[ReverendLisa]

I have been battling a virus all day. The only piece that is remaining is in the c:\windows\system32\drivers\cdrom.sys

I have done a stupid thing. I was hoping for more virus support and upgraded from the free version of AVG to the version 9.0. And of course it wants me to reboot.

I am terrified to reboot for fear of extracting the virus.

I am not the computer savvy and would really like to save my hard drive.

Please help?

Reverend Lisa

[Mumbodog]

Install, update, full scan, using MBAM

http://download.cnet.com/Malwarebyte...=dl&tag=button

.

[ReverendLisa]

Thank you for the advice, I have downloaded this software and it is running but of course it wants more money in order to correct the viruses. My big question is whether or not it safe to reboot, then I can use the software I have already purchased. But then there is the chance that it can not remove the virus from the system32 file because it is a system file. So advice regarding this would be helpful.

[Mumbodog]

MBAM is free, you sure you downloaded the right one?


Not all files in system 32 are legit system files, that is just where malware hides.

Cannot say if it is safe to reboot or not, but you have to do it sooner or later.

.

[ReverendLisa]

LOL ! if there is a way to down load the wrong one I can find it ! But so far it is the best 24.99 I ever spent.

What you and mbam have taught me is that viruses are very tricky, they can make fake files in my system32, and look like legit files. AVG will not delete anything from the system 32.

we are on the 7th scan, and yes I did finally reboot. the world did not end.
I have mbam and avg running so maybe we are out of the woods. I will know more in a bit.

Thanks Reverend Lisa

[ReverendLisa]

Back to square 1,

"Object name";"C:\WINDOWS\system32\drivers\cdrom.sys"
"Detection name";"Virus identified Packed.Protector.C"
"Object type";"file"
"SDK Type";"Core"
"Result";"Object is white-listed (critical/system file that should not be removed)"
"Action history";""


AVG is telling me this, and MBAM is not finding it. So now what do I do?

Thanks Reverend lisa

[ReverendLisa]

I have just completed a scan with MBAM, 2 things happened.

1. MBAM did not see the virus in C:\WINDOWS\system32\drivers\cdrom.sys
2. The second MBAM was scanning C:\WINDOWS\system32\drivers\cdrom.sys, AVG identified the file as a threat and flagged it.

So right now I am unsure how to proceed. HELP !

Reverend Lisa

[mtzlplex]

Just a thought here, why don`t you try an online virus scanner(it is free), then you can get a so called second opinion to see if the supposed threat is indeed that. The one I use periodically is eset online scanner, it is "free", and is found here: http://www.eset.com/onlinescan/

[Mumbodog]

What OS is it, and what service pack level?

The cdrom.sys should be quarantined by AVG, if not let it quarantine the file.

Then we can find a clean file to replace it.

.

[ReverendLisa]

I am operating windows xp service pack 2 I believe, but I have all the updates since then.

AVG did not offer to quarantine the file, but I will rerun the scan and see if I overlooked the options

[ReverendLisa]

look since I ran the checks this morning several other trojan horse things have appeared? I will try to copy the logs to them here in a bit. This morning the only thing that was left was the one in cdrom.sys.

[Mumbodog]

look since I ran the checks this morning several other trojan horse things have appeared?

You better use the "report" button and ask a moderator to move this thread to the Hijack board. Disconnect the PC from the internet until you are told to do otherwise.

.

[ReverendLisa]

Thanks for being there for me, I am very scared to loose this hard drive !

I just ran the last scan with AVG, it identified the following:

"C:\WINDOWS\system32\drivers\cdrom.sys";"Virus identified Packed.Protector.C";"Object is white-listed (critical/system file that should not be removed)"
"C:\WINDOWS\system32\bnsr.exe (3216)";"Trojan horse SHeur2.CHPZ";"Reboot is required to finish the action"
"C:\WINDOWS\system32\bnsr.exe";"Trojan horse SHeur2.CHPZ";"Moved to Virus Vault"
"C:\WINDOWS\system32\bnsr.exe";"Trojan horse SHeur2.CHPZ";"Moved to Virus Vault"
"C:\WINDOWS\system32\bnsr.exe";"Trojan horse SHeur2.CHPZ";"Moved to Virus Vault"

I had to reboot to clear the above, and the trojan horse thingy from this morning is still there.

before I could reboot the computer began to crash with a System 32 error, before I could print screen it was gone, AVG must have put up a good fight.

