Trojan.Packed.NsAnti won't go away!

[kittymaroon]

Hi!

I've been getting notifications from Symantec about Trojan.Packed.NsAnti for at least a few weeks now.  The notifications look like this:

Scan type:  Auto-Protect Scan
Event:  Security Risk Found!
Risk: Trojan.Packed.NsAnti
File:  C:\Users\kittymaroon\AppData\Local\Temp\DWH1167.tmp
Location:  Quarantine
Computer:  KITTYMAROON-PC
User:  Victoria Chao
Action taken:  Quarantine succeeded : Access denied
Date found: Monday, April 27, 2009  4:09:22 PM

I've run several full scans with Symantec, which sometimes come up with the same notifications and sometimes tell me my machine is clean.  When it finds security risks, it quarantines them but won't let me delete them.  My symantec antivirus should be up-to-date (Version: 4/26/2009 rev. 4). I tried to see if I could find the file in my task manager so that I could delete it in the registry (maybe this was a poor idea since I know nothing about computers), but can't seem to find it.  I just finished doing all the steps listed in your post "Read This Before Requesting Malware Removal Help."  None of the scanners suggested in that post found anything wrong with my computer, yet I still get these Symantec Antivirus notifications saying they found trojan.packed.nsanti. I'm pretty sure i have a trojan since the trojan has created 62 new files in my temp folder since I last ran CCleaner 22 minutes ago. 

If it's at all helpful, I have a Dell Inspiron 1420 running Windows Vista.  I have SP1 installed on it.  I've also attached my logs, though I'd be happy to post them as well.  Thanks so much for your help--I look forward to your reply!

Best,

Kittymaroon

[attachment deleted by admin]

[KingPincer]

Try using again your cleaner since it is found in the temp. files folder. Did something happen to your computer like restarts itself or something fishy going around you said that it's on quarantine so meaning you won't have a problem. When you say delete this means that it will delete that file permanently while quarantine deletes only the threats on that file or cleans that file. Sometimes this files can't be deleted cause they are a part of your computer to work properly.

[evilfantasy]

Flash Drive Cleanup

Please have all your removable storage devices ready for disinfection.

Download Flash Disinfector by sUBs and save it to your Desktop.
 
* Double-click Flash_Disinfector.exe to run it.
* Your desktop and icons may disappear. This is normal.
* It will do a cleanup of removable storage devices, and write a protected Autorun.inf file to help prevent re-infection.
* Follow any prompts that may appear.
* The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
* Wait until it has finished scanning and then exit the program.
* There will be no GUI interface or log file produced.
* Reboot your computer when done.

Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection.

----------

Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop.

Link #1
Link #2

**Note:  It is important that it is saved directly to your Desktop

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your antivirus, and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
 
Double click combofix.exe & follow the prompts.
When finished ComboFix will produce a log for you.
Post the ComboFix log in your next reply.

Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

If you have problems with ComboFix usage, see How to use ComboFix

[kittymaroon]

Thanks for the speedy reply, but it looks like Flash Disinfector is no longer available on the bleepingcomputer.com site (I've googled it, and every link to it seems to be broken.)  Is this a one-day thing, or is flash disinfector gone forever?  Is there somewhere else I can get it?

Thanks for your help again.  I hope flash disinfector comes back soon!

[KingPincer]

I have a flash disinfector installer here. The problem is can i send a file here?

[evilfantasy]

The link works fine for me.

[kittymaroon]

Here is my combofix log.  Thanks again for your help--hopefully this will all get worked out!

[attachment deleted by admin]

[evilfantasy]

Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start
  
• An information notice will appear, click OK.
  
• This starts a short scan that will scan the files currently running in memory.
• If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
  
• If or when something is found, click the Yes button when it asks you if you want to cure it.

.

• Once the short scan has finished, Click Settings > Change Settings
  
• Under the Scanning tab UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
  
• Click Yes to all if it asks if you want to cure/move any file(s).
  
