[Closed] AntiVir keeps complaining that certain viruses keep re-a

Explorer.exe closes and re-opens as part of the OTMoveIt routine, that is normal.

Did Anti-vir tell you what it found? It could have been the process of moving that services.exe file. We could try some more scans. I would really like to see a Kaspersky scan run. Let's try AVP. It's by Kaspersky also, but a little different.

Please click here to download AVP Tool by Kaspersky.

• Save it to your desktop.
• Reboot your computer into SafeMode.
  

  You can do this by restarting your computer and continually tapping the F8 key until a menu appears.
  Use your up arrow key to highlight SafeMode then hit enter.

• Double click the setup file to run it.
• Click Next to continue.
• It will by default install it to your desktop folder.Click Next.
• Hit ok at the prompt for scanning in Safe Mode.
• It will then open a box There will be a tab that says Automatic scan.
• Under Automatic scan make sure these are checked.

• System Memory
• Startup Objects
• Disk Boot Sectors.
• My Computer.
• Also any other drives (Removable that you may have)

After that click on Security level then choose Customize then click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then choose ok.
Then choose OK again then you are back to the main screen.

• Then click on Scan at the to right hand Corner.
• It will automatically Neutralize any objects found.
• If some objects are left un-neutralized then click the button that says Neutralize all
• If it says it cannot be Neutralized then chooose The delete option when prompted.
• After that is done click on the reports button at the bottom and save it to file name it Kas.
• Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.
  
  

  Note: This tool will self uninstall when you close it so please save the log before closing it.

Did Anti-vir tell you what it found? It could have been the process of moving that services.exe file. We could try some more scans. I would really like to see a Kaspersky scan run. Let's try AVP. It's by Kaspersky also, but a little different.

Yes, AntiVir found this (I'm copying & pasting from 'Events' under AntiVir):

Virus or unwanted program 'TR/Runner.E [trojan]'
detected in file 'C:\WINDOWS\fix\system.exe.
Action performed: Delete file

I'm downloading AVP now (big file, around 33mb) and will run the scan soon.

Edit: I think I'll run it overnight later as it will take quite long to do so.

I could try to run the Kasperkey online java scan later again. It has already hanged twice but I could try it again I guess.

Yes, AntiVir found this (I'm copying & pasting from 'Events' under AntiVir):
CODE
Virus or unwanted program 'TR/Runner.E [trojan]'
detected in file 'C:\WINDOWS\fix\system.exe.
Action performed: Delete file

That's the file we moved. Too bad it didn't detect it before….


If you can get the webscanner to run that would be great. But AVP is good too.

By the way, when I went to safe mode just now to look around and test out installing AVP just now, during the installation of AVP, the log for OTMoveIt suddenly appeared (a notepad window popped up). This file had the same filename as the previous one but it has a bigger filesize. I'll just paste it here in case it's useful:

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File move failed. C:\WINDOWS\fix\system.exe scheduled to be moved on reboot.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\hsperfdata_Patrick\1584 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\etilqs_XxDgXCPz2sq2OcCj5czY scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF19A3.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF1BF5.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF35A7.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF5D8A.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF5D9E.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 02252009_221835

Files moved on Reboot…
File C:\WINDOWS\fix\system.exe not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\hsperfdata_Patrick\1584 not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\etilqs_XxDgXCPz2sq2OcCj5czY not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF19A3.tmp not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF1BF5.tmp not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF35A7.tmp not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF5D8A.tmp not found!
File C:\DOCUME~1\Patrick\LOCALS~1\Temp\~DF5D9E.tmp not found!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Patrick\Local Settings\Application Data\Mozilla\Firefox\Profiles\0tqa1hpg.default\XUL.mfl moved successfully.

Anyway, I did not run the AVP scan just now but I'll do so later.
Thanks for all your help so far.

