Edit : I managed to browse to those "blocked" sites through vtunnel.com \ proxies. This confirms the virus' work, it knows what to block but it doesn't block proxy sites. This of course breaks java \ flash \ other applet "online scan"tools - they do not like functioning through a proxy... - but I can atleast look at some instructions...not that they help XD..usually.
Edit 2 : If I hold alt-tab down, I see a "blank process" on the leftmost item in the list. By blank process I mean a process box with a "Blank" icon. The standard white box that is the one you get when there isn't an icon linked to it. Doesn ot appear under processes in task manager, selecting it does nothing..shouldn't be there though I'm pretty sure.
This current infection first appeared almost a week ago, I noticed odd behaviour on my pc's part, spawned .dll, .exe, .tmp files and the like.
I have noticed a LOT of things, and can name about 4-7 viruses \ trojans that several anti-virus\spyware engines think this can belong to.
One thing is certain. I formatted twice and this SOB came back, from a clean install!
It's disgusting, and clearly, reinstalling will NOT solve the problem, so I must face it.
Of course this poses a problem, the virus is known to :
Slow my PC down
Mask \ infect as actually important files in an attempt to get me to delete them
Modified registry to make itself run on startup
Most spyware\virus software I have remove or block it but cannot keep it from coming back.
I beleive I have a backdoor\downloader, as several new viruses and or infected files spawn here and there, including the "IE 5 content" folder which I never use (Pft IE).
After a random amount of time, usually hours after the boot I am using, the virus would "break" my system. The task manager would not come up, citing a 1 line memory address crash - any and all internet communication is immediately cut and several other files \ functions cease to work \ properly.
I'm a smart user who's had protection before, I check most of my files, sources, and I do not randomly open emails I have no clue about.
I've formatted and reinstalled twice. The second time I had my internet cable out (Despite needing a network driver to make it WORK), before I ran virutfix (One of the viruses I have is confirmed to be an agressive Virut variation apparently. ) in safe mode, then installed AVG, scanned with that - all was clean and good.
I am still on the same boot after that. initially, on my previous installation, this would infect my winlogon.exe and instead of booting to desktop as it should, this SOB made windows display the "username \ pass" screen, which was what raised my curiousity the first time around.
MY correct understanding is that the virus modified registry keys \ strings and forces itself to load unless in safe mode, so it is always there.
Once the virus is on my pc, access to popular virus-aid sites are blocked (PrevX, ewido, symantec and so forth). I cannot browse to those sites, it refuses to let me.
I currently have AVG installed and Ad-Aware anniversary eidition. Both fully upgraded and technically working fine.
Ad-aware usually blocks a malicous DL \ process from loading, but more often than now, AVG tells me a new file has been found on "open".. Most of the time it cannot fix\heal the file, so I have to move it to the virus vault. These files come around once every 15 minutes on average - often duplicates.
CWShredder and Vundofix both did NOT detect either viruses on my computer, ruling them out.
I will now try to list the files I caught DURING THIS INSTALLATION which is not six hours old. I hope this helps narrow it down...
Windows\System32 :
\restore\rstrui.exe
\dllcache\iexpress.exe
\dllcache\fp98sadm.exe
msswchx.exe
DSndUp.exe
System volume information : A0000767 or 795.exe
\recycler\dd9.exe
vsdrgwrtje44.exe (Number at the end can vary)
It also likes spawning various ".tmp" extension files in my system32 \ temp \ prefertch folder.
Please, for the love of god, help me remove this thing, it's disgustingly persistent >-<.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:36:59, on 2009.05.04.
Platform: Windows XP Szervizcsomag 2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\Explorer.EXE
E:\AVG8\avgtray.exe
D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Program Files\Analog Devices\Core\smax4pnp.exe
D:\Program Files\Analog Devices\SoundMAX\Smax4.exe
D:\WINDOWS\system32\RUNDLL32.EXE
E:\AVG8\avgwdsvc.exe
D:\WINDOWS\system32\nvsvc32.exe
E:\AVG8\avgemc.exe
E:\AVG8\avgrsx.exe
E:\AVG8\avgnsx.exe
E:\AVG8\avgcsrvx.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\dhcp\svchost.exe
E:\Steam\Steam.exe
D:\WINDOWS\system32\rundll32.exe
E:\AVG8\avgui.exe
E:\AVG8\avgcsrvx.exe
E:\Downloads\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hivatkozások
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\AVG8\avgtoolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [AVG8_TRAY] E:\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Ad-Watch] D:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] D:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "D:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "D:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="D:\Program Files\Common Files\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.50\english\PhysX_9.09.0203_SystemS oftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'HELYI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'HÁLÓZATI SZOLGÁLTATÁS')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\AVG8\avgpp.dll
O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll
O20 - Winlogon Notify: avgrsstarter - D:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - E:\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - E:\AVG8\avgwdsvc.exe
O23 - Service: Dhcp server (DhcpSrv) - Unknown owner - D:\WINDOWS\dhcp\svchost.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4044 bytes
Note that \thunmail\testabd..dll isn't only a recurring virus it likes downloading - but I don't use thunderbird. I also of course "checked" it in hijackthis to remove it...
Edited by Blackwing Dragon, 04 May 2009 - 11:04 AM.