[Resolved] PAV virus

Combofix ran OK. Looks like it removed several items. Log file is attached. Kelly

rkforan,

That should have made a big difference in the operation.

LimeWire, Azureus, and FrostWire
You have LimeWire, Azureus, and FrostWire, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm://http://www.techweb.com/wire/1605005…cles/art053.htm


I would recommend that you uninstall LimeWire, Azureus, and FrostWire, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Download Rooter.exe to your desktop

• Then doubleclick it to start the tool
  
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
• Please post this log in your next reply.

I uninstalled limewire, but the other two were not listed in as an installed program. I ran the rooster program OK. Log file is below. The kaspersky program would not finish loading. I tried four times. It complatined that the key had expired. Kelly Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully … . Windows Vista Home Edition (6.0.6001) Service Pack 1 [32_bits] - x86 Family 6 Model 15 Stepping 13, GenuineIntel . [wscsvc] (Security Center) RUNNING (state:4) [MpsSvc] RUNNING (state:4) Windows Firewall -> Disabled ! Windows Defender -> Disabled ! User Account Control (UAC) -> Enabled . Internet Explorer 7.0.6001.18000 . C:\ [Fixed-NTFS] .. ( Total:231 Go - Free:192 Go ) D:\ [CD_Rom] . Scan : 19:30.15 Path : C:\Users\Heather\Desktop\Rooter.exe User : Heather ( Administrator -> YES ) . ———————-\\ Processes . Locked [System Process] (0) Locked System (4) ______ \SystemRoot\System32\smss.exe (512) ______ C:\Windows\system32\csrss.exe (568) ______ C:\Windows\system32\wininit.exe (620) ______ C:\Windows\system32\csrss.exe (628) ______ C:\Windows\system32\services.exe (664) ______ C:\Windows\system32\lsass.exe (676) ______ C:\Windows\system32\lsm.exe (696) ______ C:\Windows\system32\winlogon.exe (764) ______ C:\Windows\system32\svchost.exe (880) ______ C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (920) ______ C:\Windows\system32\svchost.exe (964) ______ C:\Windows\System32\svchost.exe (1104) ______ C:\Windows\System32\svchost.exe (1148) ______ C:\Windows\system32\svchost.exe (1172) Locked audiodg.exe (1268) ______ C:\Windows\system32\SLsvc.exe (1300) ______ C:\Windows\system32\svchost.exe (1340) ______ C:\Windows\system32\svchost.exe (1520) ______ C:\Windows\System32\spoolsv.exe (1724) ______ C:\Windows\system32\WLANExt.exe (1744) ______ C:\Windows\system32\svchost.exe (1756) ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (2012) ______ C:\Program Files\Bonjour\mDNSResponder.exe (2024) ______ C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (344) ______ C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (428) ______ C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (868) ______ C:\Program Files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe (1168) ______ C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe (384) ______ C:\TOSHIBA\IVP\ISM\pinger.exe (732) ______ C:\Windows\system32\svchost.exe (1992) ______ C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (1376) ______ C:\Windows\system32\rpcnet.exe (2064) ______ C:\Windows\system32\svchost.exe (2300) ______ c:\TOSHIBA\IVP\swupdate\swupdtmr.exe (2372) ______ C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (2444) ______ C:\Windows\system32\TODDSrv.exe (2552) ______ C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (2568) ______ C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (2596) ______ C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (2784) ______ C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (2832) ______ C:\Windows\system32\SearchIndexer.exe (2876) ______ C:\Windows\system32\DRIVERS\xaudio.exe (2968) ______ C:\Windows\system32\Dwm.exe (3172) ______ C:\Windows\Explorer.EXE (3216) ______ C:\Program Files\Norton 360\Engine\3.0.0.135\ccSvcHst.exe (3520) ______ C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (3756) ______ C:\Windows\System32\hkcmd.exe (3840) ______ C:\Windows\System32\igfxpers.exe (3876) ______ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (3908) ______ C:\Program Files\Toshiba\ConfigFree\NDSTray.exe (4064) ______ C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (4084) ______ C:\Program Files\Toshiba\SmoothView\SmoothView.exe (2436) ______ C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (2940) ______ C:\Program Files\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe (3644) ______ C:\Program Files\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe (3132) ______ C:\Program Files\iTunes\iTunesHelper.exe (1440) ______ C:\Program Files\Toshiba Registration\Registration.exe (2392) ______ C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe (2484) ______ C:\Windows\ehome\ehtray.exe (2536) ______ C:\Program Files\Windows Media Player\wmpnscfg.exe (956) ______ C:\Program Files\Toshiba Registration\Registration.exe (3632) ______ C:\Windows\system32\igfxsrvc.exe (1968) ______ C:\Windows\ehome\ehmsas.exe (4116) ______ C:\Program Files\Windows Media Player\wmpnetwk.exe (4160) ______ C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe (5040) ______ C:\Program Files\iPod\bin\iPodService.exe (5340) ______ C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (5420) ______ C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (5524) ______ C:\Program Files\Internet Explorer\ieuser.exe (5580) ______ C:\Program Files\Internet Explorer\iexplore.exe (5596) ______ C:\Windows\system32\svchost.exe (3728) ______ C:\Windows\system32\wuauclt.exe (4564) ______ C:\Windows\System32\svchost.exe (4984) Locked dllhost.exe (5060) Locked dllhost.exe (1252) ______ C:\Users\Heather\Desktop\Rooter.exe (4856) . ———————-\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 (Start_Offset:1048576 | Length:1572864000) \Device\Harddisk0\Partition2 –[ MBR ]– (Start_Offset:1573912576 | Length:248485249024) . ———————-\\ Scheduled Tasks . C:\Windows\Tasks\Check Updates for Windows Live Toolbar.job C:\Windows\Tasks\ParetoLogic Registration.job C:\Windows\Tasks\PersonalAV.job C:\Windows\Tasks\SA.DAT C:\Windows\Tasks\SCHEDLGU.TXT . ———————-\\ Registry . . ———————-\\ Files & Folders . ———————-\\ Scan completed at 19:30.25 . C:\Rooter$\Rooter_2.txt - (07/08/2009 | 19:30.25)