I've scanned everything except 1 of my harddisks so far. The top 2 sections of the log is below:

Scan
—-
Scanned:	1543366
Detected:	8
Untreated:	0
Start time:	2/26/2009 7:48:10 AM
Duration:	12:40:52
Finish time:	2/26/2009 8:29:02 PM


Detected
——–
Status	Object
——	——
deleted: Trojan program Trojan-Spy.Win32.Pophot.cpc	File: C:\Program Files\Warcraft III\AutoRefresh\CBS Refresh.exe
deleted: virus Net-Worm.Win32.Kolabc.fvs	File: C:\_OTScanIt\MovedFiles\02222009_212834\C_WINDOWS\system\wmisys.exe
deleted: adware not-a-virus:AdWare.Win32.Gator.1050	File: D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\Documents and Settings\pooiyx\Desktop\Patrick\AGSetup0608.exe//fsg-ag.exe
deleted: Trojan program Trojan-Downloader.Java.OpenConnection.d	File: D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\Program Files\Norton AntiVirus\Quarantine\482833C0//CryptFF
deleted: Trojan program Trojan.Java.ClassLoader.d	File: D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\Program Files\Norton AntiVirus\Quarantine\591E5944//CryptFF
deleted: Trojan program Trojan.Java.ClassLoader.h	File: D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\Program Files\Norton AntiVirus\Quarantine\6DF43E4F//CryptFF
deleted: adware not-a-virus:AdWare.Win32.Adstart.l	File: D:\Laptop C drive (Sun 14 May 2006 to Thu 18 May 2006)\WINDOWS\SYSTEM32\SWin32.dll
deleted: adware not-a-virus:AdWare.Win32.Adstart.l	File: H:\Laptop C drive final backup (salvage from crashed laptop - Sat 9 Jun 2007)\WINDOWS\SYSTEM32\SWin32.dll

It took about 12h40mins to scan about 700GB worth of harddisk space. It may take a several hours longer than that to scan the remaining harddisk which is also the largest (1TB in capacity).
Is there any way to split up the scan into smaller segments? If not, then I'll just have to wait it out later to scan my remaining harddisk.

I manually stopped the scan after it finished all drives except my largest because it was already taking so long and I had to use my computer to do some other things.
Sorry for taking so long, my computer is more than 3 and a half years old and the processor is slow (1.81GHz), and I have a lot of harddisk space to scan.
I will try to finish scanning the remaining 1TB harddisk as soon as I can.

I wouldn't worry too much about the online scan. AVP picked up a couple other "fragments". Most were all quarantined and taken care of.

How is it running at this point in time? If it's running well then I think you're pretty good to go. We can clean up from the tools we have used, clear out your restore points, ect…

Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  
• [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

~~~~~~~~~~~~~~~~~~~~~~

• Make sure you have an Internet Connection.
• Double-click OTMoveIt3.exe to run it.
• Click on the CleanUp! button
• A list of tool components used in the Cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
• Click Yes to beging the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Let me know how it's running.

My system seems to be running fine, and I'm not getting anymore detections/popups from AntiVir. So do I still need to scan my remaining 1TB harddisk with AVP? If not, then I'll carry out the housekeeping steps later, and I will monitor my computer's performance and behaviour for a bit after that. I would also like to restore autorun to my CD drives when this is all over.

I think you're in pretty good shape. The usual regular scans with updated tools should suffice at this point.

I would also like to restore autorun to my CD drives when this is all over.

Again, it's your PC and it's up to you, but I strongly suggest you don't want it on.

If you don't believe me here is some more reading with technical details around this whole issue.

http://blogs.computerworld.com/test_your_d…sb_flash_drives

With the malicious worms that are spreading these days it's a small inconvenience that could save you from a BIG INCONVENIENCE later.

Run things for a couple days and let me know how you're making out.

I've let my computer run for about 2 days now and I don't get any more complaints/detections from AntiVir. I also did a full system scan with AntiVir and there were no detections. I ran HijackThis once more after the scan was over too. I have attached the logs for both in case they are useful.

I have read that article on USB flash drives and from it I have learnt which file to manually open on my CDs if I want to make the end result similar to autorun (I just need to check the autorun.inf file on each CD to know which file is actually being run when the disc is inserted). I play a lot of games using different CDs so I just need to know how to make them run and it would be good enough for me.
So bottom line is I'm convinced it's safer to leave my autorun disabled and I've learnt how to manually autorun my game CDs now.

I have a few more questions to ask you:

1. How do I format (or better still, disinfect/clean) my thumbdrives (which have been infected during this recent outbreak of malware I've had)? Now that I've disabled sharing folders, I need to use thumbdrives to transfer files between the different computers in my home. But these thumbdrives are all infected with malware, and I don't want to insert them into my computer. Is there any method to use to disinfect/format thumbdrives while preserving the integrity of (clean) computers?

2. During one of the earlier scans I mentioned that a "Removable Disk Y:" has now appeared for my system.
This is what happens when I select the Open option for it in My Computer:
[external image: Posted Image]
And this is what happens when I click "Eject this disk":
[external image: Posted Image]
Is there any way to remove it? If it's harmless, then I guess I can just leave it as it is.

3. Should I stick to using Avira AntiVir? Or is there a better free antivirus I can use for my system?

Thanks for all your help and advice so far.

So bottom line is I'm convinced it's safer to leave my autorun disabled and I've learnt how to manually autorun my game CDs now.

1. How do I format (or better still, disinfect/clean) my thumbdrives (which have been infected during this recent outbreak of malware I've had)? Now that I've disabled sharing folders, I need to use thumbdrives to transfer files between the different computers in my home. But these thumbdrives are all infected with malware, and I don't want to insert them into my computer. Is there any method to use to disinfect/format thumbdrives while preserving the integrity of (clean) computers?

Safest way is to probably format them if you don't need to save anything. You can also run the flash disinfector on them. Then give them a full scan with your Antivirus.

This is how to run Flash Disinfector:

Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.
  
  Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder…it will help protect your drives from future infection.

