1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

downloaded malware or virus

Discussion in 'Virus & Other Malware Removal' started by arpit15, Nov 11, 2009.

Thread Status:
Not open for further replies.
Advertisement
  1. arpit15

    arpit15 Thread Starter

    Joined:
    Jan 25, 2009
    Messages:
    34
    I went to the following site: www.thekeys.ws/?look=prevx+csi+3.0+activation+key
    and downloaded some .exe file and ran it like a fool. It was immediately detected by my av for some backdoor dropper virus. And after that i am having problems working in windows in normal mode. Everything just hangs and the mouse doesnt respond. THe computer has just come fresh after a windows re-installation. I know i shouldn hav downloaded that file. But now i want to repair the system. PLease help me. I am using windows xp sp2, intel t1300 1.66ghz, 1gb ram and 80 gb hdd.
    I will log into the normal mode and take a hijack log and post that.
     
  2. arpit15

    arpit15 Thread Starter

    Joined:
    Jan 25, 2009
    Messages:
    34
    I forgot to mention that i am using Avast AV.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:12:07 PM, on 11/11/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\msdrv32.exe
    C:\WINDOWS\system\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
    F3 - REG:win.ini: load=C:\WINDOWS\system\svchost.exe
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
    O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\msdrv32.exe
    O4 - HKCU\..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe
    O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\msdrv32.exe
    O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

    --
    End of file - 3461 bytes
     
  3. arpit15

    arpit15 Thread Starter

    Joined:
    Jan 25, 2009
    Messages:
    34
    i ran a full scan using malwarebytes Anti-malware:

    Malwarebytes' Anti-Malware 1.41
    Database version: 3147
    Windows 5.1.2600 Service Pack 2

    11/12/2009 12:42:07 AM
    mbam-log-2009-11-12 (00-42-07).txt

    Scan type: Full Scan (C:\|F:\|)
    Objects scanned: 116609
    Time elapsed: 33 minute(s), 45 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 10
    Registry Values Infected: 3
    Registry Data Items Infected: 2
    Folders Infected: 1
    Files Infected: 31

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tqr1490 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tqr1490 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\tqr1490 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tqr1490 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tqr1490 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mjlebd5 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mjlebd5 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mjlebd5 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\mjlebd5 (Backdoor.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mjlebd5 (Backdoor.Agent) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup (Worm.Palevo) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811 (Trojan.Agent) -> Quarantined and deleted successfully.

    Files Infected:
    C:\RECYCLER\S-1-5-21-3670924984-5335988715-185390642-0982\wnzip32.exe (Worm.Autorun.B) -> Delete on reboot.
    C:\RECYCLER\S-1-5-21-7735441797-0909093588-891393348-1052\cht2009.exe (Trojan.Generic) -> Delete on reboot.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000009.exe (Trojan.Buzus) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000017.sys (Rootkit.Rustock) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000024.exe (Trojan.Buzus) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000039.exe (Trojan.Buzus) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000045.exe (Trojan.Buzus) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000047.exe (Trojan.Generic) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{09F20477-27C6-4398-886B-F0A4BD05D1DA}\RP1\A0000060.exe (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\glaide32.sys (Rootkit.Rustock) -> Delete on reboot.
    C:\WINDOWS\system32\drivers\tqr1490.sys (Backdoor.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\mjlebd5.sys (Backdoor.Agent) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\29.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\2E.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\32.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\6.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\C.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\7zS2F.tmp\update.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\7zS3.tmp\update.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
    F:\ARPIT\user.RAKESH\Local Settings\Temp\7zS9.tmp\update.exe (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\msvddr32.exe (Backdoor.IRCBot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\cryptdiag.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\dxvars.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ipcmd.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sysdiag.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\winntcmd_2_0.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\winntlog_uni.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\msdrv32.exe (Worm.Palevo) -> Delete on reboot.
    C:\sesk.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
     
  4. arpit15

    arpit15 Thread Starter

    Joined:
    Jan 25, 2009
    Messages:
    34
    i am attaching the screenshot of the malware which i m not able to remove.
     

    Attached Files:

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/876453

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice