[mart_chris]

o and i tried the OTscanit with your code, the OTscanit become not responsive and my screen went blank, the only option I could do was to reset, or ctrl-alt-del then log off of my user.

[Advertisements]

Hi there mart_chris,

Let's do this.

Step 1. Running the Avenger
1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to delete:
%SystemRoot%\System32\drivers\lvuvc.hs
%SystemRoot%\System32\drivers\logiflt.iad
%SystemDrive%\fsaua.data
%UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .

Re-run OTScanIt and attach the log it produces please.

In your next reply

Please post the log from Avenger.
Please post the log from OTScanIt, please attach this log if possible.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Edited by Mike, 29 May 2008 - 02:41 PM.

[Mike]

Hi there mart_chris,

Let's do this.

Step 1. Running the Avenger
1. Please download The Avenger by Swandog46 to your Desktop.

• Right click on the Avenger.zip folder and select "Extract All..."
• Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to delete:
%SystemRoot%\System32\drivers\lvuvc.hs
%SystemRoot%\System32\drivers\logiflt.iad
%SystemDrive%\fsaua.data
%UserProfile%\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh Hijackthis log .

Re-run OTScanIt and attach the log it produces please.

In your next reply

Please post the log from Avenger.
Please post the log from OTScanIt, please attach this log if possible.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Edited by Mike, 29 May 2008 - 02:41 PM.

[mart_chris]

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\System32\drivers\lvuvc.hs" deleted successfully.
File "C:\WINDOWS\System32\drivers\logiflt.iad" deleted successfully.

Error: "C:\fsaua.data" is a folder, not a file!
Deletion of file "C:\fsaua.data" failed!
Status: 0xc00000ba (STATUS_FILE_IS_A_DIRECTORY)
--> use "Folders to delete:" instead of "Files to delete:" to delete a directory

File "C:\Documents and Settings\Martin Christian\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[mart_chris]

I tried the OTscanIT using the code you gave me before, and the same thing happened, it didn't work. That's the log that you wanted right?

For now my computer is fine. The only problem I'm having now is that when I do general scan with my McAfee, the blue screen of death happens. Just like when I scan with your methods.

[mart_chris]

just in case u wanted the OTscanit scan, i attached it here

Attached Files

•  OTScanIt.Txt   248.82KB   246 downloads

[Mike]

Hi there mart_chris,

We seem to have a file reappearing.

1. Please re-open the Avenger.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Files to delete:
%systemroot%\system32\drivers\logiflt.iad
%systemroot%\system32\drivers\lvuvc.hs
Drivers to delete:
lvuvc

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

• Right click on the window under Input script here:, and select Paste.
• You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
• Click on Execute
• Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

• It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete", The Avenger will actually restart your system twice.)
• On reboot, it will briefly open a black command window on your desktop, this is normal.
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply, please attach a new OTScanIt log for me as well.

Edited by Mike, 30 May 2008 - 02:54 PM.

[mart_chris]

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\system32\drivers\logiflt.iad" deleted successfully.
File "C:\WINDOWS\system32\drivers\lvuvc.hs" deleted successfully.
Driver "lvuvc" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[mart_chris]

here's the OTscanIt

Attached Files

•  OTScanIt.Txt   247.37KB   238 downloads

[Mike]

Hi mart_chris,

Well we got the driver that kept making those files respawn, strange thing is it never showed up in our scans

Let's see if this works now.

Step 1. Fixes With OTScanIt

Start OTScanIt. Copy/Paste the information in the Code box below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Registry - Non-Microsoft Only]
< Drives - Autoruns > -> 
NY -> AUTOEXEC.BAT [] -> %SystemDrive%\AUTOEXEC.BAT [ NTFS ]
YY -> autorun [] -> F:\autorun [ FAT32 ]
YY -> autorun.inf [[autorun] | ICON=AUTORUN\WDLOGO.ICO | ] -> F:\autorun.inf [ FAT32 ]
< Trusted Sites Domains [HKEY_LOCAL_MACHINE\] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
YN -> 1 domain(s) and sub-domain(s) not assigned to a zone. -> 
< Trusted Sites Domains [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ -> [Key] 1884 domain(s) found.
YN -> free_aol.com [http] -> Trusted sites
YN -> 24 domain(s) and sub-domain(s) not assigned to a zone. -> 
< Internet Explorer Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\
YN -> CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} [HKEY_LOCAL_MACHINE] -> [Reg Error: Key does not exist or could not be opened.]
[Files/Folders - Created Within 30 days]
NY -> 11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Files/Folders - Modified Within 30 days]
NY -> 11 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp
[Empty Temp Folders]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. CLick the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new OTScanIt scan.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

Step 2. Running Kaspersky Online Virusscaner

We should be able to run it now.
Please run a free online scan with Kaspersky AntiVirus (works only with MS Internet Explorer 5.0 or higher).
Go to http://www.kaspersky.com/virusscanner and click the "Kaspersky Online Scanner" button (NOT "Kaspersky File Scanner").

• In the new window that opens, click the "Accept" button to accept the user agreement, install the ActiveX control, and download the program.
• When you get the Windows dialog asking if you want to install this software, click the "Install" button.
• When the "Update progress" line changes to "Ready" and the "NEXT ->" button lights up with a green arrow, click it.
• Click on the "Scan Settings" button, and in the next window select the "extended" database, and click Ok.
• Under "Please select a target to scan:", click My Computer to start the scan.

When the scan is finished, click the "Save as Text" button, and save the file as kavscan.txt to your Desktop, close the Kaspersky On-line Scanner window, and post the text in kavscan.txt in your next reply.

Edited by Mike, 31 May 2008 - 03:54 AM.