~~~~~~~~~~~~~~~~~~~~~~

2. During one of the earlier scans I mentioned that a "Removable Disk Y:" has now appeared for my system.
This is what happens when I select the Open option for it in My Computer:

Hmmm? Do you have a printer or some other device hooked up to the PC, that has a USB or other storage on it?

1. How do I format (or better still, disinfect/clean) my thumbdrives (which have been infected during this recent outbreak of malware I've had)? Now that I've disabled sharing folders, I need to use thumbdrives to transfer files between the different computers in my home. But these thumbdrives are all infected with malware, and I don't want to insert them into my computer. Is there any method to use to disinfect/format thumbdrives while preserving the integrity of (clean) computers?

Safest way is to probably format them if you don't need to save anything. You can also run the flash disinfector on them. Then give them a full scan with your Antivirus.

This is how to run Flash Disinfector:

Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.

• Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
• The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
• Wait until it has finished scanning and then exit the program.
• Reboot your computer when done.
  
  Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you run it. Don't delete this folder…it will help protect your drives from future infection.

How do I format my thumbdrive without the viruses on it spreading to my computer? I remember from previous experience, when I plugged in infected thumbdrives, AntiVir would automatically popup with a detection, and I dont want to risk that again because it seems AntiVir doesn't always "delete the root of the problems" (as can be seen from the various examples on these forums, my case included).

If I choose to use Flash Disinfector to clean my thumbdrives, will this program protect my computer from any malware which may jump into my computer when I plug the thumbdrive in (when Flash Disinfector asks me to)?

2. During one of the earlier scans I mentioned that a "Removable Disk Y:" has now appeared for my system.
This is what happens when I select the Open option for it in My Computer:

Hmmm? Do you have a printer or some other device hooked up to the PC, that has a USB or other storage on it?

Nope, the only such external devices I use are thumbdrives & digital cameras, and since my 1st post on these forums, I've not plugged any in at all because I know they are infected (or if they weren't they would have probably got infected by my computer at that time).

How do I format my thumbdrive without the viruses on it spreading to my computer? I remember from previous experience, when I plugged in infected thumbdrives, AntiVir would automatically popup with a detection, and I dont want to risk that again because it seems AntiVir doesn't always "delete the root of the problems" (as can be seen from the various examples on these forums, my case included).

It was popping up because Autorun/Autoplay was on. The malware was being automatically executed. Without that on now that won't happen. You may get a warning when you go to access the drive, and that's okay. Let Avira block the access or delete the file if so. Then format the drive right away. Just don't execute any files on the drive.

If I choose to use Flash Disinfector to clean my thumbdrives, will this program protect my computer from any malware which may jump into my computer when I plug the thumbdrive in (when Flash Disinfector asks me to)?

It will help. But you need a good all around security plan to prevent future infection.

Nope, the only such external devices I use are thumbdrives & digital cameras, and since my 1st post on these forums, I've not plugged any in at all because I know they are infected (or if they weren't they would have probably got infected by my computer at that time).

Hmm??? Not sure. I'll look into this a bit and see what I can find.

When I downloaded Flash_Disinfector.exe, AntiVir had this detection:
[external image: Posted Image]
This is normal behaviour I guess?

Yes, that's a false positive. My Avira doesn't like it either….that's normal for a lot of these tools.