Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


infected with ofufgldx.exe, lsass.exe, lich.exe, sopidkc.exe & many more in temp folder

  • This topic is locked This topic is locked
4 replies to this topic

#1 sunnypic143


  • Members
  • 2 posts
  • Local time:09:42 PM

Posted 06 July 2009 - 04:32 AM

ok its xp drive thats affected and i'm posting logs from win7
i hope its works when posting logs from win7

ok to be on safer side i'll post logs from both win7 and win xp

i'd like to add i've tried gdata 2010 scans which removes these temporarily until they appear again
i also suspect that these files are trying to download stuff when im connected to net as my net usage is much above normal when surfing
so i feel safer posting from win7

of course i'll revert to win xp if required

also i tried installing combofix but iget the error
its not safe to continue
the combofix package has been compromised
probably infected by virut

and the downloaded combofix installer disappears

above was for cf in xp & its not compatible with win7 so no use

now for virut suspicions i researched over the net
results were bad claiming it to be unremovable

luckily i came across avg's virut removing tool on softpedia march 09 version
and it cleared me of virut on all drives
what a relief!!

now i'll be posting the logs
and i'll be tremenduously grateful to any one who volunteers to help

ok here's hjt log from win7

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:58:11 PM, on 7/6/2009
Platform: Unknown Windows (WinNT 6.01.3133)
MSIE: Internet Explorer v8.00 (8.00.7229.0000)
Boot mode: Normal

Running processes:
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\POL\POL.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Huawei technologies\HUAWEI Mobile Connect\HUAWEIDataCard.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Opera\opera.exe
E:\frm e\frm d\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files

O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [POL Agent] C:\Program Files\POL\POL.exe
O4 - HKCU\..\Run: [Google Update] "C:\Users\SATYAM\AppData\Local\Google\Update

\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint

O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader

O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files

O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files

O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files

O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{20C60CA5-2CCE-4180-BB9E-CDF5699D2301}: NameServer

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files

\Common Files\Logishrd\Bluetooth\LBTServ.exe

End of file - 3698 bytes

BC AdBot (Login to Remove)


#2 thcbytes


  • Malware Response Team
  • 14,790 posts
  • Gender:Male
  • Local time:11:12 AM

Posted 12 July 2009 - 03:23 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!


#3 sunnypic143

  • Topic Starter

  • Members
  • 2 posts
  • Local time:09:42 PM

Posted 17 July 2009 - 04:50 PM

how do i attach the dds log?

im posting them instead

this is from another xp installation on saME PARTITION under different folder name WINXP
this also got infected soon after installation
i cannot access the earlier xp though and i wanna recover it

ive tried norton 2009 avira nod and avast all latest version downloaded fron their respective sites
but they failed to install as apparently the virus modifies their packages during extraction
and they are terminated giving errors relating to packages being modified

my prime objective is to regain my earlier xp installation which i cannot currently boot into.
ive got the drwtsn logs for boot errors and they have got sth to do with ofufgldx.exe which i had deleted from my win7 installation
now i cannot even access my win 7 due to boot errors

here go the ddr logs from new xp installations

DDS (Ver_09-06-26.01) - NTFSx86
Run by Administrator at 2:30:31.78 on Sat 07/18/2009
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.625 [GMT 5.5:30]

