Trojan Horse Infection

[Ninja08]

Hi. Good setup it looks like you've got here and hoping this is the right place to post for the help I need if anyone is able.

I have avast! 4.7 version  080306-0 installed.

A short while ago I was online and my avast! On-Access Scanner Message popped up saying I was infected with a Trojan Horse warning the details of which are here:

avast! Warning
A Trojan Horse Was Found!

File name:              C:\tmf3w3g0.com
Malware name:     Win32:OnLineGames-CVC[trj]
Malware type:       Trojan Horse
VPS version:          080306-0, 06/03/2008

I deleted file, as I usually do, but it keeps coming back every 20 seconds and it doesn't matter whether I delete or move to chest - same result.

I would really appreciate any help here please if anyone is able to tell me how to stop this virus or point me in the direction of the forum where I can work it out myself.

Thanks,

Jack

[oldman]

This ones usualy accompanied with an autorun, so plug in as many usb storage devices you have.

Please download ComboFix from Here or Here to your Desktop.

**Note:  In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.[/color]
  
  -----------------------------------------------------------

• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

• Double click on combofix.exe & follow the prompts.
  
• When finished, it will produce a report for you. 
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
  

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
  
• Put a check by Create a desktop icon then click Next again.
  
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
  
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
  

[rjlupin1319]

Hi there. I have the exact same problem, so I guess I don't need to start a new thread.
Here are my test results. The message would exceed the maximum allowed length (10000 characters), so I uploaded them.

Combofix
Hijackthis

Thanks!

[Ninja08]

Thank you very much, oldman. I will give all of this a go and get back to you.

Jack

[oldman]

@ rjlupin1319

A couple of things. The logs are impossile to read in the format you uploaded them in. Please attach the original combofix log to your reply. Do not rerun combofix. The log will be at c:\combofix\quqratine

Also please start a new thread or the logs and fixes will get mixed up.

Thanks.

[rjlupin1319]

I'm sorry. Both programs gave me a log report in text format.

The closest pathway to the one you gave me is C:\QooBox\Quarantine and there are no logs, only VIR files.

\C
autorun.inf.vir
ntdelect.com.vir
\\ComboFix
(empty)
\\WINDOWS\system32
kavo0.dll.vir
kavo1.dll.vir
kavo.exe.vir

\D
autorun.inf.vir

\Registry_backups
(empty)

I used to get 2 alerts every 20 seconds or so, but ever since I ran the programs you mentioned and rebooted my computer, there has been no further alerts. May I consider I'm safe ? If not, I will start a new thread.

[rjlupin1319]

[very sorry for the accidental double post]

[oldman]

The warnings have stopped in part because the autorun has been removed. I suggest you start a new thread because there may be more on your usb drives, or your HD.

When you do, please run this program, it will show the mountpoints and possible bad files associated.

Download "Clean Autoruns":From HERE

http://forums.techguy.org/attachments/103397d1176780296/clean-autoruns.zip

Save and extract its contents to the desktop. It is a folder containing a Batch file, Clean autoruns.bat, Written by Mosaic1. Once extracted, open the folder and double click on the Clean autoruns.bat to run the fix.
If any autoruns are found, the fix will move them to a backup folder.
If any autoruns are found on the root of your drives, it will kill explorer so that the registry entries in the MountPoint(s) key are fixed.
It will produce two files, Part1.txt and Part2.txt , that will show the state before and after the cleaning.

Please post those. Attach them, they may be long.

I have taken the liberty of starting a thread with some help for you.

It is called  rjlupin1319's autorun.