HIdden Virus Rootkit

[merlinza]

Hi I am having a problem with a virus that I can not detect with the latest build Kaspersky 2009 8.0.0.506 (a,b) and virus databse update 2009/06/19 02:21:00PM and I have XP service pack3

I have spoken to kaspersky admin and they have referred me to this site with their instructions.

The symptoms are as follow.

1. The mixer device dissappear when the windows firewall is disabled.
2. When the firewall is enabled the mixer/sound does not disappear.
3. I insert my 3G usb modem, it allocates a drive letter and then disappears again. This does not happen with normal USB sticks.
4. Computer is slower than usual.
5. Kaspersky does not detect anything.

on number 3 - I had a problem with a rootkit virus before which caused my usb-modem not to work and also disabled my disk management service and added ovstf**** entries in my registry. I removed the rootkit with AVG-Antirootkit. After this I removed AVG and purchased KAspersky.
THe disk management service is working now.

The AVPtool_syscheck is attached.

I am on a Wirless Network, other members of the network tipped that their Avira Antivirus ID's these symptoms as being part of the NUCRP-4 Virus.

Any Help will be appreciated.

Regards

Merlin

[Rene-gad]

Uninstall:
- DAP (Download accelerator Plus)
- AskBar.

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- Execute following script in Manual Cure

begin
SetAVZPMStatus(True);
RebootWindows(true);
end.

- Remove Bonjour
- Repeat a log file.

[merlinza]

Hi Rene-gad

Thnkas fir the quick reply.

Here is the new log file

[Rene-gad]

It's not necessary to rename the log files.

- Execute following script in Manual Cure

begin
 QuarantineFile('C:\WINDOWS\system32\DRIVERS\axskbus.sys','');
 ExecuteRepair(13);
end.

Execute following script in Manual Cure

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool cleanmgr or CCleaner or ClearProg
- Upload the C:\quarantine.zip over the link Upload quarantined files on the top of this page.

[merlinza]

How do I clean "Temp-Maps"

Добавлено через 10 минут

Hmmmm, The file does not seem to be there. The quarantine file is also empty.

Добавлено через 10 часов 34 минуты

Hidden rootkit not resolved yet

Добавлено через 9 минут

HI all my problems are still there.

THe issue with the sound, firewall and the disabling of my usb 3g modem.

Can anybody please assist?

[Rene-gad]

How do I clean "Temp-Maps"

Use the linked tools.

The file does not seem to be there. The quarantine file is also empty.

OK, the file seems to be in the trust base of AVZ

Hidden rootkit not resolved yet

It's not critical

HI all my problems are still there.

It is just possible, that your problem has nothing common with viral issues.

[merlinza]

The problems I hav is defineatly viral. Just downloaded the free version of Avira

IT FOUND HIDDEN REGISTRY KEYS WHICH KASPERSKY MISSED!
HKEY_LOCAL_MACHINE\System\Controlset001\Services\o vfsthxegqemdlv\main is just one of 8 hidden objects.

HOw is it possible that KASPERSKY misses it.

[Rene-gad]

Just downloaded the free version of Avira

Don't set 2 AV-programs simultaneously!!! It's dangerous

IT FOUND HIDDEN REGISTRY KEYS WHICH KASPERSKY MISSED!
HOw is it possible that KASPERSKY misses it.

1. Not all the AVs can scan registry in-depth; each AV scanner has his own engline.
If you'll use e.g. Malwarebytes Antimalware - you'll find a couple of threats more...
2. If there are only registry entries without files - they are from the nature harmless.
3. Installed AV could be compromised from malware side and cannot detect any malcious item.

[merlinza]

So avira is better than Kaspersky because it can scan deeper.

I am dissappointed

[Rene-gad]

So avira is better than Kaspersky because it can scan deeper.

And e.g. Symantec is better as Avira for some definite kinds of malware, ClamWin is the best for AntiSpam... and so on.
The best Antivirus & Firewall was, is and will be Brain.exe
Read www.av-comparatives.org

[merlinza]

Why is it not a good idea to install 2 virus programms at the same time?

[Rene-gad]

Why is it not a good idea to install 2 virus programms at the same time?

because of reciprocative detection as a virus...