Over 1 million tech questions and answers.

Win32/Cryptor, Win32/Heur, Win32/PolyCrypt

Q: Win32/Cryptor, Win32/Heur, Win32/PolyCrypt

Hi There,
As you can see by my thread title, I've been infected with a bunch of things. I ran an AVG scan and it ended up showing 19 different threats. Aside from these viruses, trojans called BackDoor.Generic11.HUH,SHeur2.ADCYs and Vundo.GK were also on the list. The 19 items were moved to the vault and the computer restarted.

Upon restarting, there is a wallpaper that is from the virus saying my computer has been infected and that I should clean it.

In the system tray there is a red circle with a white 'X' in it. Every minute or so during the AVG scan it would pop-up and say I had a virus and I should use spyware cleaners to clean it.

Opening My Computer etc is very slow and I can not update my AVG definitions. Just after completing a HJT scan I recieved the dreaded blue screen that said 'A threard tried to release a resource it did not own'.

I have included below my HJT log. If you could provide me with any assistance I would greatly appreciate it. I have the latest AVG Free and have no idea how I got so badly infected. I considered a format, but I have not backed-up in a while. Is there a way to recover my data?

I am sorry for the lengthy response. I wanted to provide you with as much detail as possible.

Thanks for all your help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:40:10 AM, on 4/29/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Dell\QuickSet\Quickset.exe
C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\WinGUI32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\system32\ctfmon.exe
E:\LaunchU3.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=...e.com/default.aspx&lc=1033&id=64855&mkt=en-US
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [WD Drive Manager] C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Win GUI Builder] WinGUI32.exe
O4 - HKLM\..\Run: [UVS11 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,[email protected]
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\LOCALS~1\protect.dll,[email protected]
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: ChkDisk.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\temp\ntdll64.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235972985890
O17 - HKLM\System\CCS\Services\Tcpip\..\{E72D34BF-D0F8-4887-A00F-732ABD3D7F25}: NameServer = 192.168.1.254,192.168.1.253
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: __c00B181F - C:\WINDOWS\system32\__c00B181F.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 10375 bytes

RELEVANCY SCORE 200
Preferred Solution: Win32/Cryptor, Win32/Heur, Win32/PolyCrypt

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: Win32/Cryptor, Win32/Heur, Win32/PolyCrypt

Read other 8 answers
RELEVANCY SCORE 162.8

AVG has reported the following infections:Trojan Horse Generic11.AQFN - several instancesTrojan Horse Generic13.XWVTrojan Horse Pakes.DIEWin32/HeurWin32/PolycryptMost applications close after a few minutes unexpectedly. Firefox, Word, AVG User Interface. The AVG User Interface closes but the scanner will keep running in the background. Zone Alarm disappears from the system tray a few minutes after opening. Since my browser won't stay open for more than two minutes at a time I'll be communication from my other computer using the browser on the Active Disk CD. This computer is also infected but we'll save that for another day. Here is the HijackThis Log. Please let me know what other information you may need.Thanks in advance,ChrisLogfile of Trend Micro HijackThis v2.0.2Scan saved at 9:07:49 AM, on 4/18/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16827)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Java\jre6\bin... Read more

A:Win32/heur, Win32/Polycrypt, Trojan Horse Pakes.DIE, and generics

Hello! My name is Sam and I will be helping you. In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.You'll need to find a way to transfer these programs over to the infected computer to run them and then transfer the logs back so that you can post them here.We need to create an OTListIt2 ReportPlease download OTListIt2 from hereSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.Push the "Run Scan" button.The scan should take just a few minutes.Copy the log that opens up and paste it back here in your next reply.=============The next log will show us any hidden files that are present.Download GMER from here:Unzip it to the desktop.Open the program and click on the Rootkit tab.Make sure all the boxes on the right of the screen are checked, EXCEPT for ?Show All?.Click on Scan.When the scan has run click Copy and paste the results (if any) into this thread.

Read other 30 answers
RELEVANCY SCORE 154.4

I have a bad situation with my ASUS eee netbook that I'm afraid I've made worse by mucking around in files I don't understand, following different sets of directions i found on the interweb. An EPICLY Bad Idea. I know. SIGH.I hope you can help, kind soul. Windows Police Pro keeps popping up, even though I went to Task Manager and stopped it and then erased it in Add or Remove Programs under the Control Panel. I think I removed Advanced Anti-Virus too, but am not sure. When I go online I'm getting many pop-ups, an insane number. Internet Explorer opened itself when I opened Google Chrome and has set up 16 windows-- some are Windows Anti Virus Pro and a few of this: hxxp://media2.tmlatn.com/images/defaults41/approved/404.html Often the pop-up relate to things I have browsed, yep. I'm getting a TON of fake malware stoppers telling me I need their product.Sometimes the whole system freezes up, I have shut it off with the power switch several times. I have installed several Malware busters in an effort to scour my system, but they may be making it worse at this point, or maybe I downloaded a bogus one. MalwareBytes won't even run anymore. I also have Spybot and HijackThis trying to help me out. I have AVG and have run full computer scans -- each time it finds a few problems. Some of the items in the virus vault have been Win32/Cryptor, Win32/Heur, many many Trojans, including something called Rootkit-AgentDX.I did follow all the prep steps to post here, but my firewall ... Read more

A:Windows Police Pro, Win32/Cryptor, Win32/Heur, rootkit, trojans, a real mess

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 10 answers
RELEVANCY SCORE 141.6

Yes, my computer has been running AWFULLY slow for about a year now. Ive got a few virus scanners/protection programs: AVG, Ad-Aware, Malware Bytes- Anti Malware, and Hijack This. My Norton expired ages ago. I have run a good few scans with each of these and deleted viruses/malware that AVG, Ad-Aware and Malware Bytes- AM have found, except from a couple of viruses that AVG has held in the virus vault. These viruses are entitled: Win32\Heur and Win32\Cryptor. The paths to each of these are: C:\WINDOWS\SYSTEM32\86k.dll and C:\Documents and Settings\user_name\Application Data\svchost.exe I'm not sure if i should get rid of them because one is a link library and the other is an executable file, and I'm especially unsure about this one since svchost is a service runner.I've also recently killed a process in process explorer called "AAAAMONd.exe" which was running another svchost.exe for which the company name was a bunch of random letters and the same with the descriptionAnother symptom is the classic "pop-up symptom" where when i visit a site on iexplorer, it comes up sites such as "best anti-virus removal software" and the URL is nothing like the one i have typed...whenever this happens, the warning window of AVG pops up and i then disconnect my internet so as to not recieve any "gifts". Apologies for the length of this post, but i read the "Preparation Guide" and it said that the mor... Read more

A:AVG quarantined win32/Heur and Win32/Cryptor. Malware Bytes picked up more malware.

Hello! My name is Sam and I will be helping you. In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.We need to create an OTListIt2 ReportPlease download OTListIt2 from hereSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.Push the "Run Scan" button.The scan should take just a few minutes.Copy the log that opens up and paste it back here in your next reply.

Read other 12 answers
RELEVANCY SCORE 129.2

Here is my Hijackthis log, please tell me what to do from this point!!! I cant even get my homework done because of all the pop ups!!! Please Help ASAP!!!

A:BankerFox.A, Win32/PolyCrypt, and Win32/Nuquel.E!

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructio... Read more

Read other 2 answers
RELEVANCY SCORE 128.8

Hello, Ive been fowarded from Bronis care(Security > Am I infected? What do I do? forum) as stated "...at this point some more advanced tools (not allowed in this forum) will be needed to clean up your computer.
With the information you have provided I believe you will need help from the malware removal team."

thread link
http://www.bleepingcomputer.com/forums/topic417272.html

I dont know the name of the infection but Spybot found Win32.AVKillsvc.e which it keeps fixing & keeps showing back up.
AVG cannot be accessed or found but did just previously find Trojan Horse Backdoor.Generic.UFQ & Win32\Cryptor. There was also a popup of something like- "Microsoft Feeds Update needed" or something? and there was a message something like- "Windows is not your operating program"?

