Author Topic: at a loss to find the virus -- SOLVED!!!  (Read 48755 times)

0 Members and 1 Guest are viewing this topic.

theladyupstairs

  • Guest
Re: at a loss to find the virus
« Reply #30 on: July 16, 2010, 09:36:24 PM »
david - i unchecked the cadaemon on startup with msconfig, restarted my computer & got a message from SYSTEM CONFIG. UTILITY, telling me: "the system config util is now in diagnostic or selective startup mode causing this message to be displayed & the utility to run every time windows starts.  chose the normal startup mode on the general tab to start windows normally & undo the changes you made using the system config utility."

so, out of fear, i did what it told me to do & the cadaemon got checked again.  then restarted.

one thing nice, all my restarts have worked without a hitch.  also, the unwanted websites haven't shown up lately - only once this morning.  but i haven't done much internet stuff apart from email.


Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89237
  • No support PMs thanks
Re: at a loss to find the virus
« Reply #31 on: July 16, 2010, 09:39:15 PM »
OK, you have posted not the general HJT Scan log, but the Startup list from the Config; Misc Tools; Generate StartupList Log, which is somewhat overkill and not one that I'm familiar with.

So run HJT again, select just a Scan and once complete, click the Save log button at the bottom left of the screen, see image.

Lets see if we can't stop it from the HJT interface.

Edit: Did you make a typo in the file name as you previously reported it as ACdaemon.exe ?
« Last Edit: July 16, 2010, 09:41:49 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

theladyupstairs

  • Guest
Re: at a loss to find the virus
« Reply #32 on: July 16, 2010, 09:56:35 PM »
so sorry - i messed up my reply & also the attachment.  trying again.

must have been a typo.  i keep forgetting the name of that file/program or whatever it is.

but i thought i did exactly what you told me to do with the hjt.  i ran the scan, clicked the save log button, & attached the notepad file i found in the folder indicated.  i will do it again.  thanks for your patience.  it's very fast.  i overwrote the first file.  i hope i did it correctly.  please let me know.

thanks.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89237
  • No support PMs thanks
Re: at a loss to find the virus
« Reply #33 on: July 16, 2010, 11:45:10 PM »
Well I don't see anything obvious in your HiJackThis log other than you are running XP SP2 and that is well out of date SP3 is the latest. You only appear to be running the Windows XP firewall and that provides zero outbound protection. Both of these leave your system less well protected, Microsoft are also withdrawing support (security updates) for XP unless you have SP3, meant to be this month, but may be extended.

This is the entry that starts the ACDaemon.exe file (below), now if you run HJT again and check the box to the left of that and click the Fix selected button, it will remove that startup entry.

O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

Now for the warnings, obviously that won't run on boot and I don't know how that would be started when using the camera image transfer, etc. most commonly it would be started with the transfer software (but that isn't a certainty).

When you click the fix selected button it should default to save a copy of that entry (create a backup), should you need to reverse that process, so it isn't going to be lost if you decide you nee the acdeamon.exe to run on startup. To reverse any that removal, run HJT again and click the, View list of backups, select the one of that removal and check the box to the left of the entry and click the Restore button.

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

theladyupstairs

  • Guest
Re: at a loss to find the virus
« Reply #34 on: July 17, 2010, 12:37:58 AM »
thanks, david.  do i understand correctly you're only addressing the event during shut down when acdaemon slows me down?  is that what your instructions are about when you tell me to run hjt again & fix the acdaemon.exe?  if so, that is the least of my worries.  unless you think that will fix my problem of unwanted pages, etc..

right now, my computer is running wild.  in the last half hour i got two more unrequested pages, avast stopped a virus, and, believe this or not, while working in microsoft word, i hovered over a filename in order to get a preview to open it, i saw very briefly, in red, in the preview section, the words computer hijacked.  i swear.  then a few minutes ago i got an email that disappeared, about joint relief in big letters.

i'm worried i've been hijacked, but from what?  how?  and what to do?  i'm afraid to open my bank account websites.  should i be?

and i just got another avast threat has been detected pop up called dropper blocked.  they're coming in fast & furious.  i've never had this happen before.

i hope i've explained myself.  i'm rather upset.  is there anything more i can do?


theladyupstairs

  • Guest
Re: at a loss to find the virus
« Reply #35 on: July 17, 2010, 12:43:57 AM »
and another virus blocked: w32:dropper-gen  - twice in a row.

why is this happening?  should i close down my computer?  would it help to restart?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89237
  • No support PMs thanks
Re: at a loss to find the virus
« Reply #36 on: July 17, 2010, 01:35:37 AM »
I doubt that fix will have anything to do with stopping those unwanted pages, that may be a browser hijack, but a firewall that has outbound protection may well block those outbound attempts or show what is trying to get out.

