Trojan Dropper & Win32.Agent

Hi g4orce,

Looks like that file is a required file.

DVDFab.exe may also be a False Positive. Is this a program you installed?

Thanks

Hi Oldman960. I agree… I think odw is an essential file. As to DVDFab, it is a dvd decrypter application that I've used for several years (helps get DVD files into a portable format). I think it is fine and had never had an issue with it prior, which is why I was surprised that several scans seemed to think it was corrupt.

Hi g4orce,

Some of the scanners that detected the file as infected use the Kasperky engine. I'm inclined to believe that it is indeed a false positive on DVDFab.exe .

Before we clean up the tools and send you on your way, I see 2 antivirus programs installed. This can and will lead to conflicts causing lockup, system slowdowns and possibly less protection. You currently have Lavasoft Ad-Watch Live! Anti-Virus and McAfee VirusScan Enterprise. Please choose one and uninstall the other. Let me know which one you uninstalled.

Your java is out of date. Click your start button, open Control panel.

• Locate the Java icon (it looks like a coffee cup)
• double click it to open it
• click the Update tab
• Click update now

After the java is updated, reboot your computer if not prompted to.


Next, clear the java cache

To clear the Java Plug-in cache:

• Click Start > Control Panel.
• Double-click the Java icon in the control panel.
• On the General tab, Click Settings under Temporary Internet Files.
• On the Temporary Files Settings screen, Click Delete Files.
• check all boxes
• Click OK

We'll clean up the tools after you post back.

Thanks

Hi OldMan960, I uninstalled Lavasoft as the AV. I also updated Java to build 21 and cleared the cache. One thing that was odd was that when I rebooted, the Windows Recover Mode option came up again. However, this time, unlike with the problem with odw.dll, it went ahead and booted… no continual rebooting as before. Everything seems to be fine, though. I thought that was a little odd.

Hi g4orce,

That is a little strange. Did you try a couple of reboots just to see if the problem reoccured?

We can clean up the tools and you can test drive the computer. I'll leave this thread open for a couple of days and if you have any problems please post back.

From your desktop, please delete, if present

• any notepads/logs that we created
• DDS.scr
• Rooter.exe
• SystemLook.exe

From within windows explorer delete C:\Rooter$


Next

Click the Start button, click Run. Copy and paste the following line into the run box and click OK
Combofix /uninstall


Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep MBAM updated and use it regularly.


Updates

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.0 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for tips, reviews and links to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware,IMO)

You may find a resident antispyware to your liking HERE


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Ensure that Automatic Update is turned on so you get all the latest patches.
Click start, control panel, click Security Center.


- Keep your antivirus program updated, as well as any other security programs you have.


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

We will keep this thread open for a couple of days.

Take care

Hi Oldman960, Sorry for the slow reply. I had to wait until I got to work to respond b/c my computer (OS) died during the uninstall of combofix. Everything was working fine until I did the uninstall. I ran the code as suggested and just before it completed, it beeped twice, and indicated that a parasite file was attaching itself to combofix. I grabbed a screenshot to send to you, but when I hit OK (only choice) it beeped twice again and then the computer automatically rebooted itself. During the reboot, the computer went back to the windows recovery mode/xp boot-up screen as I mentioned earlier. This time, however, nothing works to get it past recovery mode. BTW, the parasite file?… odw.dll, which we previously tried to rename and found it to be an essential windows file. I don't know if it deleted the file during reboot, or exactly what happened, but when I tried to find the file via the recovery mode CMD, it says it doesn't exist. I thought about using my CD copy of XP to get the file loaded, but don't know what other problems might occur if I did, as my copy is pre- any service packs. Any thoughts? I've never done a windows re-install or repair, but my biggest concern besides potential loss of data is that my HD is nearing capacity and if reinatalling XP would run into those space limitations.

Hi gforce,

Uninstalling combofix will not cause it to remove anything from your computer except for combofix's own folders and file plus the old System Restore points.

Did you try booting to safe mode?

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Or Last Known Good Configuration?

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Use the arrow key to highlight Last Known Good Configuration
• Press Enter.

Edit to add:

What type of XP CD do you have? Is it a retail version?

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic