Our main PC has been infected by This:

Reformat the hard disc

Recover OS/apps using your chosen disaster recovery backup to a date before the problem occurred. Then carefully bring back important data files only rolling forward to today.

End of problem.

quote:

Originally posted by jon honeyball:
Reformat the hard disc

Recover OS/apps using your chosen disaster recovery backup to a date before the problem occurred. Then carefully bring back important data files only rolling forward to today.

End of problem.

always a nice way to spend the day :-)

If its been properly thought through and tested, it shouldnt take longer than an hour.

And it has an almost 100% certainty of success.

Spending an hour poking around inside Windows attempting to get rid of a virus or trojan is far less likely to be successful. And, to be honest, far more likely to make things worse.

Assuming the data is of value, the original poster will have such a proper recovery sorted out. If he/she doesnt, then clearly the data held on the machine is of no value, in which case just do a reformat and recovery of the OS/apps. (Many people have no local data of importance, with everything held in offsite email stores)

jon

quote:

Originally posted by jon honeyball:

Assuming the data is of value, the original poster will have such a proper recovery sorted out. If he/she doesnt, then clearly the data held on the machine is of no value, in which case just do a reformat and recovery of the OS/apps.

jon

Jon, how nice it would be to think this were the case. I've come across many folk who store data of great value to themselves and have absolutely no backup and recovery strategy whatsoever.

TomK,

I think Jon probably knows this! He is, shall we say, reasonably well up on computers.

Fraser

Backup data, install Ubuntu 8.10 and use open source products and code to keep you and your data safer while surfing.

This zone labs forum link may help.

message five in this thread has 6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C mentioned in a log file.


It seems as if may well be a nasty one and you may have to follow Jon's route but hopefully you will find an easier answer here. If you read all the postings in this thread you'll get a better feel for a solution.


SJB

quote:

Originally posted by Roy T:
Backup data, install Ubuntu 8.10 and use open source products and code to keep you and your data safer while surfing.

Always good to see another completely unhelpful post from the open-source brigade.

Back up possibly infected data, great idea.

quote:

Originally posted by Roy T:
Backup data, install Ubuntu 8.10 and use open source products and code to keep you and your data safer while surfing.

This is, actually, a very good advice! The only way to truly remove most viruses, once you've contracted them is to reinstall. Since you are about to that, why not try an alternative? The only reason not to use it if you have a piece of software on your current OS you can't do without. There are alternatives for most of the common needed uses of a computer (internet usage, manipulation of office documents, multimedia...), so why not give it a try? There is a live CD available, which you can run without installing, and that CD is also an excellent tool to backup your data leftover on the laptop. Mind you - only data (documents, music, etc.) are safe to backup....

nkrgovic

All fine ideas on the assumption that the laptop is not part of a corporate environment....once you are in that place the rules of engagement are somewhat different.

Jim

quote:

Originally posted by Fraser Hadden:
TomK,

I think Jon probably knows this! He is, shall we say, reasonably well up on computers.

Fraser

Fraser I've taken Jon's words at face value as there are no sarcastic smileys or anything else to indicate I should do otherwise. Perhaps if he'd added "In an ideal world" somewhere I'd have read it differently. However, based on this message I have to conclude that Jon's view of Joe Public is extremely optimistic to say the least. How I wish he was correct as my technicians spend a great deal of their time trying to recover data lost by punters who have stored essential stuff locally rather than on their network drives which are backed up every night while their local drives are never backed up.

Tom

I make no apology if my tone on this thread comes across as somewhat abrasive...

In my experience there are two sorts of people in the world: those who have suffered a major data loss, and those who havent yet...

Protecting yourself against loss is not hard, doesnt require witchcraft, and can and should be done on a regular basis to at least DVD writeable discs as a starting point. A half terabyte external USB hard disc is another excellent tool to use, and costs about a hundred pounds. Tools like Norton's excellent Save & Restore 2 are a few tens of pounds, and will happily create a fully recoverable set of images. None of this is hard.

And yes, I have lost count of the number of times when I have received a borderline tearful phonecall from friend/family/client/reader who has just lost their photos/their accounts/their PHD thesis one week before submission.

Even emailing files to your own hotmail/gmail account as attachments is better than nothing.

quote:

Originally posted by jon honeyball:
...I have lost count of the number of times when I have received a borderline tearful phonecall from friend/family/client/reader who has just lost their photos/their accounts/their PHD thesis one week before submission...

Oops

quote:

Originally posted by Roy Donaldson:

quote:

Originally posted by Roy T:
Backup data, install Ubuntu 8.10 and use open source products and code to keep you and your data safer while surfing.

Always good to see another completely unhelpful post from the open-source brigade.

Some may find it at first glance unhelpful but other may not.

I was thinking along the lines of booting with a Ubuntu LiveCD, connecting an external storage and copying all user created data over to the external storage via the Ubuntu system without disturbing mounting the dodgy Windows system. Once the user created data is safely stored away from the infected Windows machine you can then nuke and reinstall both a fresh uninfected Windows system and archived user created content from the external storage. You may even wish to dual boot Windows and Ubuntu so as to have a working system more often than not able to access user created data with ease and safety whenever the Windows system again becomes infected.

I have used this quite a few times to fix Windows PCs owned by others, it works but YMMV.

Which is why Windows PE is a better CD/DVD bootable OS for most non-techies -- it gives them all the tools they are used to seeing, without having booted from the dodgy PC itself.

Can you remember what you were originally doing on the PC to get infected in the first place?

quote:

All fine ideas on the assumption that the laptop is not part of a corporate environment....once you are in that place the rules of engagement are somewhat different

As a system administrator I assume that corporate laptops are never restored by the user - simply because somehow "not working" PC's always end up on my desk.

In other words, corporate computers get fixed by corporate IT staff.

quote:

Originally posted by nap-ster:
Can you remember what you were originally doing on the PC to get infected in the first place?

Adobe Updater was running at the time Zone Alarm flashed up a flag to say "there is a rtm file requesting access to the trusted Zone " which I assumed was part of Adobe updater because that's all that was running ,anyway a pop up came up one the screen offering a free virus scan ,on which no matter were I clicked would not go away ,so I opened Task Manager to close that way ,then the Adobe programs stopped working saying there had been an error & it had to close so I rebooted the PC ,after rebooting & opening adobe again I noticed 2 Icons on the Desktop I for hard porn & 1 for Gay Fetish so I deleted the shortcuts Then went to Add& remove & could not find the programs anywhere so rebooted the PC now started playing up first it would not accept my Password ,then typing exactly the same password it did,then once the desktop appears it keeps flashing on & off /unable to access programs etc my Antivirus (steganos) Said there was an update available so I opened up my Antivirus there was a message saying I could get a free upgrade to the latest version mine runs out in Feb so I thought why not BAD mistake I think now must have been a fake/copy of my Antivus because after that I could not update my Antivirus kept getting an error message from Steganos about the program having no components running ,so I thought I must have a trojan or Virus & unplugged it from the router .Now I am trawling the Computer help forums on my Laptop.

Tried this so far
Malwarebytes download to my lap top on to a pen drive , the pen drive would not open on the PC ,I followed these instructions W32,Momib Symantecexcept I could not update my antivirus & could not find these files in the Registery * HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\"Microsoft Net Driver" = "%Windir%\NETSVC.exe"
* HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\"load" = "%Windir%\NETUI.EXE"
* HKEY_LOCAL_MACHINE\Software\Microsoft\WinNT\"ID" = "[CURRENT DATE IN FORMAT OF DD/MM/YYYY]" as well as the instructions from "how Malware hides & is installed as a service deleting all of the Legacy svcname files from the registery ,I am still having the same problems desktop flashing on & off ,if I try to open anything I have a limited amount of time before the desktop closes&opens ,& as i'm not the quickests typist in the world I don,t too much of a chance to sort it out ,I'm getting to the point were I thinking of just replacing the hard drive. also can worms travel via Wi Fi?...........Jim

Just run HJT on my Laptop just make sure it's not infected anyone know how to read this
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:01:43, on 06/01/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe
C:\Program Files\TOSHIBA\Toshiba Online Product Information\TOPI.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\TOSHIBA\Registration\ToshibaRegistration.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
C:\Windows\ehome\ehtray.exe
C:\Users\MARY\AppData\Local\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
C:\Users\MARY\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynToshiba.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hmrc.gov.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [HWSetup] \HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
O4 - HKLM\..\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
O4 - HKLM\..\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
O4 - HKLM\..\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Desktop SMS] C:\Program Files\IDM\Desktop SMS\DesktopSMS.exe /auto
O4 - HKLM\..\Run: [topi] C:\Program Files\TOSHIBA\Toshiba Online Product Information\topi.exe -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Camera Assistant Software] "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaRegistration.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [TOSCDSPD] TOSCDSPD.EXE
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Users\MARY\AppData\Local\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
O4 - HKCU\..\Run: [Google Update] "C:\Users\MARY\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: BBC iPlayer Desktop.lnk = C:\Program Files\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 (file missing)
O9 - Extra button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - http://www.amazon.co.uk/exec/obidos/redirect-home?tag=T...bholink-21&site=home (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: eBay - {C08CAF1D-C0A3-40D5-9970-06D067EAC017} - http://www.webtip.ch/cgi-bin/toshiba/tracker_url.pl?EN (file missing)
O13 - Gopher Prefix:
O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
O16 - DPF: {678940D3-080C-4FCE-A54D-D443E1177F01} - https://www.coolroom.com/ActiveX/ax.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HD DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\Windows\system32\TODDSrv.exe
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA Corporation - (no file)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe

--
End of file - 10463 bytes

A system restore to a place prior to this "might" work if you haven't tried it already.

Won't let me do System Restore First thing I tried nap thanks anyway!.....Jim

http://www.daniweb.com/forums/thread165672.html

This might be worth looking at?

quote:

Originally posted by nap-ster:
http://www.daniweb.com/forums/thread165672.html

This might be worth looking at?

The "Judy" on that thread is incredibly helpful. "Give-you-renewed-faith-in-humanity"-type helpful!