Live Chat & Podcast at 1:00PM Eastern on Sunday!
There's no such thing as a stupid question, but they're the easiest to answer.
JoinTour
Login
Search
Virus & Other Malware Removal
Tag Cloud
access acer asus bios bsod crash desktop driver drivers error ethernet excel freeze gaming graphics hard drive hardware hdmi internet laptop lcd malware memory monitor motherboard network operating system printer problem ram registry router slow software sound toshiba trojan ubuntu 11.10 uninstall usb video virus vista wifi windows windows 7 windows 7 32 bit windows 7 64 bit windows xp wireless
Search
Search for:
Tech Support Guy Forums > Security & Malware Removal > Virus & Other Malware Removal >
Solved: Trojan Virus Infection atapi.sys - drivers/dllcache

Reply  
Thread Tools
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
21-Nov-2009, 12:33 AM #1
Question Trojan Virus Infection atapi.sys - drivers/dllcache
I am using Windows XP -SP 1 & 2; have AVG Anti-Virus Free & Zone Alarm Firewall free installed. From yesterday morning on opening the system AVG is giving alert as follow:

Trojan horse Packed.Protector.C;"C:\WINDOWS\system32\drivers\atapi.sys";"Object is white-listed (critical/system file that should not be removed)";"11/20/2009, 3:40:15 AM";"file";"C:\WINDOWS\system32\svchost.exe"
Trojan horse Packed.Protector.C;"C:\WINDOWS\system32\dllcache\atapi.sys";"Moved to Virus Vault";"11/20/2009, 3:40:15 AM";"file";"C:\WINDOWS\system32\svchost.exe
"Trojan horse BackDoor.Agent.ACVO;"C:\WINDOWS\system32\drivers\qol5dbf.sys";"Moved to Virus Vault";"11/20/2009, 4:38:50 AM";"file";"System"

Alerts are repeating whenever system is opened.
The virus is unable to heal/remove (& reappear after moving to vault).

System is unable to restore to back date.

Please guide me what to do?

I thought of removing the infected file with fresh one but unable to find the same new file - not sure whether this would remove the problem. There was compulsory system shut down by NT system also once in begginning today.

Hoping early help from advanced adviser.

Thanks,

Sunil Goyal
Phantom010's Avatar
Computer Specs
Trusted Advisor with 25,017 posts.
 
Join Date: Mar 2009
Location: Cyberspace
Experience: Advanced
21-Nov-2009, 02:52 PM #2
Please click on the Report button and kindly ask to be moved to the Malware Removal forum.
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
22-Nov-2009, 02:04 AM #3
As instruction given, I have requested to move to Malware removal forum.

Thanks,
Sunil Goyal
dvk01's Avatar
Moderator & Malware Removal Specialist with 37,223 posts.
 
Join Date: Dec 2002
Location: Loughton, Essex, UK
22-Nov-2009, 09:40 AM #4
=====
GMER:
=====

Download GMER Rootkit Scanner from here or here.

Ensure you have uninstalled any CD Emulation programs before you run GMER as outlined here
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe.
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..


    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  • Save it where you can easily find it, such as your desktop

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries


then


Download to Desktop: DDS by sUBs from one of these locations:

http://download.bleepingcomputer.com/sUBs/dds.com
http://download.bleepingcomputer.com/sUBs/dds.scr
http://www.forospyware.com/sUBs/dds

double click DDS.scr to run

When complete, DDS.txt will open.

Click Yes for Optional Scan.
Save both reports to your desktop.
DDS.txt
Attach.txt

Attach the contents of both logs back here.
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy
Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
22-Nov-2009, 07:27 PM #5
Hi Dvk,
Thanks for help. I will Give the report after completing instructions. Now system is becoming slow may take longer time.
Sunil Goyal
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 12:15 AM #6
Hi Derek,
I have to uninstall AVG as it has (slow down system - speed improve after AVG removal) blocked scan run two times and shut Zone alarm also. File are attached.
Thanks,
Sunil Goyal
Attachment Blocked
Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.
dvk01's Avatar
Moderator & Malware Removal Specialist with 37,223 posts.
 
