Free PC Support
PC Help Forums from the Experts at Technical-Assistance.co.uk
 
Google
 
Search The Web Search This Site
 RSS FeedRSS Feed   FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Virus attack, yet again
Goto page 1, 2  Next
 
Reply to topic    Free PC Support Forum Home -> Helproom
Author Message
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Tue Feb 16, 2010 11:35 am    Post subject: Virus attack, yet again Reply with quote

Hi softstag, its me again. You have helped my solved my case on a viral attack earlier on, hopefully you remembered. Anyway, my computer now has encountered a stronger strain of virus. Although my Avast Antivirus 5.0 shows as Win32:Malware-gen, i beg to differ. This virus is totally stronger than the one that i encountered last time. Firstly, it prevented me from accessing the web, by all means. That includes browsers, and applications that have built-in web browsing features. However, applications such as MSN messenger are still able to connect and chat. I have scanned with Malwarebytes Anti-malware and Avast. I have also scanned with Windows Malicious Software Removal Tool version 3.4 and removed all possible viruses, even if it is a false alarm. I also downloaded Superkill (360专杀大全)from QiZhi Software (Beijing) Co.Ltd and removed all possible dangers. However, this all did not work UNTIL I RESTARTED MY COMPUTER and USED THE LAST KNOWN GOOD CONFIGURATION and booted up in the "backup" done by 360safe. Now, my computer is working still normally but I am very afraid that the virus will come back again. Also, I cannot edit my hosts file and it will give me an error showing that the file is invalid and make sure that the file name and path are correct. Can you help me with the following questions?

1. How to edit the hosts file?
2. Is there any way of totally removing the virus?
3. What is a possible name for the virus in my computer so that I can try to find a remover on the internet.
4. Will any programs be affected?
5. Will I still have the rights to edit some documents like the registry?

My computer is Windows XP SP3 and I have recently installed the newest version of Avast 5.0 and a game which I downloaded and virus-scanned many times. Thank you.
Back to top
View user's profile Send private message
SoftStag



Joined: 05 Feb 2006
Posts: 2049
Location: UK

PostPosted: Thu Feb 18, 2010 5:05 pm    Post subject: Reply with quote

In answer to your questions:
Quote:
1. How to edit the hosts file?

Browse to C:\Windows\System32\drivers\etc\ and open the hosts file. It has no extension, so will ask you what to open it with - select Notepad. You should now be able to edit it.
Quote:
2. Is there any way of totally removing the virus?

Yes. Format the hard drive, and reinstall Windows - this will delete any data on he hard drive, so back up first!
Quote:
3. What is a possible name for the virus in my computer so that I can try to find a remover on the internet.

I don't know. If Abast says it's Win32:Malware-gen, it probably is, or a variant of it.
Quote:
4. Will any programs be affected?

As we don't know what the virus is, we can only assume they are.
Quote:
Will I still have the rights to edit some documents like the registry?

I don't know. Have you tried?

I think your best course of action is to back up any data, format the hard drive, install Windows and any applications you use. This seems to be the best way to ensure the PC is virus free. You will, however, need to ensure that you don't download from untrusted sources, and keep you PC behind a firewall and have AV software installed.
_________________
"Microsoft programs are generally bug-free. If you visit the Microsoft hotline, you'll literally have to wait weeks if not months until someone calls in with a bug in one of our programs. 99.99% of calls turn out to be user mistakes. I know not a single less irrelevant reason for an update than bugfixes. The reasons for updates are to present more new features."
-- Bill Gates, on code stability, from Focus Magazine
Back to top
View user's profile Send private message Visit poster's website
Steve



Joined: 07 Feb 2006
Posts: 184
Location: Bangalore, India

PostPosted: Fri Feb 19, 2010 5:20 am    Post subject: Re: Virus attack, yet again Reply with quote

sijie123 wrote:
My computer is Windows XP SP3 and I have recently installed the newest version of Avast 5.0 and a game which I downloaded and virus-scanned many times.

I think this is your problem. Where did you download the game from? If is was a torrent or rapidshare link or similar, then chances are you are not only downloading something illegally, but also with the potential of having viruses and other malware in them. AV software is not 100% infallible, especially when it comes to new viruses.
Mr. Green
_________________
My Photo Gallery
Back to top
View user's profile Send private message Visit poster's website
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Sat Feb 20, 2010 6:02 am    Post subject: Reply with quote

*sorry i mean how to edit the host file as i am unable to save it after editing.