rkforan, Something still looks a little iffy. Please try to run Gmer again.

Tomk, Reran Gmer. log file attached. Kelly

rkforan,

That looks good. Let's try a different online scan.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on: [external image: Posted Image]
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on: [external image: Posted Image]
• The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on: [external image: Posted Image]
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Tomk, Ran the Scan. Log file attached. Kelly

rkforan, That's good. Maybe I'm just paranoid. Please let me have a DDS log and tell me how it's running.

Everything seems to be running normally. Attached are the two DDS log files Thanks, Kelly

rkforan,

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  UACd.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Results from Look SystemLook v1.0 by jpshortstuff (22.05.09) Log created at 17:41 on 09/08/2009 by Heather (Administrator - Elevation successful) ========== filefind ========== Searching for "UACd.sys" No files found. -=End Of File=- Kelly

rkforan,

OK. I'll accept it's just me being paranoid.

Log looks good


You need to create a new Clean restore point:

• Download SysRestorePoint to your desktop and unzip it to it's own folder.
• Double click SysRestorePoint.exe so that we can make a new system restore point.
• A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Now to remove most of the tools that we have used in fixing your machine:

• Make sure you have an Internet Connection.
• Download OTC to your desktop and run it
• A list of tool components used in the cleanup of malware will be downloaded.
• If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
• Click Yes to begin the cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Tomk, I reviewed the links, and understand. Thank you so much for your help. Everythin thing looks to be running correctly now. Regards, Kelly

rkforan, You are very welcome. Good Luck and Be Well.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.