Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

initial Antivirus scan ok subsequent immediate antivirus scan shows as infected...


  • This topic is locked This topic is locked
2 replies to this topic

#1 andy_uv

andy_uv

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:12:40 AM

Posted 25 November 2009 - 02:34 PM

Hello Friends

I believe my PC is infected.
Day before Yesterday night I had a complete scan of my PC using AVAST antivirus and it did not show any infection.I keep my antivirus software completely

upto date I have a screensaver which when avtivated, activates the avast antivirus to scan files randomly and ist displayed on the screen. After complete

scanning of my PC later in the day when the screensaver activated the avast antivirus to scan files randomly, it detected the following VIRUS infection -

Win32:Trojan-gen in couple of my installed software application which I had not used last couple of days.I moved the files to the virus vault.
In addition to AVAST AV I have installed the following PC protection softwares and I keep them upto date.

Spybot Search & Destroy
AVG Free 8.5
Ad-Aware
Spyware terminator
Malwarebytes Anti- Malware
Windows Defender

I scanned using the above softwares and the results were negative.

Two days back AVG Free AV reported the software app for playing DVD files on my PC as infected,the infection being Trojan horse Generic14.FPT. I immediately

uninstalled it and tried to do a fresh installation of the same app (HERO DVD player)and during installation I again got the warning saying the installation

file is infected. Is it possible for the only single installation file (Set up file) to get infected if its not touched for a long time. Similarly the main

setup file of some other app were also reported as infected although they have been in my harddisk untouched for a long time.

Simillary couple of days back my system restore files were also infected which i removed by deleting the system restore file.
Right now I have the installation file (Set up file) of some programs used regularly saved on my hardidsk and am unsure if any of them are infected.

Kindly guide what need to be done to ensure all infection IF ANY are cleaned.How do i ensure right now my system is infection free?
I read on your site abt softwware like combofix ...I downloaded it but has not yet run it.Pls guide
In anticipation.

In addition to the above a new problem surfaced in that I installed the free zone alarm sofware the other day and late uninstalled it as it was a very old

version.later when i checked in START-SETTINGS-CONTROL PANNEL- ADD/REMOVE PROGRAM list, many of the installed programs including some of the above listed

programs although running were not listed in the ADD-REMOVE list.

kindly guide
In anticipaion

Thanks

................................................................................

The DDS .txt file ....


DDS (Ver_09-11-24.02) - NTFSx86
Run by Sudhir at 0:24:38.10 on Thu 11/26/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2029.1147 [GMT 5.5:30]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: avast! antivirus 4.8.1356 [VPS 091125-1] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: *disabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
E:\Windows Defender 32\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
svchost.exe
svchost.exe
E:\Avast\aswUpdSv.exe
E:\Ad-Aware Aniversary edition\Lavasoft\Ad-Aware\AAWService.exe
E:\Avast\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
E:\AVGANT~1\avgwdsvc.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
E:\NERO (ULTRA) 7\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\SQL 2005 Standard Edition\MSSQL.1\MSSQL\Binn\sqlservr.exe
E:\AVGANT~1\avgrsx.exe
E:\AVGANT~1\avgnsx.exe
E:\SQL 2005 Standard Edition\MSSQL.2\OLAP\bin\msmdsrv.exe
E:\SQL 2005 Standard Edition\MSSQL.3\Reporting Services\ReportServer\bin\ReportingServicesService.exe
E:\Spyware Terminator 2.3.0.487\Spyware Terminator\sp_rsser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
E:\AVGANT~1\avgemc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
E:\AVG Anti-Virus\avgcsrvx.exe
E:\Avast\ashMaiSv.exe
E:\Avast\ashWebSv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
E:\AVGANT~1\avgtray.exe
E:\Spyware Terminator 2.3.0.487\Spyware Terminator\SpywareTerminatorShield.exe
E:\Avast\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
E:\NERO (ULTRA) 7\Nero 7\InCD\InCD.exe
E:\Windows Defender 32\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Ad-Aware Aniversary edition\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Sudhir\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Connection Wizard,ShellNext = iexplore
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - e:\orbit downloader 2.8.1\orbitdownloader\orbitcth.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - e:\avg anti-virus\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: {a057a204-bacc-4d26-9990-79a187e2698e} - AVG Security Toolbar
BHO: : {fffffef0-5b30-21d4-945d-000000000000} - e:\program files\star downloader\SDIEInt.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} -
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - e:\orbit downloader 2.8.1\orbitdownloader\GrabPro.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SmcService] e:\sygate~1\smc.exe -startgui
mRun: [AVG8_TRAY] e:\avgant~1\avgtray.exe
mRun: [SpywareTerminator] "e:\spyware terminator 2.3.0.487\spyware terminator\SpywareTerminatorShield.exe"
mRun: [avast!] "e:\avast\ashDisp.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [InCD] e:\nero (ultra) 7\nero 7\incd\InCD.exe
mRun: [Windows Defender] "e:\windows defender 32\MSASCui.exe" -hide
mRun: [Malwarebytes Anti-Malware (reboot)] "e:\malwarebytes anti-malware\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: &Clean Traces
IE: &Download by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/201
IE: &Download with &DAP
IE: &Grab video by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/204
IE: + &Download Express: download this file - e:\download express 1.9\download express\Add_Url.htm
IE: Do&wnload selected by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - e:\orbit downloader 2.8.1\orbitdownloader\orbitmxt.dll/202
IE: Download &all with DAP
IE: Download with Star Downloader - e:\program files\star downloader\sdie.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - e:\avg anti-virus\avgpp.dll
Name-Space Handler: FTP\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - e:\download express 1.9\download express\mdpph.dll
Name-Space Handler: HTTP\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - e:\download express 1.9\download express\mdpph.dll
Name-Space Handler: https\HIEClickCatcher - {E131C96E-4DDB-11D4-84B8-008048B33DEA} - e:\download express 1.9\download express\mdpph.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - e:\windows defender 32\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sudhir\applic~1\mozilla\firefox\profiles\2r1e3uhf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.in/
FF - plugin: e:\firefox\mozilla firefox\plugins\npstar.dll
FF - plugin: e:\realoneplayerv2gold\netscape6\nppl3260.dll
FF - plugin: e:\realoneplayerv2gold\netscape6\nprjplug.dll
FF - plugin: e:\realoneplayerv2gold\netscape6\nprpjplug.dll