Also, I have made a log which i have found in my registry. These files may not be a virus, but since they are in System32, I feel that more attention is required for them. Although this is a long list, I will be grateful to you if u can help me check them for viruses.

"C:\\WINDOWS\\system32\\msxml4.dll"=dword:00000009
"C:\\WINDOWS\\system32\\msxml4r.dll"=dword:00000009
"C:\\WINDOWS\\system32\\BACSCPL.cpl"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto_office.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto_notes.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTNeighborhood.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btcss.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTNCopy.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btwpimif.dll"=dword:00000001
"C:\\WINDOWS\\system32\\bt2k_ins.dll"=dword:00000001
"C:\\WINDOWS\\system32\\wbtapi.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btcpl.cpl"=dword:00000001
"C:\\WINDOWS\\system32\\btsec.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btosif.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btosif_notes.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btosif_ol.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btins.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btdev.dll"=dword:00000001
"C:\\WINDOWS\\system32\\WidcommSdk.dll"=dword:00000001
"C:\\WINDOWS\\system32\\lcppn21.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto_lnagent.nsf"=dword:00000001
"C:\\WINDOWS\\system32\\BTXPPanel.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BtXpShell.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btrez.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btbigbmp.dll"=dword:00000001
"C:\\WINDOWS\\system32\\bthcrp.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btosif_olx.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BtWizard.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto_wab.dll"=dword:00000001
"C:\\WINDOWS\\system32\\atl.dll"=dword:00000004
"C:\\WINDOWS\\system32\\comcat.dll"=dword:00000004
"C:\\WINDOWS\\system32\\mfc42.dll"=dword:00000007
"C:\\WINDOWS\\system32\\mfc42u.dll"=dword:00000003
"C:\\WINDOWS\\system32\\msvcirt.dll"=dword:00000004
"C:\\WINDOWS\\system32\\msvcp60.dll"=dword:00000007
"C:\\WINDOWS\\system32\\msvcrt.dll"=dword:0000000d
"C:\\WINDOWS\\system32\\olepro32.dll"=dword:00000007
"C:\\WINDOWS\\system32\\stdole2.tlb"=dword:00000004
"C:\\WINDOWS\\system32\\oleaut32.dll"=dword:00000004
"C:\\WINDOWS\\system32\\BtAudioHelper.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTNeighborhood.tlb"=dword:00000001
"C:\\WINDOWS\\system32\\btwhidcs.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btbip.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTNCopy.tlb"=dword:00000001
"C:\\WINDOWS\\system32\\BtWiaExt.dll"=dword:00000001
"C:\\WINDOWS\\system32\\CSH.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\BTXPPanel.tlb"=dword:00000001
"C:\\WINDOWS\\system32\\btsendto_ie.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTChooser.dll"=dword:00000001
"C:\\WINDOWS\\system32\\BTNeighborhood.dll.manifest"=dword:00000001
"C:\\WINDOWS\\system32\\btcss.dll.manifest"=dword:00000001
"C:\\WINDOWS\\system32\\btcpl.cpl.manifest"=dword:00000001
"C:\\WINDOWS\\system32\\bthcrpui.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btprn2k.dll"=dword:00000001
"C:\\WINDOWS\\system32\\btrezxp.dll"=dword:00000001
"C:\\WINDOWS\\system32\\asycfilt.dll"=dword:00000003
"C:\\WINDOWS\\system32\\VXBLOCK.dll"=dword:00000005
"C:\\WINDOWS\\inf\\drvmcdb.inf"=dword:00000001
"C:\\WINDOWS\\system32\\vxdmdcdlg.dll"=dword:00000001
"C:\\WINDOWS\\inf\\pnpwide.inf"=dword:00000001
"C:\\WINDOWS\\inf\\pnpwtape.inf"=dword:00000001
"C:\\WINDOWS\\DLA.EXE"=dword:00000001
"C:\\WINDOWS\\System32\\DLAAPI_W.DLL"=dword:00000001
"C:\\WINDOWS\\System32\\Drivers\\DLARTL_N.SYS"=dword:00000001
"C:\\WINDOWS\\System32\\Drivers\\DLACDBHM.SYS"=dword:00000001
