cannot scan with any anti-virus software.. Trojan virus? [RESOLVED]

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

2 Pages

1 2 >

cannot scan with any anti-virus software.. Trojan virus? [RESOLVED]

Options

flirttt View Member Profile	Jul 28 2008, 01:27 AM Post #1
Member Posts: 11 OS: xp	Im suspecting a trojan because i have found trojans before but cannot delete/remove it. i used optus internet security suite for a while and it always worked fine. however after a while i tried doing a full computer scan, it did not scan and i noticed that the optus security suite icon on the bottom right dissapears when i place my mouse over it. i have also tried installing avg free, the installation process was wierd it flickers (the installing bar did not fill up, 100% and it would say installation complete, there was a window that opened and closed in 1/10 of a second like when you copy and paste something) anyways when it finished i tried opening it would not open saying cannot open avg.exe or something because of incorrect configuration. reinstall. My computer has also been very slow and not functioning at the usual speed. error message : "c:\program files\avg\avg8\avgui.exe this application has failed to start because application configuration is incorrect. reinstalling the application may fix this problem." Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:38:16 PM, on 28/07/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Sandboxie\SbieSvc.exe C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Startup Faster 2004\sfAgent.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Spyware Doctor\pctsGui.exe C:\Documents and Settings\MICHAEL\Desktop\HiJackThis.exe O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O1 - Hosts: 72.167.37.76 Update.nprotect.com O1 - Hosts: 72.167.37.76 update.nprotect.net O4 - HKLM\..\Run: [StartupFaster] "C:\Program Files\Startup Faster 2004\startuploader.exe" -run SFAURUN SFCURUN SFAUSTARTUP SFCUSTARTUP O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: StartupFaster O4 - Global Startup: StartupFaster O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 4533 bytes hope someone can help me thanks in advance This post has been edited by flirttt: Jul 28 2008, 02:24 AM

Ltangelic View Member Profile	Jul 28 2008, 06:29 AM Post #2
Angel Annihilator of Malware Posts: 1,643 From: Singapore (born in China) OS: Windows XP Professional	Hey flirttt, Welcome to GeekstoGo! I'm Ltangelic and I'll be helping you fix your computer problem. Take note that I'm still in training, and my posts will have to be checked by an expert. This may cause delays in between my responses, I ask for your patience. Please stick with me until we get your computer cleaned up or it will be a wasted effort on both sides. I'm looking at your log now, and I'll post back with a fix when I'm ready. Thanks for your patience. PS. If I've not been responding, and you wonder why, feel free to PM me and I'll give an explanation. LT

flirttt View Member Profile	Jul 29 2008, 12:07 AM Post #3
Member Posts: 11 OS: xp	with you all the way and if there is any information you need, just ask waiting for your reply thanks

Ltangelic View Member Profile	Jul 30 2008, 07:08 AM Post #4
Angel Annihilator of Malware Posts: 1,643 From: Singapore (born in China) OS: Windows XP Professional	Hey flirttt, Your logs are showing some signs of infection, let's run some tools to remove them. Please follow my instructions in the order they were given, and print out a copy of it as you may not have access to the forums during the fix. 1) Use HostsXpert to restore original host file Download the HostsXpert 4.2 - Hosts File Manager. Unzip HostsXpert 4.2 - Hosts File Manager to a convenient folder such as C:\HostsXpert 4.2 - Hosts File Manager Run HostsXpert 4.2 - Hosts File Manager from its new home Click on "File Handling". Click on "Restore MS Hosts File". Click OK on the Confirmation box. Click on "Make Read Only?" Click the X to exit the program. Note: If you were using a custom Hosts file you will need to replace any of those entries yourself. 2) Run VundoFix Please download VundoFix.exe to your desktop Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting. 3) Run Deckard's System Scanner Please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply. Next reply (please include): Dss scan log Vundofix.txt

Ltangelic View Member Profile	Aug 1 2008, 07:42 AM Post #6
Angel Annihilator of Malware Posts: 1,643 From: Singapore (born in China) OS: Windows XP Professional	Hey flirttt, Your DSS logs don't show much problem, let's do some scans to see what they find. 1) Remove malicious/unnecessary programs Please go to Add or Remove Programs and remove the following (if present): Java� SE Runtime Environment 6 Update 1 LimeWire PRO 4.14.10 <---This is a P2P program that can compromise your computer's security, I would recommend its removal Reboot your computer. 2) Use OTMoveIt2 to remove malicious entries Please download the OTMoveIt2 by OldTimer. Save it to your desktop. Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator") Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): CODE [kill explorer] c:\documents and settings\michael\desktop\sago_hack_pack.39\sago hack pack.39\{trojan virus} C:\Program Files\bvjg gzg8wud2rcccs <delete service> usprserv <delete service> purity emptytemp [start explorer] Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste. Click the red Moveit! button. A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply. Close OTMoveIt2 If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. 3) Scan with MalwareBytes' Anti-Malware Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient. When the scan is complete, click OK, then Show Results to view the results. Make sure that everything is checked, and click Remove Selected. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note) The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM. Copy&Paste the entire report in your next reply. Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately. Next reply (please include): Fresh HijackThis log OTMoveIt2 log MBAM scan log

flirttt

Aug 1 2008, 07:21 PM

Post #7

Member

Posts: 11
OS: xp

add or remove programs couldnt remove
Java� SE Runtime Environment 6 Update 1
the windows installer service could not be accessed. This can occur if you are running windows in safe mode or if the windows installer is not correctly installed. contact your support personnel for assistance.

limewire removed.

Explorer killed successfully
File/Folder c:\documents and settings\michael\desktop\sago_hack_pack.39\sago hack pack.39\{trojan virus} not found.
C:\Program Files\bvjg moved successfully.
gzg8wud2rcccs service deleted successfully.
usprserv service deleted successfully.
< purity >
< emptytemp >
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08022008_093307

Malwarebytes' Anti-Malware 1.24
Database version: 1015
Windows 5.1.2600 Service Pack 2

11:06:26 AM 2/08/2008
mbam-log-8-2-2008 (11-06-26).txt

Scan type: Quick Scan
Objects scanned: 39892
Time elapsed: 4 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.Trymedia) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\All Users\Application Data\VideoEgg\user.dat (Adware.VideoEgg) -> Quarantined and deleted successfully.

HJT LOG
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:54 AM, on 2/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe