Member Avatar for anthrax_sexy

i used hijackthis...
n i am posting my log..
kindly guide me how to get rid of this virus...which makes new folders in my computer of size 104 kb...disables my task manager, standby and hibernation, hides my folder options...
pleaseee help

Logfile of HijackThis v1.99.1
Scan saved at 12:09:28 AM, on 2/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\lsass.exe
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Rahul Puri\Desktop\InstallPREVX102010030.exe
C:\DOCUME~1\RAHULP~1\LOCALS~1\Temp\SFX60.tmp\PXSetup.exe
C:\Documents and Settings\Rahul Puri\Desktop\hijackthis.exe
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\3a84255fa53bf624e6efd81d8d5d3ebf\update\update.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = <Dangerous Link Removed>
F2 - REG:system.ini: Shell=explorer.exe C:\WINDOWS\system\lsass.exe
F2 - REG:system.ini: UserInit=userinit.exe,C:\WINDOWS\system\lsass.exe
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SVCHOST] C:\WINDOWS\svchost.exe
O4 - HKLM\..\Run: [Task Manager] C:\WINDOWS\svhost32.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe
O4 - Global Startup: MSconfig.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: Washer AutoComplete (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

  • 2 Contributors
  • 4 Replies
  • 228 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

This symptom set — removable drives getting identical new folders (~104 KB), Folder Options/Registry Editor/Task Manager disabled, and startup/system.ini altered — strongly matches an autorun/USB worm that hides real files and drops a copy of itself on every removable volume. Containment first: disconnect affected USB sticks and the PC from networks, avoid opening any shortcuts or unknown files, and back up only personal documents (not executables) from a clean environment if possible.

Following ’s initial cleanup advice, add these targeted steps before reusing media or trusting the system again.

  1. Reveal and clean removable drives (example for drive F:). Run a Command Prompt (Safe Mode preferred) and execute:

    attrib -h -s -r /s /d F:\*.*
del F:\autorun.inf

    Inspect any remaining EXE/LNK files before deleting; do not remove files you need without checking them. If many drives are infected, format them after rescuing data.

  2. Repair startup and system.ini edits. Boot to Safe Mode, open Notepad as admin and load C:\Windows\system.ini. Ensure the Shell and UserInit lines contain only the normal entries (e.g., Shell=explorer.exe and UserInit=userinit.exe) — remove any extra paths appended by malware. Remove suspicious Run entries that point to oddly named executables inside the Windows folder (use msconfig, HijackThis, or the Registry Editor in Safe Mode).

  3. Restore disabled tools. Save the following as restore.reg and import it (double-click or use regedit in Safe Mode) to re-enable Task Manager, Registry Editor and Folder Options:

    
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"DisableRegistryTools"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFolderOptions"=dword:00000000



4) Verify and harden. After the manual clean, run a full scan with an up-to-date, reputable anti-malware scanner (in Safe Mode if possible), rescan removable media, change important passwords, and install all OS/security updates. If uncertainty remains or infections persist, rescue-boot (CD/USB) with a trusted clean environment or ask for a fresh HijackThis log and scan results so the community (or a tech) can confirm the cleanup.

Recommended Answers

All 4 Replies

Member Avatar for gerbil

hello, sexy.
===Download this temp file cleaner from http://www.atribune.org/ccount/click.php?id=1
--click in the download window to run it, and when ATF Cleaner opens go Select all, and then Empty Selected.
Next click Firefox at the top, Select All again, and Empty Selected again.
Close ATF.
===Get Adaware SE Personal from
- install it. Update it. Explore what settings you can change in it [via the cogwheel icon up top, if you are comfortable with that... you won't hurt anything, but for the present please keep the default settings]. Put an icon on your desktop for regular use.
===GET AVG antispyware 7.5 here.. http://free.grisoft.com/doc/5390/lng/us/tpl/v5 -the link is almost at the bottom of the page , avgas 7.5.0.50. Install it and update it.
===Restart your computer in Safe Mode:- press F8 several times while POST is running and before IDE detection completes.
- On the Windows Advanced Options Menu, select Safe Mode and press Enter.
- When the Boot Menu appears again, select Microsoft Windows XP and press Enter.
- Log in by using the your account if an admin type, or Administrator account and password. NOTE: The password is blank by default unless you set a password.

Run Adaware, doing a full system scan and finally remove all that it finds [rclick in the scan results window and select all, go next..]. If Adaware finds anything apart from cookies or your MRU list then, after removing those items you should repeat the scan [and removal] and so on until it comes up clean.

Start AVG a-s 7.5; under Scanner/ Settings set Recommended actions to Quarantine, and run the scan. Save the log file and only then click Apply all actions. Post the log file.
Reboot to normal mode.
===Next try an online scan at panda:- http://www.pandasoftware.com/products/activescan?
-the link to the scan is just above the padlock pic.... free online virus scan.. enter a valid? email and follow through, choosing My Computer for a full system scan.
Post the log it produces here, along with a fresh Hijackthis log.

Member Avatar for gerbil

hang on, first do this as a matter of urgency!!
Start hijackthis, do a scan and put a check against this entry:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = xxxxxxxxxx [zinblog]
and press Fix Checked.
You go there, u get a virus. I killed the link in the post so no-one would click on it... :)
AND DO THAT PANDA SCAN FIRST, right after the ATF cleaner runs.

Member Avatar for anthrax_sexy

thanx gerbil for a prompt reply...i will follow every step tht u told...and will let u know..keep checking my thread please..n i checkd n fixed tht zinblog.com thing..
thanx mate
keep in touch

Member Avatar for gerbil

good-oh, i clicked on it while checking ur log just to make sure. it dl'd me a virus inside 5 secs!!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.