"C:\\WINDOWS\\System32\\Drivers\\DRVMCDB.SYS"=dword:00000001
"C:\\WINDOWS\\System32\\Drivers\\DRVNDDM.SYS"=dword:00000001
"C:\\WINDOWS\\system32\\Px.dll"=dword:00000004
"C:\\WINDOWS\\system32\\PxMas.dll"=dword:00000004
"C:\\WINDOWS\\system32\\PxWave.dll"=dword:00000004
"C:\\WINDOWS\\system32\\pxwma.dll"=dword:00000004
"C:\\WINDOWS\\inf\\pxhelp20.inf"=dword:00000004
"C:\\WINDOWS\\system32\\drivers\\pxhelp20.sys"=dword:00000004
"C:\\WINDOWS\\system32\\px.ini"=dword:00000004
"C:\\WINDOWS\\system32\\pxdrv.dll"=dword:00000004
"C:\\WINDOWS\\system32\\UMLoader.dll"=dword:00000005
"C:\\WINDOWS\\system32\\MSCOMCTL.OCX"=dword:00000003
"C:\\WINDOWS\\system32\\VSFLEX3.OCX"=dword:00000002
"C:\\WINDOWS\\system32\\MSRDO20.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\FM20.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\FM20ENU.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MAPISRVR.EXE"=dword:00000001
"C:\\WINDOWS\\system32\\PCDLIB32.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\NSCMPS.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\NSERROR.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\MSAUD32.ACM"=dword:00000002
"C:\\WINDOWS\\system32\\MPG4C32.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\MFC42ENU.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\VEN2232.OLB"=dword:00000002
"C:\\WINDOWS\\system32\\VBAEND32.OLB"=dword:00000002
"C:\\WINDOWS\\system32\\VBAEN32.OLB"=dword:00000002
"C:\\WINDOWS\\system32\\MSSTDFMT.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MSSTKPRP.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MSXML3.DLL"=dword:00000002
"C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PKMWS.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\ATHPRXY.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\CTFMON.EXE"=dword:00000002
"C:\\WINDOWS\\system32\\MSCTF.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MSCTFP.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MSIMTF.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\MSUTB.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\SL_ANET.ACM"=dword:00000001
"C:\\WINDOWS\\system32\\MSXML3R.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\C_932.NLS"=dword:00000002
"C:\\WINDOWS\\system32\\C_936.NLS"=dword:00000002
"C:\\WINDOWS\\system32\\C_949.NLS"=dword:00000002
"C:\\WINDOWS\\system32\\C_950.NLS"=dword:00000002
"C:\\WINDOWS\\system32\\Decdnet.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Pncrt.dll"=dword:00000002
"C:\\WINDOWS\\system32\\Pnen3230.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Pnloader.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Pnui3230.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Ra3214_4.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Ra3228_8.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Ra32dnet.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Ract14_4.dll"=dword:00000001
"C:\\WINDOWS\\system32\\Ractdnet.dll"=dword:00000001
"C:\\WINDOWS\\system32\\VOCTL32.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\Voctool.dll"=dword:00000001
"C:\\WINDOWS\\system32\\WMV9VCM.dll"=dword:00000001
"C:\\Program Files\\Common Files\\Microsoft Shared\\Equation\\EQNEDT32.EXE"=dword:80000000
"C:\\WINDOWS\\system32\\RDOCURS.DLL"=dword:00000002
"C:\\WINDOWS\\system32\\OUTLPERF.H"=dword:00000001
"C:\\WINDOWS\\system32\\msvcr71.dll"=dword:00000007
"C:\\WINDOWS\\system32\\atl71.dll"=dword:00000002
"C:\\WINDOWS\\system32\\msvcp71.dll"=dword:00000007
"C:\\WINDOWS\\system32\\WISPTIS.EXE"=dword:00000001
"C:\\WINDOWS\\system32\\INKED.DLL"=dword:00000001
"C:\\WINDOWS\\system32\\unicows.dll"=dword:00000001
"C:\\WINDOWS\\system32\\XceedCry.dll"=dword:00000001
"C:\\WINDOWS\\system32\\XceedZip.dll"=dword:00000001
"C:\\WINDOWS\\system32\\actskn43.ocx"=dword:00000001
"C:\\WINDOWS\\system32\\XceedSco.dll"=dword:00000001
Back to top
View user's profile Send private message
SoftStag



