Trojan found

L

Lazarus

New Member
Sorry if this has been asked before but Avast just found a Trojan on my PC."Recommended action move to chest" Did that. Now what do i do?Do i just let the file sit there?
 
If Avast provides exact information to show just where the trojan is located manual removal is the preferred method to see it gone forever. If you can't do that right off through Windows Explorer your next is to simply boot up in safe mode for this. Generally most will post a HiJack This or smitfraud log to show any registy entries made by this. Other then that delete it.
 
ok cheers for the replies...this is what i've got:
1.C:\Program Files(x86)\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe --->i've moved that to the chest and deleted it?was that a wise move?
2. --->moved to chest.what to do next?

I'm gonna post a hijackthis log in a minute.
Thanks.
 
Logfile of HijackThis v1.99.1
Scan saved at 19:55:25, on 14.03.2007
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files (x86)\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HijackThis\HijackThis.exe

F2 - REG:system.ini: UserInit=userinit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files (x86)\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files (x86)\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files (x86)\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146851319546
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1146852261578
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XIb\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business XIb\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)


All i can say is that i don't understand all the (file missing)bits cause everything i install and uninstall i do it in a normal fashion.:(

Any help is appriciated.Thanks.
 
Once the trojan was quaranteened and removed your problem seems to have disappeared temporarily at least. Daemon Tools however is not a malware or trojan but a program for mounting cd/dvd images on hard drives. You can look over the description seen on this at http://www.afterdawn.com/software/cdr_software/cdr_tools/daemon_tools.cfm

Apparently Avast has misidentified a shareware version if you downloaded and cd tools lately as a trojan. The program itself is removable in the control panel. I thought you should be aware of this. For future reference you may want to go with AVG 7.5 and Grisoft's replacement of Ewido called AVG Anti-Spyware Remover found at http://free.grisoft.com/doc/5390/lng/us/tpl/v5#avg-anti-spyware-free

The antispyware tool there runs full features for the first 30 days. Another tool reviewed lately for addintional protection is the Spyware Terminator that includes a mild personal firewall. Updating from SP1 seen in your sig with the newer MS updates and going from IE 6 to IE 7 has been one help here in keeping "unvited guests" off of the system here. Just when I need "something" for beta testing the newly released beta version of the Ad-Aware 2007! :( http://www.lavasoft.com/
 
HiJack This is always known listing items with the (file missing) quote at the end. That's to be expected there. The process or service may simply be inactive when the log was created. The SP2s had additional security fixes seen in the 2004-05 updates for the 64bit as well as 32bit versions. That will reinstall IE 6 where you can update it to IE 7 at any time of your choosing.

Since you are using Opera you would have to look over possible updates and security settings for that browser. As far as the Daemon Tools item you can simply delete that and even run a free system registry cleaner if you never planned to run that program. This will remove any leftover entries as well as other "orphans" that often get left behind by uninstallers. A good one for this eevn works well in Vista so far is found at http://www.majorgeeks.com/RegCleaner_d460.html
 
Thanks,as i stated before i have deleted the deamon tools installer.But i want to know what to do with the Adware/Virus thats in my chest right now?The one i posted in my original post with the picture?
Ta. :)
 
PC eye said:
As far as the Daemon Tools item you can simply delete that and even run a free system registry cleaner if you never planned to run that program. This will remove any leftover entries as well as other "orphans" that often get left behind by uninstallers. A good one for this even works well in Vista so far is found at http://www.majorgeeks.com/RegCleaner_d460.html
Click to expand...

Apparently you didn't understand my last reply on this. Whatever you see quaranteened you can delete on the spot. The Daemon Tools can alway be downloaded and installed again at some point anyways since that is a valis application. The registry cleaner will allow you to cleanup anything leftover there as well. After it opens to the main window simply put a check mark next to any Daemon Tools item there and click the remove button.

In the tools dropdown menu on the menu bar you will also find a registry cleanup link that opens another dropdown menu. You simply scroll down to the "do them all" option to see that run automatically.
 
Yes i got that part but i'm talking about the second virus/adware that i have in my chest wich is not related to the daemon installer.This:
virusvf3.jpg

And because it says that it is in "system volume" a friend of mine told me that i should not delete the file just let it stay in the chest isolated.?Is that right?
 
Anythind in quranteen is generally something you want removed period. QuestionCat has quite well expressed the one question on this. Here I would be letting it loose for beta testing different removers. For you the answer has been put quite well.
 
That's a contaminated system restore point anyways. No loss you can make a new clean one by going into the Start>Programs>Accessories>System Tools>System Restore and choosing the create new restore point option once that is gone. You wouldn't want to reinfest your system using that one.
 
You must log in or register to reply here.
Back
Top