Virus attack during AVG download

torquemada

Welcome to Tom Coyote

Sorry for the delay in responding I am currently looking at your log. However things could have changed since your last post.
Would you please re run Hijackthis and post a fresh Hijackthis log.

thanks bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

Hello 'Bama Jim: I will run another log - do you want it posted in the 5 day old board or on the original board? Many thanks, Torque

tourquemada

Please post it as a reply in this thread

thanks bamajim

In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

torquemada

You indicated that you were attacked when updating AVG
Did you perhaps get a warning about a wininett infection, or something similar?

The reason I asked is there has been a false positve issue with AVG the last few days, but has been corrected

But to be sure it's not something else, lets do this

First Go here and Download Ewido Antimalware 4.0
(30 day free trial version) Save it to Your Desktop

Double Click Ewido-setup
(It will create its own folder)
Once the program starts You will be at the Status menuUnder "Your computers Security"
Click change status on Resident shield to inactive
Click Update now (next to last update)
After the update loads
Under Automatic updates Uncheck download and install updates automatically(recommended)
(you can always select maual updates the next day)
At the top toolbar Click Scanner Then the settings tabUnder How to act? Set default action for detected malwareTo Quarantine
Under how to scan All boxes should be checked
Under Possibly unwanted software All boxes should be checked
Under reports Select Automatically generate report after every scan
Uncheck Only if threats were found
Under what to scan Scan every file should be highlited
Exit Ewido (Do not run it yet)

Next Reboot your PC into Safe Mode
This can be done byRestart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter
Run EwidoClick scanner
Select Complete system scan
Once the scan finishesSelect Apply all actions (The items found will be quarantined)
Click save report as (Another window will open)
Save it to your desktop
(By default It will be saved in the Ewido folder as)
C:\Program Files\ewido anti-spyware 4.0\Reports
Exit Ewido

Reboot your PC in Normal Mode->> Re run Hijackthis and post a fresh Hijackthis log
Double click the report-scan txt. you saved to your desktop
It will open in Notepad
Copy and paste that report as a reply to this thread
Do not run any other options untill instructed to do so
Your reply should includeA fresh Hijackthis log
Your report_scan.txt log from Ewido
Thanks bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

'Bamajim, The plot thickens. I already had Ewido on that machine, and was already in safe mode (which was the only mode it would allow me to start up). This afternoon I ran AVG, then Ewido - both in safe mode - then restarted the computer in normal mode. For some reason, it started up correctly for the first time in 6 days and my kids are now using it again. Previously I would get blue screens with messages like: "npfs.sys PAGE__FAULT__IN__NONPAGED__AREA Physical memory dump" OR "wlancfg5.exe - application error. The application failed to initialize properly." OR "DRIVE__IRQL__NOT__LESS__OR__EQUAL Physical memory dump" OR A black screen giving me the option of starting up in safe mode or the last known correct mode. A friend of mine suggested that a new keyboard/optical mouse combo I recently installed (Saitek) might have been part of the problem. At any rate, it seems to be working at the moment. Do you still want me to run Ewido and HiJack This again? Many thanks, Torque

torquemada

I'm glad to hear things are better at the moment. I do think that it would be better if you posted the Ewido log and a fresh Hijackthis log.

The main reason for this is You are currently Runing XP with SP1 (Sevice Pack 1) Which has some security issues. Which means the likelyhood of re infection is almost certain. The current version is SP2 (Sevice Pack 2). Which I would recommend, but would not recommend installing until we know your PC is clean.

The choice to continue or not is of course your's.

thanks bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

'Bamajim, I will try to run the new logs this evening and post them. Many thanks for your help! Torque

torquemada

Thanks for posting the results. So far so good.There is one more thing I would like to do

Run an online virus scan called Kapersky1. Click on "Kapersky Online Scanner"
2. A new smaller window will pop up. Press on "Accept". After reading the contents.
3. Now Kapersky will update the anti-virus database. Let it run.
4. Click on "Next"->>"Scan Settings", and make sure the database is set to "extended". And check both the scan options. Then click OK.
5. Then click on "My Computer". And the scan will start.
6. Once finished, save a log as ".txt" to the desktop.
Copy and post the results of the Kapersky Online scan

thanks bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

Jim, Results of Kaspersky scan: ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Monday, August 14, 2006 3:08:58 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 14/08/2006 Kaspersky Anti-Virus database records: 214840 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 37935 Number of viruses found: 0 Number of infected objects: 0 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:47:46 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\cert8.db Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\formhistory.dat Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\history.dat Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\key3.db Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\parent.lock Object is locked skipped C:\Documents and Settings\John Ingram\Application Data\Sun\Java\Deployment\log\plugin150_06.trace Object is locked skipped C:\Documents and Settings\John Ingram\Cookies\index.dat Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Application Data\Mozilla\Firefox\Profiles\q2lheob0.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Temp\hsperfdata_John Ingram\312 Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Temp\Perflib_Perfdata_3e8.dat Object is locked skipped C:\Documents and Settings\John Ingram\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\John Ingram\NTUSER.DAT Object is locked skipped C:\Documents and Settings\John Ingram\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\DAP\History\Carolyn Ingram\_lasthist.dat Object is locked skipped C:\Program Files\DAP\History\Johnny Ingram\_lasthist.dat Object is locked skipped C:\Program Files\DAP\History\Joshua Ingram\_lasthist.dat Object is locked skipped C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1049\change.log Object is locked skipped C:\WINDOWS\Debug\oakley.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped Scan process completed. Thanks again, Torque

torquemada

Thanks for the scan. I just wanted to be sure you were clean before you installed SP2.

Your Log is Clean from malware
I appreciate your patience in working through this.

Now that your log is clean

There are some final notes:
Disable and Enable System RestoreLets create a clean System Restore point
the instructions are here
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:Download the latest version of
Java Runtime Environment (JRE) 5.0 Update 8.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.
Make your Internet Explorer more secure
This can be done by following these simple instructions:Open Internet Explorer click Tools->> Options.
Click Security tab
Click once on the Internet icon so it becomes highlighted.
Click Custom Level.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click OK.
If it prompts you to save the settings, press Yes.
Next press Apply and then OK to exit the Internet Properties page
Update your Anti Virus Software

Use and maintain a Firewall such as ZoneAlarmThe Windows Firewall is good at blocking incoming threats, but not outgoing threats such as "Backdoor Trojans"
Some others are
Sygate
And
Sunbelt personal
All of which are free
Get windows UpdatedYou currently have SP1 (service pack 1) as I indicated earlier, and Getting SP2 (service pack 2) is a must
Your Link is Here
It is a rather large download, about 2 hours on a high speed connection, 8 on dial up (Which I don't recommend)
It is also available on CD at the same link. It is free of charge (with a small shipping fee, in the US about $4.00)
Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Documents and Files and a regular basis
To a disc or a USB key, not your Hardrive

You may want to read this article"So how did I get infected in the first place" by Tony Klein
surf safe

Thanks bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom

"bamajim, Thanks again for all your help - you've been a real blessing. I will take all these measures. One final question: I keep receiving e-mails from people who are supposedly responding to my problem in this thread. However, these people are not instructors but members like myself with computer infections. Their comments have nothing to do with what I've posted but always refer to their own cases. Is there something I can do to my site settings to prevent me from getting these e-mails? Thanks, Torquemada

torquemada

Your welcome

About your question, I'm not sure but I will report it to a Moderator

bamajim
In Training at MalWare Removal University - A Cooperative Effort with TomCoyote Classroom