The computer did what they called a loop 3 times then I started it in safe mode when given the opportunity. it gave me a blue screen of death and went down again. Then by some miracle it restarted. and I am here to tell you that the Darn system32/driver/cdrom.sys is back it must be accessed during the boot up.

So thank you friend I am now hitting the report button.

[dvk01]

Delete any existing version of ComboFix you have sitting on your desktop

Please read and follow all these instructions very carefully

Download ComboFix from Here to your Desktop.

**Note: It is important that it is saved directly to your desktop and run from the desktop and not any other folder on your computer**
--------------------------------------------------------------------
1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Very Important! Temporarily disable your anti-virus and anti-malware real-time protection and any script blocking components of them or your firewall before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results" or stop combofix running at all
• Click on THIS LINK to see instructions on how to temporarily disable many security programs while running combofix. The list does not cover every program. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again after combofix has finished

--------------------------------------------------------------------
2. Close any open browsers and any other programs you might have running

Double click on combofix.exe & follow the prompts.

If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?"
Please select yes & let it download the files it needs to do this
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" for further review


****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read HERE why we disable autoruns

Please do not install any new programs or update anything (always allow your antivirus/antispyware to update) unless told to do so while we are fixing your problem. If combofix alerts to a new version and offers to update, please let it. It is essential we always use the latest version.

[ReverendLisa]

ComboFix 10-01-23.06 - lisa 01/24/2010 8:06.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.586 [GMT -8:00]
Running from: c:\documents and settings\lisa\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\program files\Common
c:\program files\Common\_helper.dll
c:\program files\Common\_helper.sig
c:\windows\system32\tmp41.tmp
c:\windows\system32\WORK.DAT

Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\cdrom.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_ZWANGISEARCH_SERVICE
-------\Legacy_ZWANGISRCH_SERVICE
-------\Service_MyWebSearchService
-------\Service_ZwangiSearch Service
-------\Service_ZwangiSrch Service


((((((((((((((((((((((((( Files Created from 2009-12-24 to 2010-01-24 )))))))))))))))))))))))))))))))
.

2010-01-23 17:44 . 2010-01-23 01:16 356616 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgtdix.sys
2010-01-23 17:44 . 2010-01-23 01:15 161672 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgrkx86.sys
2010-01-23 17:44 . 2010-01-23 01:16 28424 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgmfx86.sys
2010-01-23 17:44 . 2010-01-23 01:16 12464 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgrsstx.dll
2010-01-23 17:44 . 2010-01-23 01:15 502040 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgrsx.exe
2010-01-23 17:36 . 2010-01-23 01:15 875288 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.exe
2010-01-23 17:36 . 2010-01-23 01:15 610072 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgiproxy.exe
2010-01-23 17:36 . 2010-01-23 01:15 1656088 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgupd.dll
2010-01-23 17:36 . 2010-01-23 01:15 798488 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avginet.dll
2010-01-23 03:25 . 2010-01-23 03:25 -------- d-----w- c:\documents and settings\lisa\Application Data\Malwarebytes
2010-01-23 03:25 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-23 03:25 . 2010-01-23 03:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-23 03:25 . 2010-01-23 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-23 03:25 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-23 01:26 . 2010-01-12 21:17 79872 ----a-w- c:\documents and settings\lisa\Application Data\Mozilla\Firefox\Profiles\e0w33ctb.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINNT_x86-msvc\components\WeaveCrypto.dll
2010-01-23 01:26 . 2010-01-12 21:17 33280 ----a-w- c:\documents and settings\lisa\Application Data\Mozilla\Firefox\Profiles\e0w33ctb.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\WINCE\components\WeaveCrypto.dll
2010-01-23 01:18 . 2010-01-23 01:18 -------- d-----w- c:\documents and settings\lisa\Local Settings\Application Data\AVG Security Toolbar
2010-01-23 01:16 . 2010-01-23 15:17 -------- d-----w- C:\$AVG
2010-01-23 01:16 . 2010-01-23 01:17 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2010-01-23 01:15 . 2010-01-23 17:43 161800 ----a-w- c:\windows\system32\drivers\avgrkx86.sys
2010-01-23 01:15 . 2010-01-24 03:19 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-22 17:49 . 2010-01-22 17:54 -------- d-----w- c:\documents and settings\lisa\Application Data\VoxOx2
2010-01-22 17:48 . 2010-01-22 22:59 -------- d-----w- c:\program files\VoxOx
2010-01-18 03:13 . 2010-01-18 03:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-01-18 03:13 . 2010-01-18 03:13 -------- d-----w- c:\documents and settings\lisa\Application Data\Office Genuine Advantage
2010-01-11 14:19 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-10 16:08 . 2010-01-10 16:08 -------- d-----w- c:\program files\Classic Menu for Office
2009-12-29 06:11 . 2009-12-29 06:11 -------- d-----w- c:\windows\SQL9_KB970892_ENU

