Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with W32/GrayBird.ALQV


  • This topic is locked This topic is locked
2 replies to this topic

#1 alex4e

alex4e

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:00 PM

Posted 10 March 2010 - 05:59 AM

Norman Malware Cleaner
Version 1.6.2
Copyright 1990 - 2009, Norman ASA. Built 2010/03/08 09:41:53

Norman Scanner Engine Version: 6.04.08
Nvcbin.def Version: 6.04.00, Date: 2010/03/08 09:41:53, Variants: 5443289

Scan started: 08/03/2010 18:17:20

Running pre-scan cleanup routine:
Operating System: Microsoft Windows Vista 6.0.6002 Service Pack 2
Logged on user: Maziar-PC\Alex

Set registry value: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLS = "C:\PROGRA~1\KASPER~1\Kaspersky Anti-Virus 2009\mzvkbd.dll,C:\PROGRA~1\KASPER~1\Kaspersky Anti-Virus 2009\mzvkbd3.dll " -> ""

Scanning bootsectors...

Number of sectors found: 0
Number of sectors scanned: 0
Number of sectors not scanned: 0
Number of infections found: 0
Number of infections removed: 0
Total scanning time: 0s


Scanning running processes and process memory...

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Infected with W32/GrayBird.ALQV)
Terminated process
Failed to remove registry value (0x00000005): HKLM\Software\Microsoft\Windows\CurrentVersion\Run -> AVP = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe""
Removed service: AVP
Failed to delete file (0x00000005)

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Infected with W32/GrayBird.ALQV)
Failed to terminate process (0xC000010A)
Failed to remove service: AVP
Failed to delete file (0x00000005)

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Infected with W32/GrayBird.ALQV)
Failed to terminate process (0xC000010A)
Failed to remove service: AVP
Failed to delete file (0x00000005)

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Infected with W32/GrayBird.ALQV)
Failed to terminate process (0xC000010A)
Failed to remove service: AVP
Failed to delete file (0x00000005)

C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Infected with W32/GrayBird.ALQV)
Failed to terminate process (0xC000010A)
Failed to remove service: AVP
Failed to delete file (0x00000005)
Too many infections/an unexpected error (Please contact support)

Number of processes/threads found: 6315
Number of processes/threads scanned: 6315
Number of processes/threads not scanned: 0
Number of infected processes/threads terminated: 5
Total scanning time: 2m 52s


Scanning file system...

Scanning: prescan

Scanning: C:\Windows\*.*


Running post-scan cleanup routine:
Set TCP/IP autotuning to "normal" (or it was already "normal")

Aborted by user
Number of files found: 31017
Number of archives unpacked: 215
Number of files scanned: 31011
Number of files not scanned: 6
Number of files skipped due to exclude list: 0
Number of infected files found: 0
Number of infected files repaired/deleted: 0
Number of infections removed: 0
Total scanning time: 17m 22

Please help me in removing this malware. Thank You.

BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:02:00 PM

Posted 13 March 2010 - 12:31 AM

Hello alex4e smile.gif Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.


Please keep in mind that we have a large backlog of users just like yourself waiting to be helped so try to be as timely as possible in your replies. Since we do this on a part-time voluntary basis we are limited on how many logs we can respond to and keep open due to time restraints. If you have to be away or can't answer for some other reason just let me know. Thank you for your understanding.



After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.



In order to better assist you I will need the following. Along with it please give me a short description of any problems you may be having such as popups or redirections.




Download DDS and save it to your desktop from here or here.
Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt
  • Save both reports to your desktop, post the DDS.txt in the reply window and attach the Attach.txt









  • If you have any CD emulation software such as Daemon or Alcohol please run the following before you run GMER. If you do not skip DeFogger and go right on to GMER. If you do use it let me know so we can reenable when we finish up.



    Disable:


    Please download DeFogger to your desktop.

    Double click DeFogger to run the tool.
    • The application window will appear
    • Click the Disable button to disable your CD Emulation drivers.
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK
    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

    Do not re-enable these drivers until otherwise instructed.






    Download GMER Rootkit Scanner from here to your desktop.
    • Double click the exe file.
    • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan.



      Click the image to enlarge it


    • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
      • Sections
      • IAT/EAT
      • Drives/Partition other than Systemdrive (typically C:\)
      • Show All (don't miss this one)
    • Then click the Scan button & wait for it to finish.
    • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
    Save it where you can easily find it, such as your desktop, and post it in reply.

    **Caution**
    Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries




    If GMER does not want to run add the following to those that you unchecked and try it again:

    • Registry
    • Files












    Note: Please make only the Attach.txt from DDS an attachment, post the other logs directly into the reply window.



    Thanks,



    thewall



    If I have helped you then please consider donating so I can continue the fight against malware Posted Image
    All donations go directly to the helper

    Posted Image

    Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

    #3 thewall

    thewall

    • Malware Response Team
    • 6,425 posts
    • OFFLINE
    •  
    • Gender:Male
    • Location:Florida
    • Local time:02:00 PM

    Posted 18 March 2010 - 09:52 PM

    Due to the lack of feedback This Topic is closed.

    Should you need it reopened, please contact my by PM. Include the address of this thread in your request.

    If you have a new issue, please start a New Topic.

    This applies only to the original poster. Everyone else please begin a New Topic.
    If I have helped you then please consider donating so I can continue the fight against malware Posted Image
    All donations go directly to the helper

    Posted Image

    Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you




    0 user(s) are reading this topic

    0 members, 0 guests, 0 anonymous users