Windows XP's firewall is better than no firewall but, it lulls you into a false sense of protection, it doesn't provide outbound protection.
Many forum users are using these:
- PC Tools Firewall seems to have the least user headaches as it doesn't seem to be constantly asking the user questions about this and that.
- Online Armor for the most parts fine but it has caused some users grief after avast program updates and that is something you have to watch out for.
- Outpost Firewall 2009 free, a cut down version of the Outpost Firewall Pro version, which should still provide good protection, http://free.agnitum.com/. Download, http://www.filehippo.com/download_outpost_firewall/

Restarting will do nothing to stop any possible malware, just stop it at that time but it will be up and running again on boot.

Unfortunately it looks like there is something that is hidden, possibly by a rootkit that is responsible for why nothing can be found on the various scans, it is also going to be able to hide from a basic analysis tool like HJT.

~~~~
Try this tool -- GMER Anti-Rootkit
    GMER Rootkit Scanner - Download - Homepage
    • Download GMER
    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe.

    • If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
    • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED ...
      • IAT/EAT
      • Drives/Partition other than Systemdrive (typically C:\)
      • Show All (don't miss this one)

      Click the image to enlarge it
    • Then click the Scan button & wait for it to finish.
    • Once done click on the [Save..] button, and in the File name area, type in "ark.txt" 
    • Save the log where you can easily find it, such as your desktop.
    **Caution**
    Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

    Please copy and paste the report into your Post.
    Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

    theladyupstairs

    • Guest
    Re: at a loss to find the virus
    « Reply #37 on: July 17, 2010, 02:06:37 AM »
    i don't understand what "outbound" means with regard to the firewall.  i thought viruses etc. are all "inbound," that is into my computer.  what does "outbound protection" do?

    i'm now getting attacked by w32.dropper-gen (drp) every ten minutes.  avast blocks it.

    i'm running malaware bytes right now.  i will do the gmr rootkit thing later.  this is exhausting me. 

    now i have a problem with microsoft word.  when i try to open a document i get a message "word cannot start the converter mswrd632."  there is a long list of instructions that refer to the registry.  i did not do anything with the hjt except create logs & send them to you.  if i ignore the message the file opens anyway.  this is extremely worrisome to me as all my work is in word.  (i'm a writer & do many other things with words.)  could that be from the thing that has attacked me?

    i'm not going to do anything about that startup thing.  it doesn't seem important at all now.

    thank you. 


    Offline DavidR

    • Avast Überevangelist
    • Certainly Bot
    • *****
    • Posts: 89237
    • No support PMs thanks
    Re: at a loss to find the virus
    « Reply #38 on: July 17, 2010, 03:34:21 AM »
    A firewall checks inbound traffic, keeps your system stealthed and protects against inbound attack (but not inbound viruses). A firewall with outbound protection, checks outbound traffic to ensure it is authorised, so malware on your system trying to get an internet connection should be challenged by a good firewall.

    So new/changed programs or malware shouldn't be able to initiate connections to these unwanted windows or try and download more malware, like in the instance of those downloader alerts. So my thoughts are that you aren't getting attacked as such but whatever is on your system is trying to download more malware. If you are able to do a screen capture of the avast alert window it may help to find the culprit (of course a firewall with outbound protection could also do that).

    For connections made from your computer the firewall will allow the corresponding inbound traffic access to the system, this is why it is important that only authorised outbound connections are allowed. When you install a new program that needs to connect to the internet, the first time it tries to the firewall should ask if it is allowed (and remember your answer). If that program is updated and the process that connects changes the firewall should recognise that and ask again.

    Some of the better firewall maintain a white list of genuine applications with rules for what they are allowed to do and so reduce the amount of questions they ask of the user.

    There is certainly something else going on in your system, whether that is system file corruption or malware action I don't really know, but a google search for mswrd632 returns many hits, http://www.google.com/search?q=mswrd632.

    This is the first of them, http://www.wincert.net/tips/1786-word-cannot-start-the-converter-mswrd632wpc-error.html.
    Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

    theladyupstairs

    • Guest
    Re: at a loss to find the virus
    « Reply #39 on: July 17, 2010, 07:41:34 AM »