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

.
* After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
* Copy and paste that log in the next reply

[kittymaroon]

I've tried saving my report from Dr. Web twice, and each time it has caused my computer to shut down.  I'm trying again now--this time, I'll turn Symantec Antivirus off.  Am I doing something wrong?

One of the things Dr. Web picked up was that Combofix was infected--is this normal, or should I be worried?

Thanks!

[evilfantasy]

Did you get the log?

You should be able to get to it by going to Start > Run and copy this blue text and paste it into the window then click OK.

%USERPROFILE%\DoctorWeb\CureIt.log

[kittymaroon]

I'm having trouble posting this log.  Somehow it keeps taking forever and then timing out...

[evilfantasy]

Opening the log causes a timeout?

[kittymaroon]

posting it does.  I've tried copying and pasting it in and also adding it as an attachment.  Somehow computerhope stops responding when I try to add a log, but it's fine when I make a regular post.  I just tried sending it to myself over gmail a second ago, and it did the same thing.  Maybe my computer hates text files?

[evilfantasy]

Try this please.

Upload the file to File Dropper

Click Upload
Locate the file and double click it.
Copy the link under Share This Link: and post it back here.

[kittymaroon]

I realized that the text file is 37.2 MB!  Anyhow, here's the link: <img src=http://www.filedropper.com/download_button.png width=127 height=145 border=0/>
 <div style=font-size:9px;font-family:Arial, Helvetica, sans-serif;width:127px;font-color:#44a854;> <a href=http://www.filedropper.com > FileDropper Free File Hosting[/url]</div>

Thanks again for everything.  Let's get this done!

[evilfantasy]

That's not the link.

Upload the file to File Dropper

Click Upload
Locate the file and double click it.
Copy the link under Share This Link: and post it back here.

[kittymaroon]

Sorry about that!  Here it is:

http://www.filedropper.com/cureitdrweblogearlier

[evilfantasy]

That wasn't the right log...

How is the computer running now?

[kittymaroon]

ugh... are you serious?

My computer is still sending me a pop=up warning about viruses every few minutes.  I'll post the other thing I have when I get home.  It's from when I ran the scan under safemode.  THere are only about 3 items on it--I hope that's the right one.  If not, do you know how I can get it?

Thanks!

[evilfantasy]

I will be out of town starting tomorrow so won't be able to answer until next week.

Clearing Temp Folder

• Click on Start
  
• In the text box in the Run window, type %Temp% and click OK. A folder full of files and other folders will appear.
  
• Remove everything inside the Temp folder, choose Edit and then Select All from the menu.
  • Note: If you're prompted that there are hidden files in this folder, just click on OK to bypass the message.
• Now that all of the files and folders are selected, hit your Delete key or choose File and then Delete from the menu.
  
• Confirm that you want to delete the files by clicking Yes on the Confirm Multiple File Delete window that opens.
  
• After all of the files have been deleted close the window and empty your Recycle Bin.

.
Check this folder and delete everything in it. C:\Users\kittymaroon\AppData\Local\Temp\ <- Empty all of the files in the Temp folder.

----------

Vista delete temporary files

1. Open Internet Explorer.
2. Click the Tools button,  and then click Internet Options.
3. Click the General tab, and then, under Browsing history, click Delete.
4. In the Delete Browsing History dialog box, click Delete all to remove all temporary files.

----------

Flush the old infected restore points.

You can find instructions on how to disable and re-enable system restore in Vista here:

Disabling System Restore. Be sure to restart the computer and then turn system restore back on.

----------

Is the popup about malware still happening?

[Helpmeh]

When deleting, hold the shift key when you press the delete key. It will make the files skip the recycle bin.

[kittymaroon]

I flushed my old restore points and did all the other stuff when you told me to a week or two ago.  I didnt' get any pop-up warnings from Symantec for a while, but in the last few days, I've gotten a lot (60-70). 

Ran SuperAntiSpyware again and got this log.  What next?

[attachment deleted by admin]

[evilfantasy]

What next?

Start a new topic with the 3 logs from the malware removal guide. It's been nearly 3 weeks. Anything could have happened between then and now.