Joined: 05 Feb 2006
Posts: 2049
Location: UK

PostPosted: Sat Feb 20, 2010 8:09 am    Post subject: Reply with quote

Some security software will make your hosts file read only. Remove the read only attribute (right click - properties), edit it and save. It is a good idea to put the read only attribute back afterwards. Also, you will need to have Administrator privileges to edit the hosts file. If this doesn't work, please let us know what the error is.

With regard to the registry entries, I can't see anything obvious there, and I don't have time to research each and every entry. Try doing a Google search for each one and identifying what the file is for and if it may be malicious.

I still maintain the best course of action is a format and reinstall.
_________________
"Microsoft programs are generally bug-free. If you visit the Microsoft hotline, you'll literally have to wait weeks if not months until someone calls in with a bug in one of our programs. 99.99% of calls turn out to be user mistakes. I know not a single less irrelevant reason for an update than bugfixes. The reasons for updates are to present more new features."
-- Bill Gates, on code stability, from Focus Magazine
Back to top
View user's profile Send private message Visit poster's website
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Tue Feb 23, 2010 1:43 pm    Post subject: Reply with quote

well, personally, i dont want to reformat my Harddisk. This is because i will lose all my data. I dont have a External HDD so if i reformat, all my data will be lost. Currently, after installing many types of spyware and malware removers, and by deleting some stuff that i dont see to be of harm, like adware-bot, my computer was alright. Everything was quite back to normal but i couldn't figure out why this was so. I don't think that anything deleted was very dangerous like a trojan or something but my computer was just fixed. Is there any types of malware that shows the same symptoms? I nid to know them to determine the virus type in my computer, so as to fully exterminate them. I am thinking that the virus sort of "detected" that an antivirus was in my computer and "disabled" or "deleted" itself.
P.S. I installed: Webroot (Scan Version) but file was corrupted, 360 superkiller by Qizhi Software (Beijing) Co. Ltd, Spyware Doctor by PCtools, spybot, MBAM, and hijackthis.
I did remove quite a lot of stuff, but most were cookies. The most dangerous file that i thought i removed was 1 dloader.trojan but that was some time back.
Also, 360 superkiller is able to restore some of the features, such as the hosts file, back to a working state. Currently, my com is working perfect, but i do think that there should still be some remains of the virus in my computer.
One final thing, should I clear up my system restore data? I cant restore my data for some reason. They just say that "system Restore failed" and thats all after i used system restore.
In a nutshell, can you tell me the likely viruses that are in my computer, and any other ways to totally clear remains of the viruses? Also, can I delete system restore data, since I cant use them?
Back to top
View user's profile Send private message
SoftStag



Joined: 05 Feb 2006
Posts: 2049
Location: UK

PostPosted: Wed Feb 24, 2010 5:58 pm    Post subject: Reply with quote

I don't know what the name of the virus is on your computer, or even for sure that you have one. Many malware infections lie dormant for periods of time, or lose contact with their command centre and just sit there waiting for instruction - whether that is to take part in a DoS attack, or send specific spam mails, etc. Others only have effect for a period of time, or only on certain dates. There are tens of thousands of different malware programs, each with their own purpose or task, and each with it's own quirks. They can be inconsistent and unpredictable.

Yes, you can delete you system restore data if you want.

Incidentally, you should find a way to back up your data if it is important to you. What will you do if your PC fails, or the hard drive crashes, or a virus formats the drive? I learned my lesson a few years ago when my hard drive crashed - I lost everything.
_________________
"Microsoft programs are generally bug-free. If you visit the Microsoft hotline, you'll literally have to wait weeks if not months until someone calls in with a bug in one of our programs. 99.99% of calls turn out to be user mistakes. I know not a single less irrelevant reason for an update than bugfixes. The reasons for updates are to present more new features."
-- Bill Gates, on code stability, from Focus Magazine
Back to top
View user's profile Send private message Visit poster's website
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Thu Feb 25, 2010 3:06 am    Post subject: Reply with quote

k thx for ur reply but the virus that was shown in my Avast! 5.0 was Win32: Malware-gen. What does this group consist of? A search on the internet shows that it is just a common group of viruses. My friend also said that it could mean almost any Win32: Malware viruses. Is it true? Cuz if it is, then i think i might have more problems removing the virus, since it is not a definite virus
Back to top
View user's profile Send private message
SoftStag



Joined: 05 Feb 2006
Posts: 2049
Location: UK

PostPosted: Thu Feb 25, 2010 5:46 pm    Post subject: Reply with quote

I would guess that this is a name for malware that it can't identify by name.