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-24 07:11 . 2009-08-11 20:15 -------- d-----w- c:\documents and settings\All Users\Application Data\ZwangiSearch
2010-01-24 03:24 . 2009-04-05 04:59 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-23 18:53 . 2009-08-11 20:15 -------- d-----w- c:\program files\ZwangiSearch
2010-01-23 17:43 . 2009-03-14 17:00 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-01-23 17:43 . 2009-03-14 17:00 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-01-23 17:43 . 2007-09-29 05:02 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-01-23 04:38 . 2009-11-08 18:07 -------- d-----w- c:\program files\ZwangiSrch
2010-01-23 04:38 . 2009-11-08 18:07 -------- d-----w- c:\documents and settings\All Users\Application Data\ZwangiSrch
2010-01-23 01:16 . 2009-03-14 17:00 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-01-23 01:15 . 2009-03-14 17:00 -------- d-----w- c:\program files\AVG
2010-01-22 20:18 . 2009-12-11 23:05 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-01-18 02:54 . 2009-12-12 19:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-01-06 11:18 . 2008-09-02 01:46 -------- d-----w- c:\documents and settings\lisa\Application Data\Azureus
2010-01-03 02:47 . 2007-09-29 03:56 87936 ----a-w- c:\documents and settings\lisa\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-29 06:17 . 2009-12-15 05:55 -------- d-----w- c:\program files\Microsoft Works
2009-12-29 06:12 . 2009-12-15 06:32 -------- d-----w- c:\program files\Microsoft SQL Server
2009-12-24 07:40 . 2009-12-24 07:40 -------- d-----w- c:\program files\LG Electronics
2009-12-24 07:40 . 2007-09-28 05:49 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-12-22 19:01 . 2009-12-22 19:01 -------- d-----w- c:\program files\MSXML 6.0
2009-12-22 18:56 . 2008-09-02 01:45 -------- d-----w- c:\program files\Vuze
2009-12-21 19:14 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-21 17:21 . 2009-12-19 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-12-19 18:31 . 2009-12-13 19:30 -------- d-----w- c:\program files\ATI
2009-12-19 18:31 . 2008-06-03 01:35 -------- d-----w- c:\program files\ATI Technologies
2009-12-19 16:55 . 2009-12-19 16:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-18 19:27 . 2009-12-18 19:27 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-18 18:59 . 2009-12-18 18:39 6516755 ----a-w- c:\documents and settings\lisa\Application Data\Azureus\plugins\vuzexcode\ffmpeg.exe
2009-12-18 18:59 . 2009-12-18 18:39 4141117 ----a-w- c:\documents and settings\lisa\Application Data\Azureus\plugins\vuzexcode\mediainfo.exe
2009-12-18 18:57 . 2009-03-20 03:52 10686001 ----a-w- c:\documents and settings\lisa\Application Data\Azureus\plugins\azump\mplayer.exe
2009-12-18 18:40 . 2009-12-18 18:40 15884 ----a-w- c:\documents and settings\lisa\Application Data\Azureus\plugins\azitunes\libProcessAccess.dll
2009-12-18 18:40 . 2009-12-18 18:40 102400 ----a-w- c:\documents and settings\lisa\Application Data\Azureus\plugins\azitunes\jacob-1.14.3-x86.dll
2009-12-17 20:37 . 2009-12-17 20:36 -------- d-----w- c:\program files\iTunes
2009-12-17 20:36 . 2009-12-17 20:36 -------- d-----w- c:\program files\iPod
2009-12-17 20:36 . 2009-09-11 01:41 -------- d-----w- c:\program files\Common Files\Apple
2009-12-17 20:36 . 2008-01-17 04:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-12-17 20:33 . 2008-01-17 04:03 -------- d-----w- c:\program files\QuickTime Alternative