[mart_chris]

[Registry - Non-Microsoft Only]
C:\AUTOEXEC.BAT moved successfully.
F:\autorun folder moved successfully.
F:\autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ created successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\CmdMapping\\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39FD89BF-D3F1-45b6-BB56-3582CCF489E1}\ not found.
[Files/Folders - Created Within 30 days]
[Files/Folders - Modified Within 30 days]
[Empty Temp Folders]
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Temp\Perflib_Perfdata_1680.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Temp\~DFA709.tmp scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Temp\~DFA8C0.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\mcmsc_geCDsqOALHpZUnD scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_PKeLVcYI2FRnO9A scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_UGRhkDAGoQ4il3I scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_vXoOTFYz1mhHfwS scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_t0o2pl5jhW246bp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_wwiZNGi7Gn9bKdE scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
FireFox cache emptied.
RecycleBin -> emptied.
< End of fix log >
OTScanIt by OldTimer - Version 1.0.14.1 fix logfile created on 05312008_075205

Files moved on Reboot...
File C:\Documents and Settings\Martin Christian\Local Settings\Temp\Perflib_Perfdata_1680.dat not found!
File C:\Documents and Settings\Martin Christian\Local Settings\Temp\~DFA709.tmp not found!
File C:\Documents and Settings\Martin Christian\Local Settings\Temp\~DFA8C0.tmp not found!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
File C:\WINDOWS\temp\mcmsc_geCDsqOALHpZUnD not found!
File C:\WINDOWS\temp\mcmsc_PKeLVcYI2FRnO9A not found!
File C:\WINDOWS\temp\mcmsc_UGRhkDAGoQ4il3I not found!
File C:\WINDOWS\temp\mcmsc_vXoOTFYz1mhHfwS not found!
C:\WINDOWS\temp\sqlite_t0o2pl5jhW246bp moved successfully.
C:\WINDOWS\temp\sqlite_wwiZNGi7Gn9bKdE moved successfully.
C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Martin Christian\Local Settings\Application Data\Mozilla\Firefox\Profiles\nin4raqf.default\Cache\_CACHE_MAP_ moved successfully.

[mart_chris]

heres OTscanIT

Attached Files

•  OTScanIt.Txt   243.87KB   189 downloads

Edited by mart_chris, 31 May 2008 - 06:58 AM.

[mart_chris]

Tried the Kaspersky, the blue screen of death happened again..

[Mike]

Hi thanks for the logs...

I have another scan for you (whats new ), let's see if this shows anything.

Download haxfix.exe
and save it to your desktop.

• Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)
• Checkmark "Create a desktop icon"
• Click "Next"
• When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed
• Click "Finish"

A red "dos window" (dos box) will open with options:
1. Make logfile
2. Run auto fix
3. Run manual fix
E. Exit Haxfix

• Select option 1. Make logfile by typing 1 and then pressing Enter
• Haxfix will start scanning the computer. When it is finished a logfile will open: haxlog.txt > (c:\haxfix.txt)
• Copy the contents of that logfile and paste it into this thread.

[mart_chris]

HAXFIX logfile - by Marckie

version 5.01.1
Sat 05/31/2008 16:05:38.95
running from C:\HaxFix

--- Checking for Haxdoor ---

checking for a3d files
a3d files not found

checking for matching notify keys
no matching notify keys found

checking for matching services
no matching services found

checking for matching safeboot services
no matching safeboot services found


--- Checking for Goldun ---

checking for SSODL keys
no ssodl keys found

checking for notify keys
no notify keys found

checking for services
no services found

checking iexplore.exe
iexplore.exe is not infected


--- Checking for other Goldun and Haxdoor files ---
no other Haxdoor or Goldun files found


--- Catchme logfile - thank you Gmer ---

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-31 16:06:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000a6
"TracesSuccessful"=dword:0000009e

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 3


--- Analysing Catchme logfile ---

no matching regkeys found


Finished!

[Mike]

Hi there mart_chris,

Malware wise, your logs look clean to me.

I would recommend you head over to the Windows XP forums and ask for help there regarding your BSODs. Be sure to tell them that you have already been cleared on the malware side of things.

Let's remove the tools we used.

Now please download OTCleanIt.

• Save it to your desktop.
• Double Click on OTCleanIt.exe, a window will appear.
• Please press the CleanUp! Button.

This will remove the tools we used during the process of cleaning your computer.

The below steps have some important tips on how to stay safe and keep up-to-date, so be sure to read it!

Step 1. Flushing old Restore Points and creating a new one

Right-click on "My Computer." The "System Properties" dialogue box will appear, showing a number of tabs. From here you can reset System Restore and configure Automatic Updates.

First, click the System Restore tab.

* Check the box beside "Turn off System Restore"
* Click "Apply"
* At the prompt, click "Yes"

Wait while your system deletes existing Restore Points, this may take a few moments.

* Uncheck the box beside "Turn off System Restore"
* Click "Apply"
* At the prompt, click "Yes"

Your system will now create a new Restore Point.

Step 2. Configuring Automatic Updates

Click the Automatic Updates tab. Choose the update option that best suits your needs, but be sure that Automatic Updates is not turned off. Windows XP will now notify you and download important updates and security patches as they become available.
Click "OK" to save your new settings and close the System Properties dialogue.

Step 3. Preventing future infection

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems.

In order to protect yourself against spyware, you should consider installing and running the following free programs:

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
http://www.spywarewa...uc/resource.htm

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.o...oducts/firefox/

Also make sure to run your antivirus software regularly, and to keep it up-to-date.

There are many programs that can be used for your protection, most falling within the three main categories of anti-virus, anti-spyware and firewall. Please be careful to never run more than one program of the same category in resident mode, as conflicts between the different programs can actually decrease your protection.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Please post back and tell me if everything is OK, so that I may mark this thread as Resolved.