What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Win32\ Virut.AJ.dropper keeps popping up in AVG

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
UPDATE: I had more popups from AVG that showed the following: Virus infection Win32/RustockG. I had about 30 different messages about this same virus attached to various driver files within my windows system 32 folder. What do I do?

I have tried just about everything I can think of, malware bytes, ATF cleaner, scans, nothing is helping. I keep getting alerts popping up stating I have viruses attached to files I know are critical files. I am very concerned as my 16 yr old son was home alone this evening with my computer. When I logged into my computer my network card was disabled and when I renabled it my start bar disappeared and AVG went nuts with alerts - at one point there were over 20 alerts at once in the same window. The first thing I did was run AFF cleaner then malware bytes. Malwarebytes requested a reboot to remove a few more things. Got that completed and then I went into add/remove program files. That's when I found my son had games and stuff installed on my computer but they were not installed properly and could not be removed via add/remove program files. I am not sure what he was trying to do but he is officially banned from all computer use as of right now.

One of the most recent messages was about this: Win32\Virut.AJ.dropper

Anyway…here is my hjt log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:02:38 AM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\i386kd.exe,C:\WINDOWS\system32\vmware-ufad.exe,
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Owner\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\dlm.exe /windowsstart /startifwork
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ehddsvxm.exe] C:\WINDOWS\ehddsvxm.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - S-1-5-18 Startup: Suitcase 11.0.lnk = C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Suitcase 11.0.lnk = C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe (User 'Default user')
O4 - Startup: Suitcase 11.0.lnk = C:\Program Files\Extensis\Extensis Suitcase 11\Suitcase.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Owner\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1191516742453
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - http://www.familylobby.com/common/ImageUpl…geUploader4.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Smart Viewer 7) - http://198.209.97.177/viewer/activeXViewer/activexviewer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://oakmont.axiscam.net/activex/AMC.cab
O16 - DPF: {EDFCB7CB-942C-4822-AF14-F0B687409848} (Image Uploader Control) - http://www.snapgalaxy.com/albums/ImageUploader4.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: khfFWpPJ - khfFWpPJ.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Extensis\Extensis Suitcase 11\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag 2000 (OOD2000) - O&O Software GmbH - C:\WINDOWS\system32\OOD2000.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 12359 bytes

I have attached several log files - it looks as though my son ran malware bytes at around 11:23pm. I have attached that log file as wella s the two log files from malware bytes that I ran myself after arriving home. If anyone can help me with this, I will be very grateful.

Attachments:

Post #2
Hi if this is a virut infection, then I would consider backing up data files now. However, first we will have a quick check first to confirm that diagnosis. I will need you to run two programmes one is an antivirus the other an analysis tool. Prior to uploading the Dr Web report could you rename the extension to .TXT as opposed to .CSV

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.

THEN

To ensure that I get all the information this log will need to be attached (instructions at the end) if it is to large to attach then upload to Mediafire and post the sharing link.

Download OTScanit2 to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.
  • Close ALL OTHER PROGRAMS.
  • Open the OTScanit folder and double-click on OTScanit.exe to start the program.
  • Check the box that says Scan All Users
  • Check the Radio button for Rootkit check YES
  • Under Additional Scans check the following:
    • File - Lop Check
    • File - Purity Scan
    • Evnt - EventViewer Errors/Warnings (last 10)
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
Please attach the log in your next post.

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post

Logs required : DrWeb and OTScanit
Post #3 last edited
Thanks for responding so quickly. Here are the log files you requested. I thought I should let you know. I will be leaving for work in just a few minutes. I won't be able to finish working on this until I get back home tonight around midnight central time.

Attachments:

Post #4 last edited
OK it does not appear to be Virut

Start OTScanit. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Kill Explorer]
[Unregister Dlls]
[Processes - Safe List]
YY -> services.exe -> %SystemRoot%\services.exe
[Driver Services - Safe List]
YY -> (ethakwnq) ethakwnq [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethakwnq.sys
YY -> (ethavaao) ethavaao [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethavaao.sys
YY -> (ethctcow) ethctcow [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethctcow.sys
YY -> (ethfjkbp) ethfjkbp [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethfjkbp.sys
YY -> (ethgrwyi) ethgrwyi [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethgrwyi.sys
YY -> (ethhjgek) ethhjgek [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethhjgek.sys
YY -> (ethibmbi) ethibmbi [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethibmbi.sys
YY -> (ethjdsjw) ethjdsjw [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethjdsjw.sys
YY -> (ethkoouo) ethkoouo [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethkoouo.sys
YY -> (ethlcaed) ethlcaed [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethlcaed.sys
YY -> (ethmdqei) ethmdqei [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethmdqei.sys
YY -> (ethnzjae) ethnzjae [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethnzjae.sys
YY -> (ethptbbv) ethptbbv [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethptbbv.sys
YY -> (ethqfvop) ethqfvop [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethqfvop.sys
YY -> (ethtlmip) ethtlmip [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethtlmip.sys
YY -> (ethulfdq) ethulfdq [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethulfdq.sys
YY -> (ethuobhu) ethuobhu [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethuobhu.sys
YY -> (ethuwqki) ethuwqki [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethuwqki.sys
YY -> (ethvowqt) ethvowqt [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethvowqt.sys
YY -> (ethwqzzu) ethwqzzu [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethwqzzu.sys
YY -> (ethxzcoe) ethxzcoe [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethxzcoe.sys
YY -> (ethxzpmy) ethxzpmy [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethxzpmy.sys
YY -> (ethyyoje) ethyyoje [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethyyoje.sys
NY -> (ethztlzs) ethztlzs [Kernel | System | Stopped] -> %SystemRoot%\system32\drivers\ethztlzs.sys
[Registry - Safe List]
< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer ToolBars [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{2318C2B1-4965-11D4-9B18-009027A5CD4F}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Internet Explorer ToolBars [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\Software\Microsoft\Internet Explorer\Toolbar\
YN -> WebBrowser\\"{A057A204-BACC-4D26-C39E-35F1D2A32EC8}" [HKLM] -> Reg Error: Key does not exist or could not be opened. [Reg Error: Key does not exist or could not be opened.]
< Run [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "Framework Windows" -> [frmwrk32.exe]
YY -> "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< Run [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< Run [HKEY_USERS\.DEFAULT\] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "ehddsvxm.exe" -> %SystemRoot%\ehddsvxm.exe [C:\WINDOWS\ehddsvxm.exe]
YY -> "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< Run [HKEY_USERS\S-1-5-18\] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YN -> "ehddsvxm.exe" -> %SystemRoot%\ehddsvxm.exe [C:\WINDOWS\ehddsvxm.exe]
YY -> "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< Run [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> "services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< CurrentVersion Policy Settings - Explorer [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YY -> \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< CurrentVersion Policy Settings - Explorer [HKEY_CURRENT_USER] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YY -> \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YN -> \\"NoFolderOptions" -> [1]
YY -> \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< CurrentVersion Policy Settings [HKEY_USERS\.DEFAULT] > -> HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
YN -> \\"DisableRegistryTools" -> [1]
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YN -> \\"NoFolderOptions" -> [1]
YY -> \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > -> HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
YN -> \\"DisableRegistryTools" -> [1]
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003] > -> HKEY_USERS\S-1-5-21-1606980848-1757981266-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
YY -> \Run\\"services" -> %SystemRoot%\services.exe [C:\WINDOWS\services.exe]
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YN -> khfFWpPJ -> 
[Files/Folders - Created Within 30 Days]
NY -> 32788R22FWJFW -> %SystemDrive%\32788R22FWJFW
NY -> ethptbbv.sys -> %SystemRoot%\System32\drivers\ethptbbv.sys
NY -> ethakwnq.sys -> %SystemRoot%\System32\drivers\ethakwnq.sys
NY -> ethwqzzu.sys -> %SystemRoot%\System32\drivers\ethwqzzu.sys
NY -> ethfjkbp.sys -> %SystemRoot%\System32\drivers\ethfjkbp.sys
NY -> ethgrwyi.sys -> %SystemRoot%\System32\drivers\ethgrwyi.sys
NY -> ethztlzs.sys -> %SystemRoot%\System32\drivers\ethztlzs.sys
NY -> ethyyoje.sys -> %SystemRoot%\System32\drivers\ethyyoje.sys
NY -> ethctcow.sys -> %SystemRoot%\System32\drivers\ethctcow.sys
NY -> ethibmbi.sys -> %SystemRoot%\System32\drivers\ethibmbi.sys
NY -> ethjdsjw.sys -> %SystemRoot%\System32\drivers\ethjdsjw.sys
NY -> ethqfvop.sys -> %SystemRoot%\System32\drivers\ethqfvop.sys
NY -> ethlcaed.sys -> %SystemRoot%\System32\drivers\ethlcaed.sys
NY -> xdva189.sys -> %SystemRoot%\System32\xdva189.sys
NY -> xdva120.sys -> %SystemRoot%\System32\xdva120.sys
NY -> ethxzpmy.sys -> %SystemRoot%\System32\drivers\ethxzpmy.sys
NY -> ethxzcoe.sys -> %SystemRoot%\System32\drivers\ethxzcoe.sys
NY -> ethvowqt.sys -> %SystemRoot%\System32\drivers\ethvowqt.sys
NY -> ethuwqki.sys -> %SystemRoot%\System32\drivers\ethuwqki.sys
NY -> ethuobhu.sys -> %SystemRoot%\System32\drivers\ethuobhu.sys
NY -> ethulfdq.sys -> %SystemRoot%\System32\drivers\ethulfdq.sys
NY -> ethtlmip.sys -> %SystemRoot%\System32\drivers\ethtlmip.sys
NY -> ethnzjae.sys -> %SystemRoot%\System32\drivers\ethnzjae.sys
NY -> ethmdqei.sys -> %SystemRoot%\System32\drivers\ethmdqei.sys
NY -> ethkoouo.sys -> %SystemRoot%\System32\drivers\ethkoouo.sys
NY -> ethhjgek.sys -> %SystemRoot%\System32\drivers\ethhjgek.sys
NY -> ethavaao.sys -> %SystemRoot%\System32\drivers\ethavaao.sys
NY -> eaglent.sys -> %SystemRoot%\System32\drivers\eaglent.sys
NY -> secupdat.dat -> %SystemRoot%\System32\secupdat.dat
NY -> ndisio.sys -> %SystemRoot%\System32\drivers\ndisio.sys
NY -> _id.dat -> %SystemRoot%\_id.dat
NY -> xrwuphmh.job -> %SystemRoot%\tasks\xrwuphmh.job
[Files/Folders - Modified Within 30 Days]
NY -> _start.dat -> %UserProfile%\Local Settings\Temp\RarSFX0\_start.dat
NY -> xrwuphmh.job -> %SystemRoot%\tasks\xrwuphmh.job
NY -> b2e.dll -> %UserProfile%\Local Settings\Temp\B.tmp\b2e.dll
NY -> b2e.dll -> %UserProfile%\Local Settings\Temp\A.tmp\b2e.dll
NY -> b2e.dll -> %UserProfile%\Local Settings\Temp\9.tmp\b2e.dll
NY -> b2e.dll -> %UserProfile%\Local Settings\Temp\8.tmp\b2e.dll
NY -> ethptbbv.sys -> %SystemRoot%\System32\drivers\ethptbbv.sys
NY -> ethakwnq.sys -> %SystemRoot%\System32\drivers\ethakwnq.sys
NY -> ethwqzzu.sys -> %SystemRoot%\System32\drivers\ethwqzzu.sys
NY -> ethfjkbp.sys -> %SystemRoot%\System32\drivers\ethfjkbp.sys
NY -> ethgrwyi.sys -> %SystemRoot%\System32\drivers\ethgrwyi.sys
NY -> ethztlzs.sys -> %SystemRoot%\System32\drivers\ethztlzs.sys
NY -> ethyyoje.sys -> %SystemRoot%\System32\drivers\ethyyoje.sys
NY -> ethctcow.sys -> %SystemRoot%\System32\drivers\ethctcow.sys
NY -> ethibmbi.sys -> %SystemRoot%\System32\drivers\ethibmbi.sys
NY -> ethjdsjw.sys -> %SystemRoot%\System32\drivers\ethjdsjw.sys
NY -> ethqfvop.sys -> %SystemRoot%\System32\drivers\ethqfvop.sys
NY -> ethlcaed.sys -> %SystemRoot%\System32\drivers\ethlcaed.sys
NY -> xdva189.sys -> %SystemRoot%\System32\xdva189.sys
NY -> xdva120.sys -> %SystemRoot%\System32\xdva120.sys
NY -> ethxzpmy.sys -> %SystemRoot%\System32\drivers\ethxzpmy.sys
NY -> ethxzcoe.sys -> %SystemRoot%\System32\drivers\ethxzcoe.sys
NY -> ethvowqt.sys -> %SystemRoot%\System32\drivers\ethvowqt.sys
NY -> ethuwqki.sys -> %SystemRoot%\System32\drivers\ethuwqki.sys
NY -> ethuobhu.sys -> %SystemRoot%\System32\drivers\ethuobhu.sys
NY -> ethulfdq.sys -> %SystemRoot%\System32\drivers\ethulfdq.sys
NY -> ethtlmip.sys -> %SystemRoot%\System32\drivers\ethtlmip.sys
NY -> ethnzjae.sys -> %SystemRoot%\System32\drivers\ethnzjae.sys
NY -> ethmdqei.sys -> %SystemRoot%\System32\drivers\ethmdqei.sys
NY -> ethkoouo.sys -> %SystemRoot%\System32\drivers\ethkoouo.sys
NY -> ethhjgek.sys -> %SystemRoot%\System32\drivers\ethhjgek.sys
NY -> ethavaao.sys -> %SystemRoot%\System32\drivers\ethavaao.sys
NY -> eaglent.sys -> %SystemRoot%\System32\drivers\eaglent.sys
NY -> _id.dat -> %SystemRoot%\_id.dat
NY -> secupdat.dat -> %SystemRoot%\System32\secupdat.dat
NY -> ndisio.sys -> %SystemRoot%\System32\drivers\ndisio.sys
NY -> services.exe -> %SystemRoot%\services.exe
NY -> _start.exe -> %UserProfile%\Local Settings\Temp\RarSFX0\_start.exe
[Alternate Data Streams]
NY -> @Alternate Data Stream - 124 bytes -> %SystemRoot%\System32\apqymrfa.exe:changelist
NY -> @Alternate Data Stream - 263333 bytes -> %SystemRoot%\Temp:temp
[File - Lop Check]
NY -> xrwuphmh.job -> C:\WINDOWS\Tasks\xrwuphmh.job
[CatchMe Rootkit Scan by GMER]
NY -> C:\WINDOWS\system32\apqymrfa.exe:changelist 124 bytes -> 
[Empty Temp Folders]
[Start Explorer]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new Hijackthis log.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

No problem I am on GMT so I should be back at about 8pm my time tomorrow
Post #5
K…thanks a bunch. I will run that when I get back home tonight. Afterward, should i be ok to continue working on the pc? Or would you rather I not do anything with it? I have a website build with a deadline of Sunday morning so I am really trying to get that completed. This little mess is costing me. LOL. Kids sure are expensive these days.
Post #7 last edited
I encountered several problems since running the fix. The first thing while running the fix was that I kept getting a box that popped up saying : Can't find c:/windows/services.exe. This happened the entire time I ran the fix then it asked to reboot the system. Upon reboot it finished the fix. Then I did not have access to the internet after that. It keeps telling me that my network cable is unplugged. I thought maybe Ineeded to check my hosts file - but it appears normal. I looked in my device manager and there are several listings of my network card, some with strange markings on them. How can I get my network connection back? I need to get this back in order to post the logs. Thanks PS…after the reboot and upon trying to connect to the internet I got the same message about Virut from AVG when I attempted to open the firefox browser.
Post #8
Intriguing as I touched nothing in the networking area OK there are two ways we can go about this the first and easiest is to do a system restore back to Monday and I will then resume with a different tool If that fails we will look at option 2
Post #9 last edited
Ok…we can do that….one sec…I only have about 45 minutes to work with you today…as I have to be at work at 4 CST. I really need this up and going. :D This is going to take a bit and I need to save all the work I have done since Monday. Can you walk me through the system restore? I haven't done one in a very long time - probably 3 or 4 computers ago. Ok…I have looked at system restore and the only available times I have listed are on today at 12:27 and then at like 2 something…that was early this morning. I suppose I will have to reformat my computer.
Post #10
Here you go

  • Select Start > All Programs > Accessories > System tools > System Restore.
  • On the dialogue box that appears select Restore to an earlier time
  • Click NEXT
  • On the calender select the date to restore
  • Click NEXT
  • Follow the prompts
Post #12
The network card you have did it come fitted with your computer or is it one you added ? The other way is to go to control panel Device Manager Locate the network card (which will probably be showing a yellow exclamation mark) Press the + mark alongside it Right click the controller and select uninstall Reboot and windows will detect the card and re-install the drivers for it If you installed a new card yourself then use the driver disc to re-install
Post #13 last edited
I attempted what you suggested but it says it can't uninstall. There are 4 listings of my network card - 3 of which have a yellow lightening bolt thingy next to them. The card came with my computer - it was a custom built computer from a local computer store. It is still under warranty for a a few more months. Before the fix, I could connect to the net intermittently….it would connect for a while, then it would just stop connecting completely. But I was also getting tons of popups from AVG about the Virut.AJ.Dropper and Rustock.G OK…I managed to get the first one on the list to uninstall…but there are three others…when I get it rebooted I will list all it shows here. By the way, I have a Foxconn motherboard and Realtek Network Card
Post #14
OK uninstall the three with the lightning bolt and reboot your computer. Did your supplier give you the discs for the network cards ( although why you need 4 I don't know)
Post #15 last edited
umm… I logged in my computer showed a Microsoft Visual C++ Disassembly and then a pop up saying "OOD Defrag 2000 Agent"… I was also wondering if could possibly post pictures of what window's i am getting to show you my issue… i also do not normally have 4 network card identifications… some of them showed up after the problems started to occur

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI