMSWEEP2');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
BC_DeleteSvc('MEMSWEEP2');
SetAVZPMStatus(True);
RebootWindows(true);
end.[/CODE]
[COLOR="Red"]If the system after reboot would try to install any unknown hardware, abort the installtion and remove unknown hardware over hardware manager[/COLOR]
After reboot:
[URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]
- Remove [URL="http://virusinfo.info/showthread.php?t=42263"]Bonjour[/URL]
- AVZ/Service/Hosts file manager, remove all the strings after 127.0.0.1 localhost
[IMG]http://freenet-homepage.de/rene-gad/AVZ/hostd.jpg[/IMG]
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Make new logs and attach them to the new posting.
Think about upgrading of your antivirus solution, version from 2006 is obsolte just since 2 years.
Hi, my third option on standard scripts (AVZ) 9s Advanced system analysis with Malware removal enabled (which is probably the same thing)
I still cannot complete a scan with this enabled though as it crashes when scanning the disks. an advanced scan works fine (log attached)
Is there anyway to remove the host file manager strings in bulk as i have around 7000 entries and it is hurting my hand to manually remove all of them.
also i was wondering what Anti-Virus program you would recommend? (the cheaper the better)
also i cannot see the upload Quarantine files link? (all the top links are in Russian)
[QUOTE=Richard1;514786]Advanced system analysis with Malware removal enabled (which is probably the same thing)[/QUOTE]Sorry, you're right, I didn't really know, that the name of the script was changed in the last version :O
[QUOTE]I still cannot complete a scan with this enabled though as it crashes when scanning the disks. [/QUOTE]
Are your resident applications (antivirus, firewall etc. )disabled?
[QUOTE]Is there anyway to remove the host file manager strings in bulk as i have around 7000 entries and it is hurting my hand to manually remove all of them.[/QUOTE]
[url]http://virusinfo.info/showthread.php?t=61042[/url]
[QUOTE]also i was wondering what Anti-Virus program you would recommend? (the cheaper the better)[/QUOTE]
[url]www.av-comparatives.org[/url], prices for the most good AVs are about 30,- EUR for 1 year, some vendors make good options for more PCs or more time, some vendors make a discount by license prolongation. To choose any one AV you have to test some of them and choose the best for your system.
[QUOTE]also i cannot see the upload Quarantine files link? (all the top links are in Russian)[/QUOTE]This is it: [url]http://virusinfo.info/upload_virus_eng.php?tid=60810[/url] Unfortunately I cannot give you further recommendations or scripts before we'll see the quarantined files.
PS: Switch to English interface : [url]http://virusinfo.info/index.php?page=homeeng&langid=1[/url]
OK host files removed.
Yes as far as i am aware my anti-virus is disabled, although My Norton displays an error on auto protect but i cannot turn it on (so i assume it is off)
with removing all my automatic protection and removing the host files am i now more vulnerable as i have had several things on my machine today SDR64 and some other trojans, and they all seem to be installing via command prompt (cmd.exe)
and how do you feel about AVG or ad-aware as a anti-virus solution?
Quarantined zip is now uploaded.
[QUOTE=Richard1;515094]OK host files removed[/QUOTE]removed? or cleaned?
[QUOTE]with removing all my automatic protection and removing the host files am i now more vulnerable as i have had several things on my machine today SDR64 and some other trojans, and they all seem to be installing via command prompt[/QUOTE]I suppose, this malware was on your PC just before you'd disable antivirus and clean hosts file. Try to remove antivirus and make 3 log files. This could be done offline. It were perfect, if you could disconnect your PC from internet/intranet and communicate with us over another PC or other OS (e.g. Linux)
[QUOTE]and how do you feel about AVG or ad-aware as a anti-virus solution?[/QUOTE]I'm not sure, esp. about Ad-Aware: it's absolutely useless thing.
host files removed.
will try Norton removal and scan off-line shortly.
[QUOTE=Richard1;515265]host files removed.[/QUOTE]Do you mean: IP- addresses? I'd like to look at your logs.
above you told me to remove all strings after 127.0.0.1 localhost
this is what i did using hijackthis. (removed 12000 entries all seem to be potentially harmful web-addresses)
I have now removed all Norton products (using norton removal tool) and the AVZ scan still crashes.
It always crashes at the same point, C:\Documents and Settings\rich\Local Settings\Temporary Internet Files\Content.IE5
and the last thing shown on the scanner is a direct scan of a .tmp file in the temp folder.
as i cannot run this scan i cannot provide you with the log you require.
(message sent from alternate pc)
OK, make the logs syscheck and hijackthis.
Make a log of [URL="http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button"]Malwarebytes Antimalware[/URL] too, but don't remove anything!
[QUOTE=Rene-gad;515789]OK, make the logs syscheck and hijackthis.
Make a log of [URL="http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button"]Malwarebytes Antimalware[/URL] too, but don't remove anything![/QUOTE]
sorry but at the time of receiving your last response i had already ran a malwarebytes scan and a spybot S&D scan both found two trojans and six entries and they were removed. I have done a Malwarebytes scan again and include both logs. (plus hijackthis & AVZ)
i will not remove anything from now on without your say so :(
what do you feel about AVZguard and drweb cureitall?