Join Date: Dec 2002
Location: Loughton, Essex, UK
23-Nov-2009, 03:21 AM #7
That was only part of the dds log

Delete any existing version of ComboFix you have sitting on your desktop
Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus and anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
  • Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again after combofix has finished
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running
Double click on combofix.exe & follow the prompts.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy
Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 04:10 AM #8
Hi Derek,
I had attached DDS.txt file, now attaching all files (thought not required).
Further new files will attach after completing new instructions.
Thanks,
Sunil Goyal
Attachment Blocked
Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 04:51 AM #9
Hi Derek,
Attaching Combofix log.
Unable to understand "newHijack log"
Please clarify - will do as instructions given.
Thanks,
Sunil Goyal
Attachment Blocked
Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.
dvk01's Avatar
Moderator & Malware Removal Specialist with 37,223 posts.
 
Join Date: Dec 2002
Location: Loughton, Essex, UK
23-Nov-2009, 05:34 AM #10
I need to examine some files before we can go any further

Download suspicious file packer from http://www.safer-networking.org/en/tools/index.html (direct download http://www.safer-networking.org/files/sfp.zip )

Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

please upload that to http://www.thespykiller.co.uk/index.php?board=1.0 so we can examine the files

Just press new topic, fill in the needed details and just give a link to your post here & then press the browse button and then navigate to & select the files on your computer, When the file is listed in the windows press send to upload the file



c:\windows\system32\dllcache\atapi.sys
c:\windows\system32\drivers\atapi.sys
c:\windows\system32\kernel32.dll
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy
Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 07:27 AM #11
Hi Derek,
File Uploaded, Link below - topic - trojan virus
http://thespykiller.co.uk/index.php/...8.new.html#new
Thanks,
Sunil Goyal
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 07:36 AM #12
Hi Derek,
There may be mistake (in link) if require give instrction for doing again.
Thanks,
Sunil Goyal
dvk01's Avatar
Moderator & Malware Removal Specialist with 37,223 posts.
 
Join Date: Dec 2002
Location: Loughton, Essex, UK
23-Nov-2009, 07:42 AM #13
I am not guaranteeing this will work & we might have to replace the infected files uisng the recovery console but lets try this first

Download the attached CFScript.txt and save it to your desktop ( click on the link underneath this post & if you are using internet explorer when the "File download" pop up comes press SAVE and choose desktop in the list of selections in that window & press save)

Disable any antivirus/antimalware/firewall realtime protection or script blocking in the same way you did previously before running combofix & remember to re-enable it when it has finished

Close any open browsers
Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.







This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply

Note: these instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system and will not fix your problem. If you have a similar problem start your own topic in the malware fixing forum
Attachment Blocked
Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy
Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue
dvk01's Avatar
Moderator & Malware Removal Specialist with 37,223 posts.
 
Join Date: Dec 2002
Location: Loughton, Essex, UK
23-Nov-2009, 08:24 AM #14
If you haven't already performed the steps in post #13

Rather than following my last post please do this instead

combofix has been updated to hopefully deal with this problem

Delete any existing version of ComboFix you have sitting on your desktop
Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Very Important! Temporarily disable your anti-virus and anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
  • Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again after combofix has finished
--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running
Double click on combofix.exe & follow the prompts.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.
__________________
Derek Microsoft MVP/Windows - Security | Thespykiller | Security & Privacy
Find out all about the European Wild Hedgehog, what you can do to save it from extinction Hedgehog Rescue
SunilGoyal4's Avatar
Computer Specs
Junior Member with 14 posts.
 
Join Date: Nov 2009
Experience: Intermediate
23-Nov-2009, 08:57 AM #15
Hi Derek,
File enclosed.
Thanks,
Sunil Goyal
Attachment Blocked
Attachments in the HJT forum are often designed to solve a specific issue and not meant to be used without instructions specific to your computer. If you want help specific to your computer, please post a HiJackThis Log. If you started this thread, please make sure you are logged in to be able to view attachments.
Reply

THIS THREAD HAS EXPIRED.
Are you having the same problem? We have volunteers ready to answer your question, but first you'll have to join for free. Need help getting started? Check out our Welcome Guide.

Search Tech Support Guy

Find the solution to your
computer problem!




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
WELCOME TO TECH SUPPORT GUY! Are you looking for the solution to your computer problem? Join our site today to ask your question -- for free! Our site is run completely by volunteers who want to help you solve your computer problems. See our Welcome Guide to get started.
Thread Tools



Facebook Facebook Twitter Twitter TechGuy.tv TechGuy.tv Mobile TSG Mobile
You Are Using:
Server ID
Advertisements do not imply our endorsement of that product or service.
All times are GMT -4. The time now is 02:26 AM.
Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved.

Powered by Cermak Technologies, Inc.