I couldnt connect to internet (wireless) but Broni seems to have sorted that out so now I am able to but GMER(which did fully scan with Broni, using UBB flash for download) now cuts out. I was able to stop & copy the scan before the cut point & will include that log which may be incomplete (see previous full scan log posted on previous thread) Other logs also posted on that thread may be helpful.
Thanks in advance for trying to get me through this part! Cat

Here is the DDS:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.13
Run by Owner at 23:27:46 on 2011-09-05
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.95... Read more

A:fwd from Broni- nasty rootkit! Win32.AVKillsvc.e - Rootkit.Win32.ZAccess.e - Win32\Cryptor

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.Run Combofix:You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<Combofix may need to reboot your computer more than once to do its job this is normal.You can download Combofix from one of these links.Link 1Link 2Link 3 1. Close any open browsers or any other programs that are open.2. Close/disable all anti virus and anti malware programs so they do not interfere with the r... Read more

Read other 43 answers
RELEVANCY SCORE 128.4

My Avast antivirus recently started detecting a whole host of viruses. I ran a thorough scan of all files and deleted every infected file until the scanner turned up a hit in the operating memory. It then suggested I run a boot sector scan - I did so. Upon rebooting Avast started detecting more viruses. This time I rebooted into Safe Mode and ran the scanner there, deleting everything I found. Apparently one of the files I deleted was important, because after that my computer Blue-Screened during boot-up and I had to do a system restore to a save point from a few days ago (before the virus was contracted). Since then the virus has continued to crop up, and I haven't the foggiest notion of how to get rid of it.

The title is a list of the virus descriptions that my Avast scanner gave me. I ran all the programs the walkthrough on this site instructed me to, but the RootRepeal program crashed and generated an error message and crash report, both attached (error message in .png image format - I took a screenshot of it).

Thanks for your help!

__________________________________________________________________________________
DDS (Ver_09-12-01.01) - NTFSx86
Run by Bryan at 18:56:06.09 on Wed 12/02/2009
Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_17
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3070.1546 [GMT -5:00]
============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32&... Read more

A:Infected with js: downloader-FT Win32:Banload-GLR Win32:Malware-gen Win32:Refpron-AW Win32:Rootkit-gen Win32:VB-NWC

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 3 answers
RELEVANCY SCORE 127.6

A few days ago the Win32 Heur was showing up on my AVG8 Free software. It is also coming up with a trojan horse rootkit-pakes. Today I done a scan on spybot and it failed to remove Win32.fraudload.net, Win32.TDSS.rtk & Win32.TDSS.reg. In addition to that I read on a forum to download Registry Easy and I done a scan and fix thru that. It stated all the relivant issues had been resolved. But as I mentioned Spybot comes up with those 3 Trojans still. So I have these 5 issues, there is probably more. But I would appreciate if you can help.

Here is a copy of my log HiJackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:49:42, on 31/08/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Spare Messaging\MessagingApp.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\CyberLink\PCM4Everio\EverioService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome... Read more

Read other answers
RELEVANCY SCORE 124.8

Hi guys need some urgent help....i have AVG 8.5.427 free edition installed on my system ,wherein the operating system is Windows XP Profesional .....i ran a scan on my system and the scan reported Trojan Horse Generic11.ATHC and the resident shield log reported the remaining viruses(Worm/Downadup,Win32/Virut,Win32/Cryptor).I deleted the corresponding folders but still the system is very slow.It would be of immense help if anybody could provide expert advice on this matter.I am providing the hijackthis log herewithLogfile of Trend Micro HijackThis v2.0.2[/u][/u]Scan saved at 4:18:32 PM, on 12/21/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\Explorer.EXEC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\CleanMyPC\Registry Cleaner\RCHelper.exeC:\WINDOWS\system3... Read more

A:Infected with Trojan horse generic11,Worm/Downadup,Win32/Virut,Win32/Cryptor

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until ... Read more

Read other 3 answers
RELEVANCY SCORE 123.2

Hi,Please help me in getting rid of the pop ups which keep coming up.trojan downloader win32 agent bqtrojan clicker win32 tiny htrojan spy win32 key logger.aatrojan spy win32 green screentrojan spy html bankfraud.dqHijakThis log file.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 15:00:40, on 9/8/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16705)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Hewlett-Pac... Read more

A:Infected With Trojan Clicker Win32 Tiny.h / Downloader Win32 Agent Bq / Spy Win32 Key Logger.aa/spy Win32 Green Screen / Html B...

Sorry for the delay. If you are still having problems please post a brand new HijackThis log as a reply to this topic. Before posting the log, please make sure you follow all the steps found in this topic:Preparation Guide For Use Before Posting A Hijackthis LogPlease also post the problems you are having.

Read other 1 answers
RELEVANCY SCORE 123.2

hello. sorry about this mess. im afraid i dont really know what im doing. my nephew asked me to help get rid of a red circle with a white cross telling him he had spyware but its turned into something much worse. he only used windows firewall and nothing else saying he only uses world of warcraft and msn and music and doesnt surf the web!! i tried to scan with avg but it was aborted and the windows firewall was continually turned off no matter how many times i put it on. tried other antivirus progs but all were turned off. eventually i managed to do online scan on microsoft safety centre and deleted quite a few v high threat trojans but many unable to clean. i also ran sophos rootkit and nearly gave myself a heart attack - 938 hidden things that recommend not to clean. i resorted to you now. i followed the tutorial for posting hijack this and here are the resultskaspersky report for critical areas--------------------------------------------------------------------------------KASPERSKY ONLINE SCANNER 7 REPORT Saturday, November 29, 2008 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, November 29, 2008 12:40:36 Records in database: 1426420--------------------------------------------------------------------------------Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yesScan area - Critical Areas: C:\Do... Read more

A:win32/alureon.gen, win32/Eldycow.en!A, win32/Small, win32/Olmafik, winNT/Xantvi.gen!A, Trojan-Game Thief and more

i think i have sorted this. i ran SDFix which cleaned up enough for me to install antivirus. avast caught lots of trojans and i have now been able to onlinescan and spybot s/d etc. all logs now coming back clean so can u delete this post please

Read other 3 answers
RELEVANCY SCORE 122.8

Hi guys, recently i downloaded an .exe game which had malware on it. As soon as i ran the program i was bombarded with warning/notices saying i have the win32/heur, win32/virut and many other trojans. I closed all programs and immediatly ran avg 8.5 scan. It detected 276 infected files. It healed many files but 46 weren't healed. These were either win32/heur or win32/virut. The next day i installed malwarebytes anti malware and spybot search and destroy. I ran both these scans AND the avg scan. They all detected different threats and were removed but win32/heur and virut remain. I rebooted my pc and avg did an automatic scan before i got to the desktop. Meaning i didn't get to my desktop yet avg was running a scan. When i was able to go into my desktop the taskbar and desktop icons were missing. I was only able to use m pc via taskmanager. Now i still have the 46 infected files which cant be removed and my taskbar and desktop icons were gone. I tried to run explorer.exe but it ddnt work because "system cannot locate file" please help!!

The 46 infected files are windows32 files. Probably registry files so it cant be removed. I have winxp and atg 8.5. +malwarebytes and spybot

A:Hardest problem - Computer infected with Win32/heur and win32/virut

Hi,

I would like to first confirm if you do in fact, have virut.