    thanks for the info.  i will study it all carefully tomorrow.  meanwhile, because i don't give up, here's the results of the rookit scan:  (you did ask me to copy & paste the report into my post, but if you prefer the file, i will send it.) 

    and i will work on the word problem. as you can imagine, i'm afraid to do anything with the registry.  this is work for heroes!

    will you be around tomorrow?

    i went to a great concert this evening - a french group called caravan palace.

    GMER 1.0.15.15281 - http://www.gmer.net
    Rootkit scan 2010-07-16 22:30:36
    Windows 5.1.2600 Service Pack 2
    Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pxtdqpob.sys


    ---- System - GMER 1.0.15 ----

    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwClose [0xEF735CD2]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwCreateKey [0xEF735B8E]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwDeleteKey [0xEF736142]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwDeleteValueKey [0xEF73606C]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwDuplicateObject [0xEF735764]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwOpenKey [0xEF735C68]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwOpenProcess [0xEF7356A4]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwOpenThread [0xEF735708]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwQueryValueKey [0xEF735D88]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwRenameKey [0xEF736210]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwRestoreKey [0xEF735D48]
    SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwSetValueKey [0xEF735EC8]

    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwCreateProcessEx [0xEF742B9C]
    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwCreateSection [0xEF7429C0]
    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ZwLoadDriver [0xEF742AFA]
    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            NtCreateSection
    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ObInsertObject
    Code            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)            ObMakeTemporaryObject

    ---- Kernel code sections - GMER 1.0.15 ----

    PAGE            ntoskrnl.exe!ObInsertObject                                                                      80564423 5 Bytes  JMP EF73FF6C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE            ntoskrnl.exe!NtCreateSection                                                                     8056469B 7 Bytes  JMP EF7429C4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE            ntoskrnl.exe!ZwCreateProcessEx                                                                   805820F6 7 Bytes  JMP EF742BA0 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE            ntoskrnl.exe!ObMakeTemporaryObject                                                               805A29A4 5 Bytes  JMP EF73E5B4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    PAGE            ntoskrnl.exe!ZwLoadDriver                                                                        805A5972 7 Bytes  JMP EF742AFE \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)
    init            C:\WINDOWS\system32\drivers\tifmsony.sys                                                         entry point in "init" section [0xF85DD280]
    .rsrc           C:\WINDOWS\system32\DRIVERS\mouclass.sys                                                         entry point in ".rsrc" section [0xF88B7814]

    ---- User code sections - GMER 1.0.15 ----

    .text           C:\WINDOWS\System32\svchost.exe[1248] ntdll.dll!NtProtectVirtualMemory                           7C90D6EE 5 Bytes  JMP 007A000A
    .text           C:\WINDOWS\System32\svchost.exe[1248] ntdll.dll!NtWriteVirtualMemory                             7C90DFAE 5 Bytes  JMP 007B000A
    .text           C:\WINDOWS\System32\svchost.exe[1248] ntdll.dll!KiUserExceptionDispatcher                        7C90E47C 5 Bytes  JMP 0079000C
    .text           C:\WINDOWS\System32\svchost.exe[1248] USER32.dll!GetCursorPos                                    7E41BD76 5 Bytes  JMP 0109000A
    .text           C:\WINDOWS\System32\svchost.exe[1248] ole32.dll!CoCreateInstance                                 774FFAC3 5 Bytes  JMP 0098000A
    .text           C:\Program Files\Mozilla Firefox\plugin-container.exe[2628] USER32.dll!TrackPopupMenu            7E4650EE 5 Bytes  JMP 104505FE C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
    .text           C:\WINDOWS\system32\wuauclt.exe[2908] ntdll.dll!NtProtectVirtualMemory                           7C90D6EE 5 Bytes  JMP 00A3000A
    .text           C:\WINDOWS\system32\wuauclt.exe[2908] ntdll.dll!NtWriteVirtualMemory                             7C90DFAE 5 Bytes  JMP 00A4000A
    .text           C:\WINDOWS\system32\wuauclt.exe[2908] ntdll.dll!KiUserExceptionDispatcher                        7C90E47C 5 Bytes  JMP 003D000C
    .text           C:\WINDOWS\Explorer.EXE[3860] ntdll.dll!NtProtectVirtualMemory                                   7C90D6EE 5 Bytes  JMP 00A1000A
    .text           C:\WINDOWS\Explorer.EXE[3860] ntdll.dll!NtWriteVirtualMemory                                     7C90DFAE 5 Bytes  JMP 00A7000A