---- FIREFOX POLICIES ----
e:\firefox\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-11-4 64160]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-10-16 114768]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-6-1 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-6-1 108552]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-8-31 141312]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-10-16 20560]
R2 avg8emc;AVG8 E-mail Scanner;e:\avgant~1\avgemc.exe [2008-7-3 908056]
R2 avg8wd;AVG8 WatchDog;e:\avgant~1\avgwdsvc.exe [2008-7-3 297752]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;e:\ad-aware aniversary edition\lavasoft\ad-aware\AAWService.exe [2009-7-3 1028432]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 ReportServer;SQL Server Reporting Services (MSSQLSERVER);e:\sql 2005 standard edition\mssql.3\reporting services\reportserver\bin\ReportingServicesService.exe [2005-10-14 14552]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-7-6 16512]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;e:\visual studio 2005\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]

=============== Created Last 30 ================

2009-11-23 18:35:52 249856 ------w- c:\windows\Setup1.exe
2009-11-23 18:35:51 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-11-23 18:04:51 272 ---ha-w- c:\windows\system32\vsconfig.xml
2009-11-23 17:45:01 0 d-----w- c:\windows\system32\ZoneLabs
2009-11-19 06:03:02 0 d-----w- C:\Driver
2009-11-19 06:02:55 74 ---ha-w- c:\windows\ACLASS.DMF
2009-11-19 06:02:52 57344 ------w- c:\windows\dvdrgn.exe
2009-11-19 06:02:52 25 ----a-w- c:\windows\UCMDPPG.ETF
2009-11-19 06:01:54 0 d-----w- c:\program files\common files\Ulead Systems
2009-11-16 01:09:46 9600 -c--a-w- c:\windows\system32\dllcache\hidusb.sys
2009-11-16 01:09:46 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2009-11-16 01:09:39 59264 -c--a-w- c:\windows\system32\dllcache\usbaudio.sys
2009-11-16 01:09:39 59264 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2009-11-16 01:09:32 31616 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-11-16 01:09:32 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-11-05 18:10:56 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-11-04 17:04:26 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-11-04 16:05:42 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-04 16:05:23 0 dc-h--w- c:\docume~1\alluse~1\applic~1\{EF63305C-BAD7-4144-9208-D65528260864}

==================== Find3M ====================

2009-11-23 18:06:27 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-09-06 04:53:57 11952 ----a-w- c:\windows\system32\avgrsstx.dll

============= FINISH: 0:25:04.81 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 fireman4it

fireman4it

    Bleepin' Fireman


  • Malware Response Team
  • 13,505 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Greenup, Ill USA
  • Local time:02:10 PM

Posted 30 November 2009 - 07:23 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

" Extinguishing Malware from the world"

The Virus, Trojan, Spyware, and Malware Removal forum is very busy. If I'm helping you and I've not posted back within 24 hrs., send a PM with your topic link. Thank you.

ALL OTHER HELP REQUESTS VIA THE PM SYSTEM WILL BE IGNORED. The Forums are there for a reason!
Thanks-


  userbar_eis_500.gif

If I have helped you, consider making a donation to help me continue the fight against Malware! Just click btn_donate_LG.gif


#3 SpySentinel

SpySentinel

  • Staff Emeritus
  • 2,090 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The United States
  • Local time:02:10 PM

Posted 07 December 2009 - 01:03 PM

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with the link to this thread.

Everyone else please start a new topic.
Posted Image
Unified Network of Instructors and Trained Eliminators

Posted Image

My help is always free, but if you can, please Posted Image to help me continue the fight against malware.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users