Please do the following:
Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
c:\windows\system32\userinit.exe

Click on the Upload button
If a pop-up appears saying the file has been scanned already, please select the ReScan button.
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

Please do the same for the following files:
c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\windows\system32\spoolsv.exe


NEXT


We would be grateful if you could assist us in our research into this infection by providing us with some samples and information from your machine. This will only take a minute or two to complete, and is very simple. If you wish to help us, please do the following:Download VAPrep.bat and save it to your Desktop.
Double-click VAPrep.bat to run it. It will only take a moment to complete.
When done, please right-click the VAPrep folder which should now be on your Desktop. Select Send To >> Compressed (zipped) Folder.
Next, please go to this webpage.
Browse to the VAPrep.zip zipped folder you just created.
Click Send File.
Once d... Read more

Read other 4 answers
RELEVANCY SCORE 122.8

Hello,My computer became infected last night, and It's pretty bad. I became infected with Infected: Trojan:Win32/Alureon.BT, Win32:Jifas-CY, and the others listed (maybe more). Long story short, I'd just watched Harry Potter on dvd, and logged onto the computer to see who he married in the end. I ended up at a Harry Potter encyclipdiea website, and looked it up. Avast went nuts after a few minutes, and showed 4 different virus alerts, and Windows Defender showed 1 as well after I shut down.The virus listed by Defender was Trojan:Win32/Alureon.BT. Avast listed Win32:Jifas-CY, I didn't get the others in time.The last 2 I listed in the title, a "security center alert" claimed it detected these programs trying to acess the internet. It listed one more, but I didn't get it's name in time.I know Alureon is a downloader and backdoor for other viruses, and it basically shuts down security systems, which it's trying to do since windows now thinks I have no anti-virus installed.All of these trojans are listed as "server" and "high risk." I'm not sure a root kit didn't try to make it's way in too.EDIT: I wanted to add a few things in. First, I have XP SP3 set up with multiple accouts, one admin "owner" account and then 1 limited access "user" account. The Viruses came in while the user account was logged on (I am not dumb enough to connect to the internet with an admin account). It seems the Viruses we... Read more

A:Infected: Trojan:Win32/Alureon.BT, Win32:Jifas-CY, Backdoor.Win32.Kbot.al, Net-Worm.Win32.Mytob.t

Hello again.I booted into Safe Mode and ran an Avast scan (which took forever) and it was a waste of time. The stupid thing found nothing wrong, and said the system was clean (which is the opposite it says when you log into the limited user account). The computer (and specially that account at least) is definitely infected. Could the viruses be hiding themselves when in safe mode?Should I scan from a Pre-install environment like BartPE? Or from the Regular "Owner" Admin account? I waited 2 days for the stupid program to scan 700gb (painfully slow for a qaud core, though to be excepted in safe mode), and it was useless.Other than running windows defender (which I'm doing now), and maybe trying MBAM, I'm not sure what to do. I'm not expect enough to dive into programs like OTViewIT and Combofix, so I'll need help here. Please, ANY HELP is appreciated. I would rather NOT wipe the drive and reinstall the whole system, but I need to get this figured out.Does no one have any ideas???

Read other 5 answers
RELEVANCY SCORE 121.2

Here is my HiJackThis log - Logfile of Trend Micro HijackThis v2.0.2Scan saved at 3:05:03 PM, on 2/26/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\WINDOWS\system32\spoolsv.exec:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AV... Read more

A:Win32/Heur - I-Worm/Nuwar - Win32/Virut

Hi,I have bad news for you I see you're dealing with Virut on top of the other nasty malware you are dealing with. In that case, it's unfortunately a lost case - Game over situation and a format and reinstall is the fastest and especially the safest solution.You may want to read this why:Virut and other File infectors - Throwing in the Towel? So, I suggest you to start backup all of your valuable data/documents/pictures/movies/songs/etc.. Do NOT backup any applications/installers and Do NOT backup any .exe/.scr/.htm/.html/.xml/.zip/.rar files...This because these files may be infected as well. If you back them up and replace them afterwards, it will infect your computer again.Read here for instructions how to format and reinstall Windows: http://web.mit.edu/ist/products/winxp/adva...all-format.html

Read other 14 answers
RELEVANCY SCORE 120.8

Hello,Please help if you can .I ran free Avast! version 5.0.677 on my Windows XP desktop computer (Pentium 4, 1.5 Ghz CPU, 1 gb ram), and came up with the following virus warnings. Unfortunately the Avast! software internal tools to remove it are grayed out and not functioning. I tried a couple of things to remove viruses from help online and then realized I was in way over my head. I found this forum and am now requesting help.Avast! says I am affected with:JS:Downloader-AT, Win32:Nimda, Win32:Small-GWM, Win32:VB-EIJ, Win32:WinSpy-CK, JS:ScriptSH-inf, and Win32:VirutAttached a screen shot of Avast! with viruses and partial path to them. Computer's Symptoms (not sure if these are all due to old slow processor or malware):Computer is freezing often;When it is in sleep mode it is turning itself on;Seems to be downloading stuff often and slowing down;Monitor is going black forcing reboots often;Couple weeks back I began getting floating ads that pop up when browsing online;I get an error message daily that says AdAware has shut down unexpectedly, do I want to send a report? I have been ignoring this, not knowing if it was important, been several weeks.Ok, I think that is all I can think of to share. Please help if you can. I appreciate it.Thanks,Dancer~~~~~~~~~~DDS (Ver_10-03-17.01) - NTFSx86 Run by ljk at 15:52:28.93 on Mon 09/20/2010Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_18Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.102... Read more

A:Please Help ~ Infected with JS:Downloader-AT, Win32:Nimda, Win32:Small-GWM, Win32:VB-EIJ, Win32:WinSpy-CK, JS:ScriptSH-inf, and...

Hello, and to the Malware Removal forum! My online alias is Blade Zephon, or Blade for short, and I will be assisting you with your malware issues!In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond to your topic and facilitate the cleaning of your machine.Before we begin cleaning your machine, I'd like to lay out some guidelines for us to follow while we are working together.I will be assisting you with your malware issues. This may or may not resolve other problems you are having with your computer. If you are still having problems after your machine has been determined clean, I will be glad to direct you to the proper forum for assistance.Even if things appear better, that does not mean we are finished. Please continue to follow my instructions until I give you the all clean. Absence of symptoms does not mean that all the malware has been removed. If a piece of the infection is left, it can regenerate and reinfect your machine. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.I ask that you please refrain from running tools other than those I su... Read more

Read other 42 answers
RELEVANCY SCORE 118.8

***UPDATE***I have discovered that ONE of the infections is, in fact, Win32/Tanotos.M. I have been able to successfully identify it and clean it using Grisoft's rmtanat.exe tool found here: <hxxp://www.avg.com/filedir/util/avg_rem_sup.dir/rmtanat/rmtanat.exe>I still have the issues of registry changes that inhibit RegEdit, TaskMan, etc.***END UPDATE***I support several PCs at an organization that have become infected with what appears to me to be several different malware packages. I have sifted through what I could find on www.bleepingcomputer.com as well as general Internet searches and have had no success in cleaning these machines up.All of these PCs have been running Grisoft VG 7.5 - 8.0 for quite some time now without event. Whatever has infected these machines was not detected by AVG unitl it was too late. AVG reports many *.exe files as infected with either Win32/Heur and\or Win32/Tanatos.M. I understand that Win32/Heur generically means that the detection is really non-specific and was flagged by hueristics rules.Further scanning with Dr. Web Cure It! reports Win32/Sality infections. However, scanning with the AVG Sality removal tool identifies no infected files.Thanks in advance everyone. I greatly appreciate your time devoted to helping each other. It's an invaluable resource.As per guidelines, I am pasting in DDS.scr results below:DDS (Ver_09-03-16.01) - NTFSx86Run by school at 11:53:42.54 on Tue 03/17/2009Internet Explorer: 7.0.5730.13Microsoft Windows XP P... Read more

A:AVG8.5 Win32/Tanatos.M and Win32/Heur

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the instructio... Read more

Read other 2 answers
RELEVANCY SCORE 118.8

Hi,

I'm currently battling against what Avast is telling me is the above infection. This computer was originally running AVG and that was picking up the heur trojan, but I changed the anti-virus 'cause AVG sucks and now Ramnit keeps popping up. There's an AVG process that keeps restarting despite uninstalling it. I've run Spybot and am currently performing a full scan with Malwarebytes, which I think is what's making Avast go crazy. As far as I can work out it's infecting things all over the place, but not actually doing anything apart from (so far as I can tell) stopping me opening Firefox, which sends constant crash reports whenever I tell it to start a new session. Avast is 4% into a scan and has found 36 infected files, so I figure this thing is bigger than I can deal with. Help would be much appreciated =) Just finished writing this to have another one pop up for VBS:ExeDropper-gen [Trj]. Balls.

