virus name: downloader

Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\qvomftrk ******************* Script file located at: \??\C:\Documents and Settings\afkhootj.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\drivers\utidjzgf.sys deleted successfully. File C:\WINDOWS\system32\drivers\kaqdkm43.sys deleted successfully. File C:\WINDOWS\system32\drivers\kywxqx79.sys deleted successfully. Completed script processing. ******************* Finished! Terminate.

Hello, Dave Still got the same thing Scan type: Realtime Protection Scan Event: Virus Found! Virus name: Downloader File: C:\documents~1\owner\locals~1\temp\tmpb.cab Location: Quarantine Computer: ZHOU-0E83EBB2A1 User: Owner Action taken: Clean failed : Quarantine succeeded: Access denied Date found: Thu Dec 14 21:19:18 2006 Then two error messege pops up: Error Loading C:\WINDOWS\system32\kywxqx79.dll the specific module could not be found Error Loading C:\WINDOWS\system32\kaqdkm43.dll the specific module could not be found When I tried to change my IE homepage, it still doesn't allow me to change

OK gy2001, it worked on the .sys files so let's use Avenger to try and delete those .dll files.

Same as last time, different files:
Open the program. Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, paste this (all 3 lines):

Files to delete:
C:\WINDOWS\system32\kywxqx79.dll
C:\WINDOWS\system32\kaqdkm43.dll

and click 'Done'

Click the Traffic Light icon to start the program, and OK the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt

Hello Dave, Before I have time to delete those .dll files,when I turned my computer on, seems like Norton pops up was gone and the Error messeges were gone. Then I changed my homepage and it worked. I was very happpy thinking those troubles were gone. Then something disastrous happened. when I tried to install window updates, norton pops up a window telling me there is virus at this location :C:\WINDOWS\system32\drivers\utidjzgf.sys But I restarted the computer anyway to install the updates. The the computer was dead and I can't boot no matter what I tried.

Hi gy2001,

I have a couple of questions for you and need a little more details on your issue.

When you say your computer is "dead" and "will not boot" what do you mean? Does nothing happen? Or does it start to boot up then stall? Does it give any error message?

Also, when Norton told you there was a virus this last time what did it do with the file, quarantine? or delete?

So give me some more details around what happened and the exact message if there are any errors.

Hello Dave, The computer booted for a second, when the screen appears "Comaq " Press F8, or press ESC etc. Then it stalled and nothing was on the screen beofre it can load to Window XP Screen. The last time Norton pops up a messege, it looks like this: Scan type: Realtime Protection Scan Event: Virus Found! Virus name: Downloader Location: C:\WINDOWS\system32\drivers\utidjzgf.sys Computer: ZHOU-0E83EBB2A1 User: Owner Action taken: Clean failed : Quarantine failed Access denied Date found: Sat Dec 16 21:19:18 2006

Will it let you hit F8 and boot to safe mode?

I tried to hit F8 a couple of times, hoping to boot in safe mode,but still doesn't work