============== Running Processes ===============

C:\WINXP\system32\svchost -k DcomLaunch
C:\WINXP\system32\svchost -k rpcss
C:\WINXP\System32\svchost.exe -k netsvcs
C:\WINXP\system32\svchost.exe -k NetworkService
C:\WINXP\system32\svchost.exe -k LocalService
C:\Program Files\Alwil Software\Avast4\ashServ.exe
svchost.exe C:\WINXP\TEMP\VRT43.tmp
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\Program Files\Huawei technologies\HUAWEI Mobile Connect\HUAWEIDataCard.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://search.orbitdownloader.com
uInternet Connection Wizard,ShellNext = hxxp://www.orbitdownloader.com/Grab-Pro.htm?r=install
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - c:\program files\orbitdownloader\orbitcth.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - c:\program files\orbitdownloader\GrabPro.dll
uRun: [reader_s] c:\documents and settings\administrator.home-66cba30009\reader_s.exe
mRun: [18426] c:\winxp\system32\162.tmp.exe
mRun: [services] c:\winxp\services.exe
mRun: [reader_s] c:\winxp\system32\reader_s.exe
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
dRun: [reader_s] c:\documents and settings\administrator.home-66cba30009\reader_s.exe
StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\orbit.lnk - c:\program files\orbitdownloader\orbitdm.exe
IE: &Download by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\orbitdownloader\orbitmxt.dll/202
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
TCP: {6430D05E-247C-4BF9-A34A-A7D6704C1F20} =

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1.hom\applic~1\mozilla\firefox\profiles\b8c4axql.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.orbitdownloader.com

c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R4 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-7-18 138680]
RUnknown aswFsBlk;aswFsBlk; [x]
RUnknown aswSP;aswSP; [x]