HjT log reads as follows:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 15:23:11, on 27/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17091)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDO... Read more

A:win32/heur & Win32:Ramnit-E trojans

Hello and Welcome to TSF.

We no longer use HijackThis as our initial analysis tool.

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

Read other 1 answers
RELEVANCY SCORE 118.8

This is a different computer (my laptop) but it seems to have a few things wrong also. Would appreciate any help in cleaning it up.

Here is the DDS.txt:
DDS (Ver_09-01-07.01) - NTFSx86
Run by Brennen Fowler at 18:16:16.45 on Sat 01/10/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1350 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\SMSC\CIRHID\V1_0_0000_0\ToshibaRC.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\... Read more

A:Different computer: Win32/Heur, Win32/Tanatos.M

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until instruc... Read more

Read other 2 answers
RELEVANCY SCORE 118.8

Infected these viruses via USB thumb drive from a school computer. The virus blocked me from viewing Task Manager and give me an error saying "Task Manager has been disabled by your administrator". I went on to download AVG and it suddenly starts showing me that Win32/Tanatos.M is infecting everything. I tried to remove/heal it but it says healing failed. I'll attach my hijackthis log

A:Please help! Infected with Win32/Heur and Win32/Tanatos.M

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 28 answers
RELEVANCY SCORE 118.8

Last night my firewall (Sygate) said there was a program requesting to connect to the internet. I do not remember what it was, but I know it looked like it had something to do with Microsoft or Windows because it was named something along the lines of something Microsoft would call one of their .exe's. So a few hours later, my computer is sluggish. I go to check the Task Manager... and it won't let me! It says "Task Manager has been disabled by your administrator". I AM the admin, so I know something is up. AVG suddenly starts showing me that Win32/Tanatos.M is infecting EVERYTHING! Windows Meida Player, Inter Explorer, Google Chrome, VLC Player, RealPlayer, Wordpad, paint, everything!

I googled a way to access the Task Manager and it gave me a code to run. Tried it, didn't work. Then i realized it actually DOES work, it's just that the virus quickly disables the Task Manager before I can get into it. So I ran the code in Start > Run one more time, and extremely quickly did Ctrl+Alt=Delete before it could disable it and I got in! I found a whole bunch of .exes that I've never seen before, like:

winkqrmmr.exe
winpfkp.exe
noytd.exe
ycln.exe
mvul.exe
rfpav.exe
winpoflfl.exe
winejlpg.exe

I googled them all and for most of them, nothing came up. So now I'm positive it's a virus. AVG keeps going nuts telling me it's infecting everything, and when I click Heal or Remove, it says the healing failed! I try to block i... Read more

A:Please help! Infected with Win32/Heur and Win32/Tanatos.M

Argh!!! I think it ended the Explorer.exe task! Now I can't see my taskbar or open any new windows! I rebooted and NOTHING loads. No taskbar, no icons, Task Manager doesn't open. Just showing my wallpaper. Somebody PLEASE help me. I have no computer now! (Typing this on my sister's).

Read other 4 answers
RELEVANCY SCORE 118.8

Avast continually blocks the following threats: - Win32:Malware-gen - WIn32:Downloader-PKU [Trj] - Win32:DNSChanger-VJ [Trj]Avast scans and detects Win32:Sirefef-PL [Rtk], cannot remove it though.Malwarebytes scan detects BCminer, quarantines it, though never seems to get rid of BCminer. Other issues of possible note: - Windows Firewall not running 0x80070424 - Backup & Restore - last backup did not complete successfully - server execution failed - 0x80080005Ran both DDS and GMER (GMER did not have all the options available as per the preparation guide, and did not log anything when the scan was complete). .DDS (Ver_2011-08-26.01) - NTFSAMD64 Internet Explorer: 9.0.8112.16421Run by Family-pc at 12:37:05 on 2012-08-05Microsoft Windows 7 Home Premium 6.1.7601.1.1252.2.1033.18.16383.13888 [GMT -4:00].SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k RPCSSC:\Windows\system32\atiesrxx.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\sy... Read more

A:Win32:Sirefef-PL, Win32:Malware-gen, WIn32:Downloader-PKU [Trj], Win32:DNSChanger-VJ [Trj], BCMiner need help

Hello Njals, Welcome to Bleeping Computer.
My name is fireman4it and I will be helping you with your Malware problem.

Please take note of some guidelines for this fix:
Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing.
Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean".
In the upper right hand corner of the topic you will see a button called Watch Topic.I suggest you click it and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

Finally, please reply using the ADD REPLY button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply, unless they do not fit into the post.
I will be analyzing your log. I will get back to you with instructions.Do you have a USB Flash Drive you can use?

Read other 21 answers
RELEVANCY SCORE 116.8

Originally Virus Heat installed itself onto my computer then we added CA Security anti virus and anti spyware protection. This cleaned up some of the problem but I had to download spybot search and destroy to find more spyware. There was a lot of Z lob spyware on the computer. I have spent countless hours on the phone with tech support with Time Warner who is my internet provider who suggested the CA Security that isn't picking up on everything. Now when I run a full scan with CA on my computer it says there are no infections but I keep getting a pop up from CA saying there are 33 infected items. The pop up is random- it isn't in connection with the anti-virus scan. They aren't deleted or quarentened, the pop up just states the file name, infection name, type which is "file" and status which is infected. There are 10 win32/vmalum.ccpy, 19 win32/crushpy!generic, 1 win32/vmalum.ccqd, 2 win32/bewschy.d and 1 vmalum.ccqa. The files aren't quarentened so I can't go in and delete them and when I run the scan to clean them up it isn't picking up on them. So CA anti virus scan isn't picking up on these infected files but then again it is because the pop up knows they are there? Does this make sense? Almost like it knows they are there but it can't do anything with them? Time Warner suggested I get a trojan hunter, is this appropriate? Are you familiar with these infection types? I have googled the names but nothing comes u... Read more

A:Win32/bewschy.d, Win32/vmalum.ccpy, Win32/vmalum.ccqa,win32/crushpy!generic, Win32/vmalum.ccqd

What OS (Win 2K, XPsp1, XPsp2, Vista) are you using? Have you tried doing your scans in "Safe Mode"? Are you doing scans while logged into the "Administrator Account" or an "account with administrator privileges"? You need to start there first. If rescanning in Safe Mode does not help, then do this:Please perform an online scan with Kaspersky WebScannerClick on You will be promted to install an ActiveX component from Kaspersky, Click The program will launch and then begin downloading the latest definition files:Once the files have been downloaded click on Now click on In the scan settings make that the following are selected:Scan using the following Anti-Virus database:Extended (if available otherwise Standard)
Scan Options:Scan Archives
Scan Mail BasesClick Now under select a target to scan:Select My ComputerThis will program will start and scan your system.The scan will take a while so be patient and let it run.Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:Save the file to your desktop.Copy and paste the scan results in your next reply.

Read other 11 answers
RELEVANCY SCORE 115.6

Hi!

Please help. Along with the above virus? names I have an icon down in the bottom right corner that flashes from a yellow X to a yellow ? with a message telling me I have a Critical System error and to go to that site and download software....

I have AVAST and ran a full scan and did come up with several files with virus/trojan names; these files went into the Virus Chest. I deleted the Temp ones but decided not to delete anything else until I know what is going on. I have since ran the Clean Up through Avast and rescanned twice. Did not show any new stuff although there were 6 files that it was not able to scan. It appears that my C drive has all the problems.

One other thing I did notice was that when I went into Device Manager there is the big yellow question mark next to something identified as optional device and below that another question mark as RAID something. Also, down below the volume game controller file? there are several things that have a big yellow exclamation marks......

Someone showed me last night the process to remove the Adware(??) and the icon and clean this up and but I was not at home so I just reviewed the info, decided that I should be able to do it and just wrote down this website address. So, now I have here but do not know where to get started.................

Thanks for you help!