MBAM found some not-critical things, registry have you just cleaned ;)
Try to make a check with it: [url]http://www.freedrweb.com/livecd/?lng=en[/url]
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
TerminateProcessByName('\Device\HarddiskVolume3\DOCUME~1\Richard\LOCALS~1\temp\dc01367163\25e9kxp.exe');
QuarantineFile('\Device\HarddiskVolume3\DOCUME~1\Richard\LOCALS~1\temp\dc01367163\25e9kxp.exe','');
DeleteFile('\Device\HarddiskVolume3\DOCUME~1\Richard\LOCALS~1\temp\dc01367163\25e9kxp.exe');
DeleteFileMask('\Device\HarddiskVolume3\DOCUME~1\Richard\LOCALS~1\temp','*.*',true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.[/CODE]
After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]
- Upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Make and attach new logs to your new post..
ok, i have ran drwebb and it saved a CSV file it provided after scan (i did not remove items) but i cannot upload csv files so here is the text
[FONT=Arial][SIZE=2]SopAdver.exe; C: \ Documents and Settings \ Richard \ Application Data \ SopCast \ adv; Adware.Sopcast;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]SetupCasino.exe; C: \ Documents and Settings \ Richard \ Desktop \ Casi; Probably DLOADER.Trojan;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]Process.exe; C: \ Documents and Settings \ Richard \ Desktop \ SDFix \ apps; Tool.Prockill;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]Process.exe; C: \ Documents and Settings \ Richard \ Desktop \ SmitfraudFix; Tool.Prockill;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]restart.exe; C: \ Documents and Settings \ Richard \ Desktop \ SmitfraudFix; Tool.ShutDown.14;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]pv.exe; C: \ Program Files \ LittlewoodsCasino; Program.PrcView.3725;;[/SIZE][/FONT][FONT=Arial][SIZE=2]bet365casino setup.exe; [/SIZE][/FONT]
[FONT=Arial][SIZE=2]C: \ WINDOWS; Adware.Casino;;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]atapi.sys; C: \ WINDOWS \ SYSTEM32 \ DRIVERS; BackDoor.Tdss.1133; Cured.;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]atapi.sys; C: \ WINDOWS \ SYSTEM32 \ DRIVERS; BackDoor.Tdss.1133; Cured.;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]atapi.sys; C: \ WINDOWS \ SYSTEM32 \ DRIVERS; BackDoor.Tdss.1133; Cured.;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]atapi.sys; C: \ WINDOWS \ SYSTEM32 \ DRIVERS; BackDoor.Tdss.1133; Cured.;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]atapi.sys; C: \ WINDOWS \ SYSTEM32 \ DRIVERS; BackDoor.Tdss.1133; Cured.;[/SIZE][/FONT]
[FONT=Arial][SIZE=2]vjocx.dll; C: \ WINDOWS \ SYSTEM32 \ nagasoft; Probably DLOADER.Trojan;;[/SIZE][/FONT]
[QUOTE]C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys[/QUOTE]If Dr.Web cannot heal this file, you have to replace it over recovery console: [url]http://support.microsoft.com/kb/314058[/url]
If you'll use Windows CD you have to log in in recovery console.
Put the commands as follow (Enter-Key after each string! Instead of X: set a letter for CD-ROM-Drive with Windows CD )
[CODE]cd X:\i386
dir atapi.*[/CODE]
If the file has an extension SYS, you can copy it to C:\WINDOWS\SYSTEM32\DRIVERS\ directly:
[CODE]copy X:\i386\atapi.sys C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[/CODE]
If the file has an extension SY_, you have to extract it:
[CODE]expand X:\i386\atapi.sy_ C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[/CODE]
You could take this file from any clean system, which is similar to your's one (the same Service Pack is important!!!) one
The other files which had been found you could ignore.
I copied atapi.sys from a clean system and then it (drwebb) found a problem with atapi.sys.tmp
i have since run some scans in safe mode (including mbam; not removed, hijackthis and a command line scanner from AVG9)
there are lots of problems on mbam and obvious spyware in hijackthis as well
Remove all items were found from MBAM (MBAM can remove them).
Make all the temp-maps empty (CCleaner).
Make all the log files according the rules in NORMAL MODE
[QUOTE](drwebb) found a problem with atapi.sys.tmp[/QUOTE]This file can be removed.
mbam finds nothing now.
scan logs included.
but geyek (rootkit) registry files still present in gmer.
[URL="http://virusinfo.info/showpost.php?p=512824&postcount=2"]Execute commands[/URL] in GMER:
[CODE]gmer.exe -del reg "HKLM\SYSTEM\ControlSet001\Services\UACd.sys"
gmer.exe -del reg "HKLM\SYSTEM\ControlSet001\Services\geyekruhylkjba"
gmer.exe -del file "c:\windows\system32\geyekrwsp.dll"
gmer.exe -del file "c:\windows\system32\drivers\geyekritbijhgt.sys"
gmer.exe -del file "c:\windows\system32\geyekrkeamnksq.dll"
gmer.exe -del file "c:\windows\system32\geyekrgakftpvx.dat"
gmer.exe -del file "c:\windows\system32\geyekrogjdwwxm.dll"
gmer.exe -del file "c:\windows\system32\geyekrhflbyggi.dat"
gmer.exe -del file "C:\DOCUME~1\Richard\LOCALS~1\Temp\geyekrtixtbqftih.tmp"
gmer.exe -reboot[/CODE]
After reboot repeat 3 the logs acc. to the rules + gmer.