=============== Created Last 30 ================

2009-07-18 02:15 <DIR> --d----- c:\docume~1\admini~1.hom\applic~1\GrabPro
2009-07-18 02:13 <DIR> --d----- c:\program files\Yahoo!
2009-07-18 02:11 <DIR> --d----- c:\program files\Avira GmbH
2009-07-18 01:55 18,432 a------- c:\winxp\system32\47.tmp
2009-07-18 01:55 16,384 a------- c:\winxp\system32\46.tmp
2009-07-18 01:54 120 a------- c:\winxp\system32\44.tmp
2009-07-18 01:50 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Symantec
2009-07-18 01:50 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\Norton
2009-07-18 01:49 <DIR> --d----- c:\docume~1\alluse~1.win\applic~1\NortonInstaller
2009-07-18 01:48 <DIR> --d----- c:\documents and settings\Administrator.HOME-66CBA30009
2009-07-18 01:28 1,060,864 a------- c:\winxp\system32\MFC71.dll
2009-07-18 01:28 499,712 a------- c:\winxp\system32\MSVCP71.dll
2009-07-18 01:28 348,160 a------- c:\winxp\system32\MSVCR71.dll
2009-07-18 01:16 182,656 ac------ c:\winxp\system32\dllcache\ndis.sys
2009-07-18 01:15 0 a------- c:\winxp\system32\163.tmp
2009-07-18 01:14 73,216 a------- c:\winxp\services.exe
2009-07-18 01:14 18,432 a------- c:\winxp\system32\162.tmp
2009-07-18 01:14 47,104 a------- c:\winxp\system32\reader_s.exe
2009-07-18 01:14 120 a------- c:\winxp\system32\15F.tmp
2009-07-18 01:14 361,344 ac------ c:\winxp\system32\dllcache\TCPIP.SYS
2009-07-18 01:14 361,344 a------- c:\winxp\system32\drivers\TCPIP.SYS.ORIGINAL
2009-07-18 00:51 1,351,392 a------- c:\winxp\system32\comctl32.ocx
2009-07-18 00:51 <DIR> --d----- c:\program files\Golden Bow
2009-07-18 00:23 88,960 a------- c:\winxp\system32\drivers\ewusbmdm.sys
2009-07-18 00:22 361,344 a------- c:\winxp\system32\drivers\tcpip.copy
2009-07-18 00:17 <DIR> --ds---- c:\winxp\system32\Microsoft
2009-07-18 00:16 8,192 a------- c:\winxp\REGLOCS.OLD
2009-07-18 00:15 <DIR> --d----- c:\winxp\system32\xircom
2009-07-18 00:15 <DIR> --d----- c:\winxp\system32\wbem\snmp
2009-07-18 00:15 2,577 a------- c:\winxp\system32\CONFIG.NT
2009-07-18 00:15 0 a------- c:\winxp\control.ini
2009-07-18 00:15 23,392 a------- c:\winxp\system32\nscompat.tlb
2009-07-18 00:15 16,832 a------- c:\winxp\system32\amcompat.tlb
2009-07-18 00:15 316,640 a------- c:\winxp\WMSysPr9.prx
2009-07-18 00:14 <DIR> --dsh--- c:\documents and settings\all users.winxp\DRM
2009-07-18 00:14 488 a---hr-- c:\winxp\system32\WindowsLogon.manifest
2009-07-18 00:14 488 a---hr-- c:\winxp\system32\logonui.exe.manifest
2009-07-18 00:14 <DIR> --ds---- c:\winxp\Downloaded Program Files
2009-07-18 00:14 <DIR> --d--r-- c:\winxp\Offline Web Pages
2009-07-18 00:14 749 a---hr-- c:\winxp\WindowsShell.Manifest
2009-07-18 00:14 749 a---hr-- c:\winxp\system32\wuaucpl.cpl.manifest
2009-07-18 00:14 749 a---hr-- c:\winxp\system32\sapi.cpl.manifest
2009-07-18 00:14 749 a---hr-- c:\winxp\system32\nwc.cpl.manifest
2009-07-18 00:14 749 a---hr-- c:\winxp\system32\ncpa.cpl.manifest
2009-07-18 00:14 749 a---hr-- c:\winxp\system32\cdplayer.exe.manifest
2009-07-06 10:09 <DIR> --d----- c:\program files\STOPzilla!
2009-07-06 10:09 <DIR> --d----- c:\program files\common files\iS3
2009-07-06 00:36 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-07-05 20:56 <DIR> --d----- c:\program files\AVG
2009-07-05 20:23 <DIR> --d----- c:\program files\common files\Symantec Shared
2009-07-05 20:10 <DIR> --d----- c:\program files\NortonInstaller
2009-07-05 12:25 <DIR> --d----- c:\program files\NeoSmart Technologies
2009-07-05 09:34 <DIR> --d----- c:\program files\Prevx
2009-07-05 03:52 <DIR> --d----- c:\program files\common files\G DATA
2009-07-04 21:22 <DIR> --d----- c:\program files\CCleaner
2009-07-04 10:38 <DIR> --d----- c:\program files\Guitar Pro 5
2009-07-03 08:40 <DIR> --d----- c:\program files\GRETECH
2009-07-03 08:20 <DIR> --d----- c:\program files\Babylon
2009-07-01 23:13 <DIR> --d----- c:\program files\Stardock
2009-07-01 19:29 <DIR> --d----- c:\program files\VideoLAN
2009-07-01 14:58 <DIR> --d----- c:\program files\Orbitdownloader
2009-07-01 13:12 <DIR> --d----- c:\program files\common files\ACD Systems
2009-07-01 13:12 <DIR> --d----- c:\program files\ACD Systems
2009-07-01 12:59 <DIR> --d----- c:\program files\MSXML 4.0
2009-07-01 11:38 <DIR> --d----- c:\program files\DAMN NFO Viewer
2009-07-01 10:15 <DIR> --d----- c:\program files\SYSTRAN
2009-07-01 09:10 <DIR> --d----- c:\program files\Nuance
2009-07-01 08:23 <DIR> --d----- c:\program files\Windows Desktop Search
2009-07-01 08:22 <DIR> --d----- c:\program files\Windows Media Connect 2
2009-06-30 23:58 <DIR> --d----- c:\program files\common files\ODBC
2009-06-30 23:58 <DIR> --d----- c:\program files\common files\SpeechEngines
2009-06-30 20:58 <DIR> --d----- c:\program files\WinDjView
2009-06-30 20:00 <DIR> --d----- c:\program files\PowerISO
2009-06-30 19:47 <DIR> --d----- c:\program files\Intel Audio Studio
2009-06-30 19:46 <DIR> --d----- c:\program files\IDT
2009-06-30 19:14 <DIR> --d----- c:\program files\uTorrent
2009-06-30 18:45 <DIR> --d----- c:\program files\Huawei technologies
2009-06-30 18:38 <DIR> --d-h--- c:\program files\WindowsUpdate
2009-06-30 18:37 <DIR> --d----- c:\program files\common files\MSSoap
2009-06-30 18:35 <DIR> --d----- c:\program files\Online Services
2009-06-30 18:35 <DIR> --d----- c:\program files\Messenger
2009-06-30 18:35 <DIR> --d----- c:\program files\MSN Gaming Zone
2009-06-30 18:35 <DIR> --d----- c:\program files\Windows NT