A:Win32:zlob; Win32:ageng-a; Win32:adan-007; Win32:enumplus And On And On

Sorry you didn't get a reply sooner.Here's what to do.Follow the directions in this topic: http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/Then post a new topic with your HJT log here: http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/Provide a brief description of your problem, and provide a title similar to the one you have here.Please be patient, as the HJT team is very busy. Do not bump your log as the team may think that someone is already helping you. If you have not had a response in five days add a reply to this topic: http://www.bleepingcomputer.com/forums/topic14717.html and paste in the link to your HJT topic there.Orange Blossom

Read other 1 answers
RELEVANCY SCORE 114.4

My PC was fine this morning, but when I got home, my sister said that my PC is now infected of viruses. I think the virus got my AVG 7.5, so I installed AVG 8, and the resident shield aler kept on popping up. what I don't understand is that all of my programs appear as viruses!!! now i can only use IE7! can't even open hijackthis!! HELP!!! PLEASE!!! thanks!!!
 

Read other answers
RELEVANCY SCORE 110.8

Hi, My laptop is running on Windows XP Home Edition Ver 2002 SP3. I also have CA Anti-virus software and Malwarebytes installed.

Recently, my laptop is infected by the malwares Win32/ZAcesss.AC, Win32/Karagany.ZAAE and Win32/Fosniw.ZABA. The CA Anti-virus software detected and quarantined them but it came back again after reboot. Also, Google search results are also redirected to the website xa.com.

I would be most grateful if you could help to solve this issue. The DDS log is pasted below. For your info, I received the following message when GMER completed scanning: WARNING!!! GMER has found system modification caused by ROOTKIT activity.
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.11
Run by CST at 4:20:34 on 2011-11-25
Microsoft Windows XP Home Edition 5.1.2600.3.936.86.1033.18.2047.1291 [GMT 8:00]
.
AV: CA Anti-Virus Plus *Enabled/Updated* {6B98D35F-BB76-41C0-876B-A50645ED099A}
AV: PC Cleaners *Disabled/Updated* {737A8864-C2D9-4337-B49A-B5E35815B9BB}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\Zcfg... Read more

A:Google redirect to xa.com and malware Win32/ZAcesss.AC, Win32/Karagany.ZAAE and Win32/Fosniw.ZABA

Hi,Please do the following:Download ComboFix from one of the following locations:Link 1 Link 2 VERY IMPORTANT !!! Save ComboFix.exe to your Desktop * IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here Double click on ComboFix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\C... Read more

Read other 16 answers
RELEVANCY SCORE 110.8

Hi,I'm running Windows XP - Internet Explorer v. 6.00, SP3. Yesterday Avast alerted me to a virus on my computer (I neglected to write down the exact message). At the time, only Gmail was open and an email was being written. I've had some issues with Avast occasionally reporting a false positive, and since nothing was being downloaded at that time, I took no action with Avast. Instead, I immediately did a Quick Scan with MalwareBytes to see if it would find anything. MalwareBytes found and deleted the following: C:\Documents and Settings\HP_Owner\application data\Sun\Java\deployment\cache\\6.0\44\61b86cac-3c0c0928Trojan.FakeAlert.VGenC:\Documents and Settings\HP_Owner\local settings\temp\0.506697477033.exeTrojan.FakeAlert.VGenA second MalwareBytes scan was clean.I looked "Trojan.FakeAlert.VGen" up on Google and then it clicked: for the past few days, Adobe Flash Player has been crashing an awful lot. When it crashes (on Youtube, for example), it tells me the program is out of date and needs to be updated. The weird thing was that sometimes it worked for a while before it crashed, but I dismissed that as being some strange computer quirk. I went to the Adobe web site and tried to install the newest version of Flash Player, but was unable to. I feel foolish, but it never even occurred to me that a virus could be to blame. It concerns me that (assuming the Adobe Flash Pla... Read more

A:Trojan.FakeAlert.VGen, SpyInstall_HPPre.exe, Win32: Mirc-z [PUP], Win32: Kill App-W [PUP] & Win32: Agent-AMXO (Trj)

Download Security Check from HERE, and save it to your Desktop. * Double-click SecurityCheck.exe * Follow the onscreen instructions inside of the black box. * A Notepad document should open automatically called checkup.txt; please post the contents of that document.=============================================================================Please download MiniToolBox and run it.Checkmark following boxes:Report IE Proxy SettingsReport FF Proxy SettingsList content of HostsList IP configurationList last 10 Event Viewer logList Users, Partitions and Memory sizeClick Go and post the result.=============================================================================Download Malwarebytes' Anti-Malware (aka MBAM): http://www.malwarebytes.org/products/malwarebytes_free to your desktop. * Double-click mbam-setup.exe and follow the prompts to install the program. * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. * If an update is found, it will download and install the latest version. * Once the program has loaded, select Perform quick scan, then click Scan. * When the scan is complete, click OK, then Show Results to view the results. * Be sure that everything is checked, and click Remove Selected. * When completed, a log will open in Notepad. * Post the log back here.Be sure to restart the computer.The log can also be found here:C:\Document... Read more

Read other 13 answers
RELEVANCY SCORE 110

So, this is a newer netbook, almost 8 months old, i dont know how i got these because i have had anti-virus runing from day one

Anyway it all started when i was on facebook it just went to a diffrent page and i never clicked on anything, then MS security center popped up saying everything was infected, and kept tellin me that i didnt have an antivirus program and i coudlnt do anthing thing but keep going to this ADD to buy one... Which was odd because Avast was running. I opend avast and did a quick check and found the first one Dracur_c, But when i tied to do the the action to mvoe to chest it was telling me that there was not enough room on disc... and my disc is NOT FULL ODD, so i deleted it and it worked i can not coppy and paste the results if i can i dont know how But i will tell you it was in: C:/system volume information/_restore{ number letters}.dll and .EXE and it was also in C:/windows/system32/fwcfg32.dll listed TWICE

I then restarted the computer in safemode and did a full scan and it then found it again in system volume information/restore{letter numbers}.DLL twice And then in Windows/system32/75.tmp..

this morning it was still acting wierd when i started EI redirecting me when i would use google and When i would send an error log to MS the page never loded and then i would get a poppup add So i ran another Avast scan and GOT the win32:trojan-gen,win32:alureon-hd, win32crypt-gwl that came up... This time it was found in my TEMP folder as an EXE and one in my ... Read more

A:avast found win32:dracur_c, win32:trojan-gen,win32:alureon-hd, win32crypt-gwl

Read other 14 answers
RELEVANCY SCORE 110

Mates,

I have spent the entire day trying to rid my system (Windows XP Home Version 2002 SP3) of this Win32.TrojanSpy, Win32.WormLovGate, & Win32.TrojanD\.\ader.NewMedia problem. I was alerted to these problems through scanning with AdAware Anniversary Edition after becoming so frustrated with my ridiculously slow internet connection (cable from Comcast). I can't seem to get rid of them and my cable internet speed is at about dial-up speed when testing it through CNET and Toast.net. Very frustrating, indeed. My attempts to remove the culprits have consisted of scanning by using:

(In order of scans):

AdAware Anniversary Edition (found the above mentioned culprits & claimed to have successfully removed them)
ATF Cleaner
Malwarebytes' Anti-Malware (found nothing)
SUPERAntiSpyware (found nothing)
SmitfraudFix (I used 'Search' in normal mode, then I used 'Clean' in safe mode - found nothing)
AdAware Anniversary Edition (scanned once again & in safe mode this time - it still found all of the above malware, trojans, etc., of which I selected it to remove)

Internet connection is still super slow.
It may be helpful to note that after performing these scans, I would select 'Turn Off' the computer (not 'Restart'), but the computer would simply reboot...I found that strange.

Any suggestions?

Thank you.

Daddy?!

A:Need help removing Win32.TrojanSpy, Win32.WormLovGate, & Win32.TrojanD\.\ader.NewMedia

Did AdAware provide a specific file name associated with this malware threat(s) and if so, where is it located (full file path) at on your system? Please post the results of your MBAM scan for review (even if nothing was found).To retrieve the MBAM scan log information, launch MBAB.Click the Logs Tab at the top.The log will be named by the date of scan in the following format: mbam-log-date(time).txt
-- If you have previously used MBAM, there may be several logs showing in the list.Click on the log name to highlight it.Go to the bottom and click on Open.The log should automatically open in notepad as a text file.Go to Edit and choose Select all.Go back to Edit and choose Copy or right-click on the highlighted text and choose copy from there.Come back to this thread, click Add Reply, then right-click and choose Paste.Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.Exit MBAM when done.

Read other 7 answers
RELEVANCY SCORE 110

I have followed the 5 step rule with no luck and have searched the threads i am acualy a hardware guy and not up on the maleware viri so maybe some pitty here here is my HJTL

Logfile of HijackThis v1.99.1
Scan saved at 10:55:46 AM, on 2/1/2007
Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\PeoplePC\ISP6230\Browser\Bartshel.exe
C:\Program Files\PeoplePC\ISP6230\Browser\Bartshel.exe
C:\PROGRA~1\PeoplePC\ISP6230\Browser\PPShared.exe
C:\Program Files\PeoplePC Accelerated\PeoplePC.exe
C:\Documents and Settings\stacy\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\... Read more

A:Help please 3 trojans present Win32.Qhost.f-Win32.Dialer.mw-Clicker.Win32.Agent.ac

Hi scubbadoo32,

Welcome to Tech Support Forum!

I apologize for the delay getting to your log. The helpers here are all volunteers and we have been very busy here lately. If you are still having malware problems, I will be glad to help.

OK, here?s what we do first.


Please run HijackThis and click "Scan". Place a check (tick) next to the following entries (if present):

O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O15 - Trusted Zone: http://secure.gestrip.com (HKLM)
O15 - Trusted Zone: http://update.randhi.com (HKLM)
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s.work4sure.com/c/ge/w4sgeen9.exe
O16 - DPF: {33331111-1111-1111-1111-611111193423} -
O16 - DPF: {33331111-1111-1111-1111-611111193429} -
O16 - DPF: {33331111-1111-1111-1111-615111193427} -
O16 - DPF: {33331111-1131-1111-1111-611111193428} -
O16 - DPF: {43331111-1111-1111-1111-611111195622} -
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab


Close ALL programs and browsers (including this one), leaving ONLY HijackThis open, then click "Fix checked".

Then please exit HijackThis.


NEXT:

Using Windows Explorer, please navigate to and delete the following FILES (if they exist):

c:\eied_s7.cab


Please let me know if you encountered any problems finding or deleting the file.


NEXT:

Please download CCleaner (freeware) and save it to your desktop:Run the CCleaner install... Read more

Read other 1 answers
RELEVANCY SCORE 109.2

anyone help me remove that virus im using kaspersky but it's not working deleting the virus is also no good since it will be replace by another one... and i think that virus did'nt allow to see hiden files and folder and also i cant open my hardisk(c: and d: ) by double cliking it...pls help me im using windows xp sp2
 

A:Packed.Win32.PolyCrypt.h

bump
 

Read other 3 answers
RELEVANCY SCORE 109.2

I cannot figure out how to get rid of this - Kapersky found this but says this cannot be disinfected.
My computer is painfully slow - can you help????
 

Read other answers
RELEVANCY SCORE 109.2

how to remove it?
plz anyone can tell me how?

A:how to remove win32/polycrypt

Hello and Welcome to TSF.

Please do not create multiple threads.

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

------------------------------------------------------

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new thread, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.

------------------------------------------------------

Read other 1 answers
RELEVANCY SCORE 109.2

Hello,
Would someone please help me to remove PolyCrypt?

I'm using a Sony Vaio VGN-FW31J running Windows 7 that was updated from Vista. All important updates accepted from Microsoft and Sony until infection detected. I use Firefox but IE is installed.

AVG (full, v9, updated) is giving me a threat warning about a virus infection it calls WIN32/PolyCrypt that it states is to be found in c:\Windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin. (The lower case c is correct.)

When I click the appropriate buttons to deal with the infection (with and without the power-user option) then AVG states that the object is inaccessible. When I reboot the computer I get the same warning of a threat again.

Object Type is File.

Process is: C:\Windows\System32\svchost.exe (upper case C.)

AVG's 'Go to File' button opens a window with the My Documents folder selected (in blue).

No entry in AVG's database for PolyCrypt. I've Googled PolyCrypt and am unclear about its nature. Some posts talk of different file-suffixes (is that the right term? .doc/.php/etc) but AVG does not give a file-suffix for the file in question. Some posts call this PolyCrypt a 'false negative' whereas others warn that it's a real baddy, allowing remote access and data loggining and all sorts of things I don't want happenening.

The requested text is pasted below.
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Andrew at 14:12:33.98 on 26... Read more

A:WIN32/PolyCrypt detection

Hello and welcome to Bleeping Computer We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far. Upon completing the steps below another staff member will review your topic an do their best to resolve your issues. If you have already posted a DDS log, please do so again, as your situation may have changed. Use the 'Add Reply' and add the new log to this thread. Thanks and again sorry for the delay. We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scr DDS.pifDouble click on the DDS icon, allow it to run. A small box will open, with an explaination about the tool. No input is needed, the scan is running. Notepad will open with the results. Follow the instructions that... Read more

Read other 12 answers
RELEVANCY SCORE 108.8

Hi,

My anti-virus is saying that i have got all the above viruses mentioned. It says everytime deleted

but each time i reboot, i am getting those problems

Also , i am having my IE opening http://83.30...... website in multiple tabs and windows everytime.

I am struck up with viruses thts 4 sure

Can anyone help me kindly
 

A:Problem with Win32.Monder, Win32.Virtumonder and Win32.obfuscated Viruses

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:29:18, on 02/07/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\Marketing Tools\MarketingTools.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Sony\Network Utility\LANUtil.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
C:\Program Files\Apoint\ApMsgFwd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://... Read more

Read other 2 answers
RELEVANCY SCORE 108

Hi everyone,

Like I'm sure everyone feels, I've only found this forum when I've hit trouble and I'm very glad/impressed it exists.

I've had the SpyMaxx virus on my computer for 3 days and I'm really struggling to get rid of it, my computer is virtually crippled and I'm writing this on my girlfriend's work laptop.

The virus locks me out of the taskmanager and registry, but I've found little executables to help temporarily solve these problems.
The processes 20663.exe, spools.exe, spoolsv.exe and uTorrent.exe seem to pop up all the time.

I've purchased AVG 8.0 and installed it on my computer, but it always seems to find hidden drivers and whatnot, but not the actual viruses. I've run it a couple of times without rebooting, just over and over and eventually it will find nothing, but the continual popups for Spymaxx keep going during and after the virus check. AVG is not able to connect to it's server to update.

Interestingly, I can use Google without any issues, however, if I try to click on a virus scanner I get a page saying my internet connection has died. If I try and check the latest football scores I have no problem.

Going through instructions for Combofix doesn't do anything. I double click on the program on my desktop and nothing happens.
I downloaded DSS from this laptop and used a USB to get it onto my computer. DSS seems to run fine, but Notepad is now broken and I can't view the results. Whenever notepad t... Read more

A:Malware Virus Win32/polycrypt?,

can you please clarify; was Norton on there before you put avg on there ?unfortunately avg 8.0 is NOT getting a good reception for effectiveness nor user -friendliness ( unlike its predecessor avg7.5)depending on which Antivirus program was on there first you will need to uninstall any others; you cannot have more than ONE installed antivirus program on any computer ; if you do they will wye for computer supremicy and ignore their actual JOB of hunting viruses you should not even ATTEMPT to use combofix unless instructed to do so by a Trained malaware expert; to do so can render your computer forever unueable and unbootable one assumes this is an XP machine ; did it have sp2 installed on it and all its windows updates?so we know what you HAVE got on there can you please list the protection programs currently on there and when you last managed to fully update them and run full system scans; do you have any reports from any of them ?to your knowledge does the computer have any P2P programs on it and if so do you know if they have they been utilised for file sharing( whcih is an INSTANT route for computer infections)

Read other 2 answers
RELEVANCY SCORE 108

Hi everyone,

Like I'm sure everyone feels, I've only found this forum when I've hit trouble and I'm very glad/impressed it exists.

