Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Unknown virus/malware causing Explorer to crash/restart.


  • Please log in to reply
1 reply to this topic

#1 superherofive

superherofive

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:27 AM

Posted 24 December 2008 - 01:32 PM

My father-in-law downloaded a program yesterday that made a link to a free e-card making website. Since then he restarted his laptop to find that Windows Explorer would crash and then restart. It will continue to do this for a few minutes before it stops loading Explorer. I can manually start it up again through the Task Manager, but it continues its previous actions. The laptop is running Windows XP Pro SP3 and AVG Free as its antivirus. My father-in-law scanned and found 5 infected objects, however he 'healed' them without getting their names. Here is the DDS report:


DDS (Version 1.1.0) - NTFSx86
Run by Spence Gibbs at 13:10:04.70 on Wed 12/24/2008
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.454 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Spence Gibbs\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg8\avgssie.dll
BHO: N/A: {46DDFA46-B704-495A-95F7-91E071E9C92D} - c:\windows\system32\khfGyvuR.dll
BHO: N/A: {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\vtUlICSM.dll
BHO: SSVHelper Class: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon
mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
Notify: igfxcui - igfxdev.dll
Notify: vtUlICSM - vtUlICSM.dll
AppInit_DLLs: avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\vtUlICSM.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\khfGyvuR

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\spence gibbs\application data\mozilla\firefox\profiles\lvj2bnxv.default\
FF - prefs.js: browser.startup.homepage - hxxp://mail.google.com/mail/?hl=en&tab=wm#inbox
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-17 97928]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-6-17 26824]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-8-29 875288]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-8-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-6-17 76040]
R3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-24 38496]

=============== Created Last 30 ================

2008-12-24 13:02 <DIR> --d----- c:\docume~1\spence gibbs\application data\Malwarebytes
2008-12-24 13:02 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-24 13:02 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-24 13:02 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2008-12-24 13:02 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Malwarebytes
2008-12-24 11:20 <DIR> --d----- c:\program files\Trend Micro
2008-12-24 10:27 417,887 a------- c:\program files\Uninstall Fun Web Products.dll
2008-12-24 01:42 <DIR> --d----- C:\$AVG8.VAULT$
2008-12-24 01:38 962,617 a--sh--- c:\windows\system32\RuvyGfhk.ini2
2008-12-24 01:38 963,068 a--sh--- c:\windows\system32\RuvyGfhk.ini
2008-12-24 01:38 302,592 a------- c:\windows\system32\khfGyvuR.dll
2008-12-24 01:33 45,056 a------- c:\windows\system32\tuvTLBrR.dll
2008-12-24 01:33 34,816 a------- c:\windows\system32\vtUlICSM.dll
2008-12-24 01:32 45,056 -------- c:\windows\system32\wpv281230091279.cpx
2008-12-24 01:32 22,016 a------- c:\windows\system32\~.exe
2008-11-25 15:06 <DIR> --d----- c:\windows\system32\Dell

==================== Find3M ====================

2008-10-31 17:48 48,112 a------- c:\docume~1\spence gibbs\application data\GDIPFONTCACHEV1.DAT
2008-10-28 17:59 717,296 a------- c:\windows\system32\drivers\sptd.sys
2008-10-23 07:36 286,720 a------- c:\windows\system32\gdi32.dll
2008-10-15 20:00 666,112 a------- c:\windows\system32\wininet.dll
2008-10-03 05:02 247,326 a------- c:\windows\system32\strmdll.dll
2008-09-30 16:43 1,286,152 a------- c:\windows\system32\msxml4.dll

============= FINISH: 13:11:25.87 ===============


Any help you guys can provide would be much appreciated. Thanks for your time.

Attached Files



BC AdBot (Login to Remove)

 


#2 sjpritch25

sjpritch25

  • Security Colleague
  • 898 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:West Coast of Florida, USA
  • Local time:12:27 PM

Posted 05 January 2009 - 10:04 PM

Welcome to BC :thumbsup:

Sorry for the delay


Please download Malwarebytes Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Quick Scan, then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply with a fresh Hijackthis log too.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.
Microsoft MVP Consumer Security--2007-2010




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users