Worm Maybe?

[wilmsp]

A couple of points.  By the time I finished scanning with Super etc. and was ready to reboot, I was baffed and decided to wait till morning when I could go on Safe Mode.  In the morning, my wife inadvertently rebooted regularly.  So after she was finished, I rebooted and entered safe mode, at which time I ran Super etc.  It took just under an hour and really didn't find much.  But - the virus is still there since Avast popped it up even while I was checking for the log!

Another point: about halfway through file portion of the scan, I got an error message saying "correct 3D object not found".  I clicked OK and the scan continued. 

It seems every time I use my connect mode to go on net {dialup} I get the Avast Message.  I am attaching this morning's Syperanti etc. log plus the most recent Hijack This log from last night.  What now my friend?

Bill.

[wilmsp]

Ooopppss, it appears I can only attach one log at a time.  So, I will attach last night's Hijack This log.

Bill

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

The logs aren't showing.

Just post them directly into the thread if needed.

[wilmsp]

Strange - but okay, here are the 2 logs, one from last night and the other this morning.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/02/2008 at 01:14 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259
Trace Rules Database Version: 1270

Scan type       : Quick Scan
Total Scan Time : 00:10:26

Memory items scanned      : 448
Memory threats detected   : 0
Registry items scanned    : 545
Registry threats detected : 0
File items scanned        : 8476
File threats detected     : 1

Adware.Tracking Cookie
   C:\Documents and Settings\Owner\Cookies\[email protected][2].txt

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:10:51 AM, on 1/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Avast4\aswUpdSv.exe
C:\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Avast4\ashDisp.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\a1944.exe
C:\Program Files\Messenger\msmsgs.exe
C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\FinePixViewer\QuickDCF2.exe
C:\INCRED~1\bin\ImApp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Avast4\ashMaiSv.exe
C:\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nexicom.net/internet/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.experienceexchange.comShopperLogon
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nexicom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.experienceexchange.comShopperLogon
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Nexicom Inc
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [avast!] C:\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Firewall] C:\DOCUME~1\Owner\LOCALS~1\Temp\a1944.exe /autorun
O4 - HKCU\..\Run: [IncrediMail] C:\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.nexicom.net
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Avast4\ashWebSv.exe

--
End of file - 4267 bytes

[evilfantasy]

Go to My Computer->Tools->Folder Options->View tab:

• Under the Hidden files and folders heading:
• Select Show hidden files and folders.
  
• Uncheck Hide protected operating system files (recommended) option.
  
• Also, make sure there is no checkmark beside Hide file extensions for known file types.
  
• Click OK

.


Next go to http://www.viruschief.com/ and click Browse.

Locate this file

C:\DOCUME~1\Owner\LOCALS~1\Temp\a1944.exe /autorun

Double click it to enter it into the search box and click Scan.

Once it is done scanning you will see a text box with results from the scanners. Under BB Code: Copy and paste those results in the next reply.

Note The DOCUME~1 and LOCALS~1 are abbreviated for documents and settings and local settings.

[wilmsp]

Sorry, but on VirusChief and Browse, I am unable to find such a file on Desktop and in doing a search, unable to find it on C:\ drive.  Or - anywhere.  Please advise.

[evilfantasy]

Lets do this.


Download and install CleanUp!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:

• Click Options...
  
• Move the arrow down to Standard CleanUp!
  
• Uncheck the following:
  
  • Delete Newsgroup cache
    
  • Delete Newsgroup Subscriptions
• Click OK

Press the CleanUp! button to start the program. Reboot/logoff when prompted.

Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility


Then run a new HijackThis scan and post the log please.

[wilmsp]

Thanks - will do - back with details this evening.

Bill

[wilmsp]

Yo Evil Fantasy.

Did as you suggested.  Tried to download Cleanup both 4.5 and 4.0 and in both cases when I attempt to unzip or use itssetup, a message said in effect - this download is bigger than stated, please try again."  I did.  zip.  Now I hope I was on the right site since it is that of a stevengould org. which I obtained via a Google.  Maybe that's not Clean UP! eh?  If not, could you provide me the URL?

Thanks again.

[evilfantasy]

Yep its that site, stevengould.org.

Here is the direct download link http://stevengould.org/downloads/cleanup/CleanUp452.exe

If that will not work then use ATF Cleaner.

Please download ATF Cleaner by Atribune. ATF Cleaner.exe

Make sure that all browser windows are closed.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All and UNCHECK Cookies.
  
• Click the Empty Selected button.
  

If you use Firefox browser

• Click Firefox at the top and choose: Select All and UNCHECK Cookies.
  
• Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

If you use Opera browser

• Click Opera at the top and choose: Select All and UNCHECK Cookies.
  
• Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

Click Exit on the Main ATF Cleaner menu to close the program.

[wilmsp]

Good Grief - I followed the linke, downloaded Cleanup! and followed your instructions.  I am going to copy/paste the log to speed things along.  However, just as I was looking at the log - up came the Avast Virus report - again.  This is getting "scary".

So - what now? [See below].

Thanks for your patience.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:12 PM, on 1/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Avast4\aswUpdSv.exe
C:\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Avast4\ashMaiSv.exe
C:\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
C:\Avast4\ashDisp.exe
C:\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\cc0a.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\FinePixViewer\QuickDCF2.exe
C:\INCRED~1\bin\ImApp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.nexicom.net/internet/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bourque.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nexicom.net
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.experienceexchange.comShopperLogon
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Nexicom Inc
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl06a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [avast!] C:\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Windows Firewall] C:\DOCUME~1\Owner\LOCALS~1\Temp\cc0a.exe /autorun
O4 - HKCU\..\Run: [IncrediMail] C:\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: ExifLauncher2.lnk = C:\FinePixViewer\QuickDCF2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.nexicom.net
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O20 - Winlogon Notify: !SASWinLogon - C:\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Avast4\ashWebSv.exe

--
End of file - 4300 bytes

[evilfantasy]

We're getting there, time for some more powerful tools.

Sorry for the problems with the Cleanup program.


Please download Combofix by sUBs from either here or here

IMPORTANT - Save Combofix.exe to your your Desktop.

• Close any open Web browsers. (Firefox, Internet Explorer, etc)
• Close/disable all anti virus and anti malware programs so they do not interfere with ComboFix. <-- IMPORTANT
  AVAST
  Right click on the avast! icon in system tray and choose (Stop On-Access Protection)
  
  
• Double click combofix.exe & follow the prompts.
• From the keyboard select 1 and press Enter
  
• When finished, it will produce a log for you.
• Post that log in your next reply.

Do not mouseclick combofix's window while it's running. That may cause your computer to stall

Next post please add the combofix log.

[wilmsp]

Hello Evil Fantasy:

I was wondering when I might hear back from you.  I was sure I posted the log on Friday morning - but now it appears it did not get there or something since its not posted.  I will copy the log below since it appears my attachment don't sometimes work.  Here is the log and please let me know what next.  Sorry, but I really did think I had sent this Friday.Let me if you think I should run it again, since I am still getting the Avast notice of a virus - I think I am to some 40 or more now in the Avast "trunk".

Bill S.

Oops - this may explain things.  After posting, a message appeared above saying I had exceeded the max amount of 10000 characters.  So I will again try via attachment.



[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

This is a little perplexing. I thought combofix would turn up something.


Please download DrWeb CureIt & save it to your desktop.

Scan with DrWeb-CureIt as follows:

• Double-click on drweb-cureit.exe and then click Start.
  
• An Express Scan of your PC notice will appear.
  
• Under Start the Express Scan Now Click OK to start.
  • This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
• Once the short scan has finished, Click Options > Change settings
  
• Choose the Scan tab and UNcheck Heuristic analysis and click OK
  
• Back at the main window, select the Complete scan button.
  
• Then click the Green Arrow Start Scanning button on the right and the scan will start.
  • Click Yes to all if it asks if you want to cure/move any file(s).
• When the scan is done.
• In the Dr.Web CureIt menu on top left, click File and choose Save report list.
  
• Save the DrWeb.csv report to your Desktop.
  
• Exit Dr.Web Cureit.

• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

[/COLOR]

• After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
  
• Copy and paste that log in the next reply

---------------


Please run the F-Secure Online Scanner

Note: This Scanner works with Internet Explorer Only!

• Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
• Allow the Active X control to be installed on your computer, then click the Accept button
• Click Full System Scan and allow the components to download and the scan to complete.
  
• If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  
• When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click

Cancel, then New Scan[/list]

• When the cleaning option is presented, Uncheck Submit samples to F-Secure
  
• Click Automatic cleaning
  
• When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  
• Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post

• This scan will only work with Internet Explore
• You must have administrator rights to run this scan
• This scan can take several hours, so please be patient

Next post please add
DrWeb log
F-Secure log
New HijackThis log[/list]

[wilmsp]

Uh oh - first good morning, and then - I am unable to reach DrWeb Curit using the link provided.  I tried a Google, but returned only a couple of logs from somebody else's search.  Could you please send me the full URL?  I will be out till early till early this afternoon [Central Daylight Time] will carry on at that time.  Thanks again!

Bill.