Hi gy2001, I have a method that I've used in the past with success to recover from a complete crash. It will take a little work but could bring your PC back to a point where we can work on it again. You will need your original XP install disk. Hopefully you have it. Recovering from BSOD. Even if safe mode won't boot. For total crash. 1. Boot with XP disc. NOTE: If that does not work then the order of drives needs to be changed in the BIOS. 2. Open recovery console – click R. 3. Should look like this: ——————————————————————————– Microsoft Windows® Recovery Console The Recovery Console provides system repair and recovery functionality. Type EXIT to quit the Recovery Console and restart the computer. 1: C:\WINDOWS Which Windows Installation would you like to log onto (To cancel, press ENTER)? ——————————————————————————– 4. Click 1 on the keyboard (or whatever OS you are trying to boot into). 5. If asked enter the administrator password and click enter (If none just click enter). 6. Enter the following lines one at a time and click enter after each. Copy lines will confirm but delete lines will not: md tmp copy C:\windows\system32\config\system C:\windows\tmp\system.bak copy C:\windows\system32\config\software C:\windows\tmp\software.bak copy C:\windows\system32\config\sam C:\windows\tmp\sam.bak copy C:\windows\system32\config\security C:\windows\tmp\security.bak copy C:\windows\system32\config\default C:\windows\tmp\default.bak delete C:\windows\system32\config\system delete C:\windows\system32\config\software delete C:\windows\system32\config\Sam delete C:\windows\system32\config\security delete C:\windows\system32\config\default copy C:\windows\repair\system C:\windows\system32\config\system copy C:\windows\repair\software C:\windows\system32\config\software copy C:\windows\repair\sam C:\windows\system32\config\sam copy C:\windows\repair\security C:\windows\system32\config\security copy C:\windows\repair\default C:\windows\system32\config\default 7. Type exit and let PC reboot. Not from CD this time. 8. Need to make sure hidden files and folders are showing: 1. Start Windows Explorer. 2. On the Tools menu, click Folder options. 3. Click the View tab. 4. Under Hidden files and folders, click to select Show hidden files and folders, and then click to clear the "Hide protected operating system files (Recommended)" check box. 5. Click Yes when the dialog box is displayed that confirms that you want to display these files. 6. Double-click the drive where you installed Windows XP to get a list of the folders. It's important to click the correct drive. 9. Open the System Volume Information folder. This folder appears dimmed because it is set as a super-hidden folder. If you're using the FAT32 file system, this will be easy. If you're using NTFS, it won't let you open the folder, but here's how to get around that: Right-click on that system volume information folder and select Sharing and Security. Then click the Security tab. (No security tab? See step 10.) Click Add, and then in the box that's labeled "Enter the object names to select," type the name of the user that's at the top of the Start menu 10. Click on the Sharing tab. Put a check next to Share this folder on the network. Rename the share name to something like sysinfo. Click OK, now you should be able to open the folder. 11. Open the folder that looks something like this: "_restore{87BD3667-3246-476B-923F-F86E30B3E7F8}" 12. Open a folder that was not created at the current time. You may have to click Details on the View menu to see when these folders were created. There may be one or more folders starting with "RP x under this folder. These are restore points. 13. Open one of these folders to locate a Snapshot subfolder; the following path is an example of a folder path to the Snapshot folder: C:\System Volume Information\_restore{D86480E3-73EF-47BC-A0EB-A81BE6EE3ED8}RP"#"\Snapshot 14. From the Snapshot folder, copy the following files to the C:\Windows\Tmp folder _registry_user_.default _registry_machine_security _registry_machine_software _registry_machine_system _registry_machine_sam 15. Restart Windows and boot back into the recovery console. 16. Next step is to delete the existing registry files, and then copy the System Restore Registry files to the C:\Windows\System32\Config folder: From within Recovery Console, type the following commands: —————————————————————————— Del c:\windows\system32\config\sam Del c:\windows\system32\config\security Del c:\windows\system32\config\software Del c:\windows\system32\config\default Del c:\windows\system32\config\system copy c:\windows\tmp\_registry_machine_softwarec:\windows\system32\config\software copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\system copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\security copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\default ——————————————————————————- Exit out and reboot normally. Should be good. You can even choose another restore point normally now if not happy with where it's at.

Hello Dave, Is it more easier to format and reinstall everything at this point?

Well that is certainly up to you. If it were me I would try the recovery and if that doesn't work then go ahead and re-install. You may be able to do a repair install. Here is a couple of links with some information.

http://www.michaelstevenstech.com/XPrepairinstall.htm
http://spyware-free.us/tutorials/reformat/

Hello Dave, Thank you for the help. I'll try to reinstall tonight and let you know tomorrow.

Hello Dave, Just finished reinstall last night. Everything is fine now. The tutorial is really helpful. Really appreciate your help. Merry Christmas!

Hello gy2001,

Glad to hear things worked out, sorry we couldn't get you cleaned up without the re-install. Here are a few ideas to prevent re-infection in the future.

Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. Here is a list of some free and evaluation versions to try: AVG AntiVirus
Avast Antivirus Home Version–Free
Online Scanners:
Trend Micro Housecall
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some free and evalutation versions that provide
better security than the Windows Firewall.Kerio Personal Firewall
Zone Alarm Free
Outpost Firewall
For a tutorial on Firewalls and a listing of some other available ones see the link below:
Understanding and Using Firewalls

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to recieve automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Spybot - Search and Destroy - Spybot: Search And Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

Install Ad-Aware - Ad-Aware SE You should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.

http://forums.tomcoyote.org/index.php?show…mp;#entry257163

Follow this list and your potential for being infected again will reduce dramatically.

Hello Dave,

Thank you very much for the list.

I have one question see if you have any idea of. After I reinstalled XP, my laptop speaker doesn't have any sound. When I go to Start-Program-accessories-Entertainment, and tried to activate volume control. A messege popped up alerting me that I haven't installed sound max. Since my laptop has built-in speakers, I don't know what that means. At the same time. I go to Control Panel-Sound, Video-Hardware, looks like the hardware is functioning properly.

Another issue is that when I use mouse to scroll up and down of a window, the window seems shaky and not steady enough. How do I adjust the setting?

Thanks