I've had the SpyMaxx virus on my computer for 3 days and I'm really struggling to get rid of it, my computer is virtually crippled and I'm writing this on my girlfriend's work laptop.

The virus locks me out of the taskmanager and registry, but I've found little executables to help temporarily solve these problems.
The processes 20663.exe, spools.exe, spoolsv.exe and uTorrent.exe seem to pop up all the time.

I've purchased AVG 8.0 and installed it on my computer, but it always seems to find hidden drivers and whatnot, but not the actual viruses. I've run it a couple of times without rebooting, just over and over and eventually it will find nothing, but the continual popups for Spymaxx keep going during and after the virus check. AVG is not able to connect to it's server to update.

Interestingly, I can use Google without any issues, however, if I try to click on a virus scanner I get a page saying my internet connection has died. If I try and check the latest football scores I have no problem.

Going through instructions for Combofix doesn't do anything. I double click on the program on my desktop and nothing happens.
I downloaded DSS from this laptop and used a USB to get it onto my computer. DSS seems to run fine, but Notepad is now broken and I can't view the results. Whenever not... Read more

A:Malware Virus Win32/polycrypt?

Hi .I suggest that you post in either the Hijack This section of the website...or BleepingComputer.com - Am I infected What do I do - http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/ Preparation Guide For Use Before Posting A Hijackthis Log - http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ The personnel at those webpages are very skilled in helping persons like you with malware issues.Louis

Read other 2 answers
RELEVANCY SCORE 106.8

I've never used HijackThis before and have never had an infection on my PC in 7 years, but I've caught a few trojans lately in the ZoneAlarm/Kasperky antivirus and AVG AntiSpyware, so I think it might be time to ask for some expert advice. The last item quarantined in ZoneAlarm is "other" whose description is "not yet available" and risk level "high". The known trojans are Trojan.PolyCrypt.b, Win32.KeySearch, Win32.Trojan.Downloader.CWS.am and Backdoor.Hupigon.cql. I'm not particularly worried about them, but am more concerned about the "other" one. I've had some strange little things going on with computer recently, such as EVERYTHING being slow (temperature is normal, ran CCleaner but didn't make a difference), and the BOINC entry disappeared from the All Programs list and the Add/Remove Software list. BOINC is still functioning, but now I have no way to uninstall it. This seems kind of suspicious to me and I'm wondering if I might have a rootkit lurking somewhere or Feds prying through my files. AVG AntiRootkit didn't turn anything up. I ran GMER also, but that's another first for me and I don't know how to decipher the log. I tried to post it, but it was rejected for being too long. I'm running ZoneAlarm Internet Security Suite for full time security but also have AdAware, SpyBot, Windows Defender, LinkScanner and NoScript and the others mentioned above. For about a year I've also had AVG AntiVirus and Avast! installed, but thei... Read more

A:Recent Trojan.polycrypt.b, Win32.keysearch And "other"

Hello solar and welcome to BleepingComputer!Apollogies for the delay. If you are still having problems please post a brand new HijackThis log as a reply to this topic. Before posting the log, please make sure you follow all the steps found in this topic:Preparation Guide For Use Before Posting A Hijackthis Log.Thanks,Johannes

Read other 1 answers
RELEVANCY SCORE 106.4

Firefox and Mostly IE is experiencing redirects when I search through any search engine. Avast is continuously stopping malware in the Windows\Temp folder.

DDS (Ver_09-12-01.01) - NTFSx86
Run by Ricardo at 15:09:36.31 on Sun 12/27/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3071.2184 [GMT -8:00]

AV: avast! antivirus 4.8.1368 [VPS 091227-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\... Read more

A:Infected with Win32:Malware-gen, Win32:Rootkit-gen, and Win32:Spyware-gen

Please close this post. I'm reformatting and reinstalling an Acronis Image prior to the infection. Thanks anyway.

Read other 2 answers
RELEVANCY SCORE 106.4

Hey I could use some help getting rid of this virus, I think Ramnit-A might be around too on it. I've done some researching trying to see if I could try and fix this on my own, but I think this might go quicker.I have spybot and adaware (freeware) on my computer, spybot hasn't bothered to pick anything up in this mess. Adaware has picked up Ramnit-A virus on the system and it always ends up with a list of items to repair (mostly files and a few processes at the end of the list), a cookie, and then ~4 misc. items that it recommends the "just once option". Anyways it hasn't been working, so from my reading, from a topic I managed to google from this forum board I downloaded Avast, which has grabbed virus file types that I listed in the topic with quick scan (and with it's "shields" too) . The other disturbing thing is that I think I have about 3000+ files now sitting in my virus chest on Avast from running the thing...safe to probably say it's not fixing anything.I'm a little worried too about the fact that the files Avast is taking are, or were just regular exe's some that were actually on my desktop. Has left me wondering if I should delete everything in the virus chest or not, I'm not going to end up deleting something important if I do? (main worry)From what I've read I hope I posted the required stuff, I'm currently running Gmer right now, I'll probably leave it running and try posting it tomorrow morning as ... Read more

A:VBS:ExeDropper-gen;Win32:Ramnit-B;Win32:Rootkit-gen;Win32:Trojan-gen

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.In the custom scan box paste the following:CODEmsconfigsafebootminimalactivexdrivers32netsvcs%SYSTEMDRIVE%\*.exe/md5st... Read more

Read other 2 answers
RELEVANCY SCORE 106.4

I completed Steps 1 - 5, but couldn't do the Step 2 Panda Scan part, since Avast popped up the following:

File Name: http://acs.pandasoftware.com/actives...cab\pskavs.dll
Malware name: Win32:CTX
Malware type: Virus/Worm
VPS version: 080507-0, 2008/05/0

Problem Discription

The following Trojans keep getting found by avast:

C:\WINDOWS\system32\ahst593.exe\[UPX]
Win32:Lineage-351 [Trj]
C:\WINDOWS\system32\ftpdll.dll
Win32:Small-JMK [Trj]
C:\Documents and Settings\LocalService\cftmon.exe\[UPX]
Win32:Lineage-351 [Trj]
C:\Documents and Settings\LocalService\ftpdll.dll
Win32:Small-JMK [Trj]
etc...

Avast cannot delete them because they are being used by a program I am not sure off, so Avast's description claims. It only keeps popping up if I choose an action that should be done. I run my computer with the warning popup flashing continously, then it seems to be stable.

Also I have Spybot search and destroy installed, and everytime I try and run it to check for problems, my computer freezes and restarts. The same happens if I try to run an AVG Anti-Spyware check.

It seems to be something with Avast, because if I am connected to the internet, the on-access shield Intermail, kept sending out random emails, i disabled it at the moment.

I tried a system restore, but it seems to have deleted all my previous restore points.
Besides this I have a crypt.dll virus, that Avast picks up, that I cannot delete in the registry.

I've seen similar posts, so I ho... Read more

A:Win32:Pakes-APC [Trj];Win32:Small-JMK [Trj];Win32:Lineage-351 [Trj] popups.

Hello and Welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please be patient with me during this time.