2009-12-17 20:17 . 2009-12-17 20:17 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-12-15 06:41 . 2009-12-15 06:40 -------- d-----w- c:\program files\Microsoft Small Business
2009-12-15 06:36 . 2009-12-15 05:53 -------- d-----w- c:\program files\Microsoft.NET
2009-12-15 06:29 . 2009-12-14 02:54 -------- d-----w- c:\documents and settings\lisa\Application Data\GetRightToGo
2009-12-14 02:24 . 2009-12-11 18:10 -------- d-----w- c:\program files\iPod(2)
2009-12-14 02:24 . 2009-12-11 18:10 -------- d-----w- c:\program files\iTunes(2)
2009-12-14 02:23 . 2009-12-11 22:11 -------- d-----w- c:\program files\Microsoft Expression
2009-12-14 02:23 . 2009-12-12 19:54 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-12-14 01:57 . 2008-10-11 01:08 -------- d-----w- c:\documents and settings\lisa\Application Data\OpenOffice.org2
2009-12-12 19:59 . 2009-03-13 03:45 -------- d-----w- c:\program files\MSBuild
2009-12-12 19:57 . 2009-12-12 19:57 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-12-12 19:53 . 2009-12-12 19:53 -------- d-----w- c:\program files\Microsoft Analysis Services
2009-12-12 19:38 . 2009-12-12 16:43 -------- d-----w- c:\documents and settings\lisa\Application Data\Download Manager
2009-12-12 09:08 . 2009-12-12 09:08 824424 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-12 03:30 . 2009-12-12 03:30 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-12-07 05:44 . 2008-06-02 04:18 -------- d-----w- c:\documents and settings\lisa\Application Data\Creative
2009-12-07 03:57 . 2009-12-07 01:33 -------- d-----w- c:\program files\Avidemux 2.5
2009-12-07 03:16 . 2009-12-07 03:16 12518 --sha-w- c:\windows\system32\KGyGaAvL.sys
2009-12-07 03:11 . 2009-12-07 03:11 -------- d-----w- c:\program files\RADVideo
2009-12-07 02:23 . 2009-12-07 02:23 -------- d-----w- c:\program files\Common Files\TechSmith Shared
2009-12-07 02:23 . 2009-12-07 02:23 -------- d-----w- c:\program files\TechSmith
2009-12-07 01:45 . 2009-01-31 07:54 -------- d-----w- c:\program files\AVS4YOU
2009-12-07 01:36 . 2009-12-07 01:33 -------- d-----w- c:\documents and settings\lisa\Application Data\avidemux
2009-12-07 00:19 . 2007-11-18 21:02 -------- d-----w- c:\program files\Wondershare
2009-12-06 18:37 . 2009-06-13 06:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Ahead
2009-12-06 18:36 . 2009-12-06 18:34 -------- d-----w- c:\program files\Common Files\Ahead
2009-12-06 18:34 . 2007-12-26 01:30 -------- d-----w- c:\program files\Nero
2009-12-06 18:34 . 2007-12-26 01:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero
2009-12-06 17:32 . 2007-11-13 14:51 -------- d-----w- c:\documents and settings\lisa\Application Data\ArcSoft
2009-12-06 17:00 . 2009-12-06 16:54 -------- d--h--w- c:\documents and settings\All Users\Application Data\ArcSoft
2009-12-06 16:54 . 2008-08-08 17:51 -------- d-----w- c:\program files\Common Files\ArcSoft
2009-12-06 16:52 . 2009-12-06 16:52 -------- d-----w- c:\program files\Kodak
2009-12-06 00:04 . 2009-09-11 01:47 -------- d-----w- c:\documents and settings\lisa\Application Data\Apple Computer
2009-11-25 18:43 . 2007-11-08 17:39 -------- d-----w- c:\documents and settings\lisa\Application Data\AdobeUM
2009-11-21 15:51 . 2004-08-04 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

------- Sigcheck -------

[7] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys
[-] 2008-04-13 18:40 . !HASH: COULD NOT OPEN FILE !!!!! . 96512 . . [------] . . c:\windows\system32\drivers\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys
[7] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.