    .text           C:\WINDOWS\Explorer.EXE[3860] ntdll.dll!KiUserExceptionDispatcher                                7C90E47C 5 Bytes  JMP 00A0000C
    .text           C:\Program Files\Mozilla Firefox\firefox.exe[4060] ntdll.dll!NtProtectVirtualMemory              7C90D6EE 5 Bytes  JMP 00FB000A
    .text           C:\Program Files\Mozilla Firefox\firefox.exe[4060] ntdll.dll!NtWriteVirtualMemory                7C90DFAE 5 Bytes  JMP 00FC000A
    .text           C:\Program Files\Mozilla Firefox\firefox.exe[4060] ntdll.dll!KiUserExceptionDispatcher           7C90E47C 5 Bytes  JMP 00FA000C

    ---- Devices - GMER 1.0.15 ----

    Device          \FileSystem\Ntfs \Ntfs                                                                           aswSP.SYS (avast! self protection module/ALWIL Software)

    AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                           aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

    Device          \Driver\BTHUSB \Device\0000008f                                                                  bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
    Device          \Driver\BTHUSB \Device\0000008f                                                                  bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

    AttachedDevice  \Driver\Tcpip \Device\Ip                                                                         aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice  \Driver\Tcpip \Device\Udp                                                                        aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
    AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                      aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

    Device          \Driver\BTHUSB \Device\0000008d                                                                  bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
    Device          \Driver\BTHUSB \Device\0000008d                                                                  bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
    Device           -> \Driver\atapi \Device\Harddisk0\DR0                                                          821CEEC5

    ---- Registry - GMER 1.0.15 ----

    Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00014a1494b7                     
    Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\080046e09ef5                     
    Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00014a1494b7 (not active ControlSet) 
    Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\080046e09ef5 (not active ControlSet) 

    ---- Files - GMER 1.0.15 ----

    File            C:\WINDOWS\system32\DRIVERS\mouclass.sys                                                         suspicious modification
    File            C:\WINDOWS\system32\drivers\atapi.sys                                                            suspicious modification

    ---- EOF - GMER 1.0.15 ----

    Offline essexboy

    • Malware removal instructor
    • Avast Überevangelist
    • Probably Bot
    • *****
    • Posts: 40589
    • Dragons by Sasha
      • Malware fixes
    Re: at a loss to find the virus
    « Reply #40 on: July 17, 2010, 12:17:04 PM »
    Hi you have a variant of TDSS rootkit

    Download TDSSKiller and save it to your Desktop.

    • Extract the file and run it.
    • Once completed it will create a log in the root directory (usually C:\).
    • Please post the contents of that log in your next reply.

    THEN

    Download ComboFix from one of these locations:


    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.

    Offline DavidR

    • Avast Überevangelist
    • Certainly Bot
    • *****
    • Posts: 89237
    • No support PMs thanks
    Re: at a loss to find the virus
    « Reply #41 on: July 17, 2010, 04:53:06 PM »
    Thanks for stepping in to help essexboy.
    Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

    Offline essexboy

    • Malware removal instructor
    • Avast Überevangelist
    • Probably Bot
    • *****
    • Posts: 40589
    • Dragons by Sasha
      • Malware fixes
    Re: at a loss to find the virus
    « Reply #42 on: July 17, 2010, 05:57:12 PM »
    My pleasure  ;D

    theladyupstairs

    • Guest
    Re: at a loss to find the virus
    « Reply #43 on: July 17, 2010, 06:38:25 PM »
    i thank you also, essex boy.

    david - i assume you agree & have nothing to add to essex boy's directions????  i just printed them out & will start work now, but if there's anything you wish to add (considering my lack of tech savvy) please tell me now.  thanks!

    i'll wait a bit for your reply before i begin.

    waiting for you....




    theladyupstairs

    • Guest
    Re: at a loss to find the virus
    « Reply #44 on: July 17, 2010, 07:00:27 PM »
    p.s. - with all due respect to essex boy!  i just don't have any experience with you, and i'm such a scardie-cat, afraid of my computer & doing this stuff.  david has been with me on this from the beginning & so i just wanted his accord before i go ahead, which i'm probably going to do now - with your instructions -  since i haven't heard from him.  i am eager to get this thing over with.

    i hope you understand & don't take this personally.  i don't know how things work at avast & that is why.