==================== Find3M ====================

2009-07-18 01:16 182,656 a------- c:\winxp\system32\drivers\ndis.sys
2009-07-18 01:14 361,344 a------- c:\winxp\system32\drivers\TCPIP.SYS
2009-07-18 00:47 86,315 a------- c:\winxp\pchealth\helpctr\offlinecache\index.dat
2009-07-18 00:12 21,640 a------- c:\winxp\system32\emptyregdb.dat
2009-07-01 07:44 268,435,456 a--sh--- C:\WinPEpge.sys

============= FINISH: 2:30:45.32 ===============

PS. thnx for the reply
i'll be grate ful for any help

and its a request on my side not to ask for formatting my drives

#4 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:12 PM

Posted 18 July 2009 - 07:26 PM

Hi sunnypic143,

This file is a Virut file.

mRun: [reader_s] c:\winxp\system32\reader_s.exe

Your System is infected with Virut!!
Virut is a file infecting virus which is able to modify itself each and every time it runs. In addition, when it infects, sometimes it will destroy the file it tries to latch onto.
For these reasons, you really can't truly fix Virut. You will need to format/reinstall the operating system on this machine.

More information:

There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus.


W32/Virut.h is a polymorphic, entry point obscuring (EPO) file infector with IRC bot functionality. It can accept commands to download other malware on the compromised machine.
It appends to the end of the last section of executable (PE) files an encrypted copy of its code. The decryptor is polymorphic and can be located either:
Immediately before the encrypted code at the end of the last section
At the end of the code section of the infected host in 'slack-space' (assuming there is any)
At the original entry point of the host (overwriting the original host code)

Miekiemoes, one of our team members here and an MS-MVP, additionally has a blog post about Virut.


and its a request on my side not to ask for formatting my drives

Sorry, but the only alternatives are not perfect. As you now know it is not that easy.

I will post the other options but I, and Bleeping Computer, recommend the reformat/reinstall option.

If you insist on trying to fix this infection instead of following our advice to reformat and reinstall your operating system, there are various rescue disks available from major anti-virus vendors which you can try. Keep in mind, even the vendors like Kaspersky say there is no guarantee that some files will not get corrupted during the disinfection process. In the end most folks end up reformatting out of frustration after spending hours attempting to repair and remove infected files. IMO the safest and easiest thing to do is just reformat and reinstall Windows.

Bleeping Computer DOES NOT assume any responsibility for your attempt to repair this infection using any of the following tools. You do this at your own risk and against our advice.

These are links to Anti-virus vendors that offer free LiveCD or Rescue CD files that are used to boot from for repair of unbootable and damaged systems, rescue data, scan the system for virus infections. Burn it as an image to a disk to get a bootable CD. All (except Avira) are in the ISO Image file format. Avira uses an EXE that has built-in CD burning capability.If you are not sure how to burn an image, please read How to write a CD/DVD image or ISO. If you need a FREE utility to burn the ISO image, download and use ImgBurn.
Posted Image
m0le is a proud member of UNITE

#5 m0le


    Can U Dig It?

  • Malware Response Team
  • 34,527 posts
  • Gender:Male
  • Location:London, UK
  • Local time:04:12 PM

Posted 24 July 2009 - 11:40 AM

Since this issue appears to be resolved ... this topic has been closed. Glad we could help. :thumbup2:

If you're the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
Posted Image
m0le is a proud member of UNITE

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users