Read other 19 answers
RELEVANCY SCORE 106.4

Hello all,Because of my careless actions while using my computer and IM i got infected and now i cant get rid of it. Im getting now ad pop-up's only, and i think i got rid of some infections that came but still there are left a few. I got this infection about a week ago. Computer hasnt been used much after that 'cos i had to go away for a week and didnt have time to try to fix it then. Now i tried to fight with this for a couple of days, but no glorious victory for me here.Kaspersky's online scan report is last in my postIf you have time and knowledge to help me, i would appreciate it.Thanks in advancemain.txt:Deckard's System Scanner v20071014.68Run by Jaybird on 2008-06-07 14:21:17Computer is in Normal Mode.---------------------------------------------------------------------------------- HijackThis (run as Jaybird.exe) ---------------------------------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 14:21:28, on 7.6.2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16640)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\spoolsv.exeC:\W... Read more

A:Infected With Win32.virtumonde/win32.monde/win32.ircbot

Hello Jay-EM and welcome to BleepingComputer,1. * Clean your Cache and Cookies in IE:Close all instances of Outlook Express and Internet Explorer Go to Control Panel > Internet Options > General tabUnder Browsing History, click Delete. Click Delete Files, Delete cookies and Delete historyClick Close below.* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):Go to Tools > Options.Click Privacy in the menu..Click the Clear now button below.. A new window will popup what to clear.Select all and click the Clear button again.Click OK to close the Options window* Clean other Temporary files + Recycle bin Go to start > run and type: cleanmgr and click ok. Let it scan your system for files to remove. Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.Press OK to remove them.2. Please download Malwarebytes' Anti-Malware from Here or HereDoubleclick mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.If an update is found, it will download and install the latest version.Once the program has loaded, select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed,... Read more

Read other 2 answers
RELEVANCY SCORE 106.4

I recently got annoyed when my Firefox browser started redirecting me to random websites. So I scanned my computer using aswMBR and it found viruses called Sirefef-PL, Medfos and Agent-APDL.

Here is my aswMBR log

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-08-17 12:32:14
-----------------------------
12:32:14.193 OS Version: Windows x64 6.1.7601 Service Pack 1
12:32:14.193 Number of processors: 4 586 0x2A07
12:32:14.194 ComputerName: STEVEN-PC UserName: Steven
12:32:15.256 Initialize success
12:32:18.850 AVAST engine defs: 12081601
12:32:23.238 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
12:32:23.241 Disk 0 Vendor: SAMSUNG_HD103SJ 1AJ100E5 Size: 953869MB BusType: 3
12:32:23.264 Disk 0 MBR read successfully
12:32:23.267 Disk 0 MBR scan
12:32:23.271 Disk 0 Windows 7 default MBR code
12:32:23.286 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
12:32:23.300 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953767 MB offset 206848
12:32:23.393 Disk 0 scanning C:\Windows\system32\drivers
12:32:37.944 Service scanning
12:32:52.922 Modules scanning
12:32:52.930 Disk 0 trace - called modules:
12:32:52.946 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
12:32:52.951 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007db30... Read more

A:Help with Win32:Sirefef-PL/Win32:Agent-APDL/Win32:Medfos

Hello and welcome to the forums!My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you. I'll be addressing you by your username, if you'd like me to address you by something else, please let me know!I would be glad to take a look at your log and help you with solving any malware problems.If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed. If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
If I instruct you to download a specific tool in which you already have, please delete ... Read more

Read other 13 answers
RELEVANCY SCORE 106

Hi computer gods,
My AVG antivirus program picked up a Trojan horse Dropper.Delf.BLA and Virus Win32/PolyCrypt on my computer. They were found in the following locations on my computer.

Trojan Horse Dropper.Delf.BLA in C:Sytem Volume Information/_restore{46DE8921-1d39-44D2-A9E9-64119261F211}/RP4/A0000013.dll

Win32/PolyCrypt in C:Sytem Volume Information/_restore{46DE8921-1d39-44D2-A9E9-64119261F211}/RP7/A0000217.exe

Trojan horse Dropper.Delf.BLA in C:/WINDOWS/system32/splm/ncjapi32.exe ; this was detected in the registry key as well.

Win32/PolyCrypt was found in C:/WINDOWS/system32/splm/kbdsapi.dll earlier this week.

It have also previously picked up another type of Trojan horses (ex. Sheur.Cazb) and tracking cookies. All of which have been moved to the virus vault of AVG. Below is the logfile.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:04:25 PM, on 9/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\P... Read more

Read other answers
RELEVANCY SCORE 104.8

(DDS log below)I re-installed my AV after running without it for a while and found that I had quite a few bad things going on picked up by Nod32 including (see attachment for more detail):Win32/Olmarik.ZCJava/TrojanDownloader.Agent.NBEa variant of Win32/Olmarik.UL trojanWin32/Cimag.CL trojanI also get multiple outbound connection attempts which are at least partially being blocked by Nod32 to weird .cc .cn and a few .com domain urls, this happens after performing a google search. Also getting some browser redirects going on and homepage changes.I tried setting nod32 to pre-release updates and performing a full scan, this picked up the above and removed them, but after a reboot there are still things going on. Before reading the steps on this site, I ran the latest ComboFix twice which picked up a rootkit in intelide.sys both times, but appears to come back each time. While I disabled nod32 when I ran ComboFix, it re-enabled upon reboot automatically, not sure if that matters.I've also been getting a startup delay of around 1 minute after logon, in this time, nothing appears to be going on (no apparent CPU or disk activity), but wireless, AV and other startup items do not run. Then a minute later, everthing fires up.I've tried running GMER several times but this keeps giving me a BSOD with IRQL_NOT_LESS_OR_EQUALLast scan with nod32 came up clean but still getting outbound connections and browser redirects.Looking to sort this out once and for all!DDS (Ver_10-03-17.... Read more

A:WinXP rootkit? problem + Win32/Olmarik.ZC Java/TrojanDownloader.Agent.NBE a variant of Win32/Olmarik.UL trojan Win32/Cimag.CL t...

Hi,Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.Please reply to this post so I know you are there.The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.----------------------------------------------Please download GMER from one of the following locations and save it to your desktop:Main MirrorThis version will download a randomly named file (Recommended)Zipped MirrorThis version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.Disconnect from the Internet and close all running programs.Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.GMER will open to the Rootkit/Malware tab and perfor... Read more

Read other 14 answers
RELEVANCY SCORE 104.8

i have AVG 8 , 3 days ago popups appears indicate the infection with 2 viruses : trojan horse sheur.cazb and win32/polycrypt in system32/splm folder . the avg see it but the problem remain every time i turn on the computer the popups appears and now popups appears frequently for the same viruses. i turn off the restore system, and i removed the viruses from the vault list nothing change . i have xp sp1 . can you help me please with this matter.



Thanks

A:trojan horse sheur.cazb, win32/polycrypt viruses

Hello and welcome to TSF
Download RSIT by random/random and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

=======
Logs Required
log.txt
info.txt

If there is no response to this post within 72hrs, this thread will be closed.

Read other 2 answers
RELEVANCY SCORE 104.8

KASPERSKY ONLINE SCANNER 7 REPORTSaturday, November 29, 2008Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)Kaspersky Online Scanner 7 version: 7.0.25.0Program database last update: Friday, November 28, 2008 18:35:48Records in database: 1424124Scan settingsScan using the following database extendedScan archives yesScan mail databases yesScan area My ComputerC:\D:\E:\F:\Scan statisticsFiles scanned 94300Threat name 4Infected objects 4Suspicious objects 0Duration of the scan 02:45:29File name Threat name Threats countC:\Documents and Settings\All Users\Application Data\FreeApp.exe Infected: Trojan.Win32.Agent.arng 1 C:\Qoobox\Quarantine\C\Program Files\tinyproxy\tinyproxy.exe.vir Infected: Trojan-Proxy.Win32.Agent.bcw 1 C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\winse32.exe Infected: IRC-Worm.Win32.Small.x 1 C:\WINDOWS\bolivar24.exe Infected: Backdoor.Win32.Agent.ubx 1 The selected area was scanned.----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Logfile of random's system information tool 1.04 (written by random/random... Read more

A:Infected: Trojan.Win32.Agent.arng, Trojan-Proxy.Win32.Agent.bcw, IRC-Worm.Win32.Small.x, Backdoor.Win32.Agent.ubx

Hello and to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a description of your problem, along with any steps you may have performed so far.Upon completing the steps below a staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results, click no to the Optional_ScanFollow the instructions that pop up for posting the results.Close the program window, and delete the program from your desktop.Please note: You may have to disable any scr... Read more

Read other 4 answers