Win32 - This will mean it's Windows 32 bit code
Malware-gen - I suspect this means generic malware

So it's generic malware designed to run in a 32 bit Windows environment. It could be anything! I think it is probably malware detected by heuristics, so can't assign a name.

If you know what files were found to be infected, this may give a clue as to the identity of the malware.
_________________
"Microsoft programs are generally bug-free. If you visit the Microsoft hotline, you'll literally have to wait weeks if not months until someone calls in with a bug in one of our programs. 99.99% of calls turn out to be user mistakes. I know not a single less irrelevant reason for an update than bugfixes. The reasons for updates are to present more new features."
-- Bill Gates, on code stability, from Focus Magazine
Back to top
View user's profile Send private message Visit poster's website
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Sat Feb 27, 2010 8:45 am    Post subject: Reply with quote

hi softstag,
it happens when i m playing wolfteam (by Softnyx) (http://wolfteam.softnyx.com) and usually when the game loads just before i start playing the game, the virus alert pops out. the location of the file is in C:\Documents and settings\(Username)\Local Settings\Temp. the file name is usually like obj2E.tmp or obj3D.tmp and things like that.
* (username) is the current log on user. Whichever account i log into (my computer has multiple accounts), the virus will appear under that user's account.
Back to top
View user's profile Send private message
SoftStag



Joined: 05 Feb 2006
Posts: 2049
Location: UK

PostPosted: Tue Mar 02, 2010 5:58 pm    Post subject: Reply with quote

These files look like something to do with the game. Possibly a false positive from Avast - might be worth checking with Softnyx or Avast to see if this issue has been seen before. Also, if you downloaded the game from a non-reputable source (Bittorrent, Warez site, etc.) then your copy of the game may be the problem.
_________________
"Microsoft programs are generally bug-free. If you visit the Microsoft hotline, you'll literally have to wait weeks if not months until someone calls in with a bug in one of our programs. 99.99% of calls turn out to be user mistakes. I know not a single less irrelevant reason for an update than bugfixes. The reasons for updates are to present more new features."
-- Bill Gates, on code stability, from Focus Magazine
Back to top
View user's profile Send private message Visit poster's website
sijie123



Joined: 27 Nov 2009
Posts: 45

PostPosted: Wed Mar 03, 2010 12:29 pm    Post subject: Reply with quote

well, i can assure you that this object is created when i play the game, but it contains no virus nor does Avast report a false positive. It is because my friends are also playing this game and report no problem. I was just playing with my friend the day before. Also, just a recent update, i realised that i have a VBS:Malware-gen in my computer when i inserted a thumbdrive. It is an autorun virus right? Anyway, my computer has started to fail me recently. Without warning, it will just abruptly restart (no shutdown screen and no blue screen) or simply just a blue screen error. For the blue screen error, it shows a hardware malfunction. However, it is usually at intervals when i am the most happy or excited, like when i win a game or when i load an application. Besides, my system has been VERY UNSTABLE these days. Things like system hangs occur very often, usually when i insert an external HDD or a thumbdrive. So, i now can only plug them in the computer before my computer is turned on. Also, my startup time has been greatly increased to 1 min 45 sec approx. One of the longest startup period was after the windows logo, before i log on as the user. (Just right before the "Windows is starting up" phrase, the moment when the screen is black, the system stucks there for around 5 to 10 sec). Can you recommend me any cleaners for my system? I suspect faults in the registry and the core Windows folders.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Free PC Support Forum Home -> Helproom All times are GMT
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

 



Powered by phpBB © 2001, 2005 phpBB Group

2005 - 2017 All Rights Reserved www.technical-assistance.co.uk
Terms and Conditions