Problem With AVG Finding Trojans

GEC: Discuss gaming, computers and electronics and venture into the bizarre world of STGODs.

Moderator: Thanas

Locked
User avatar
Dorsk 81
Sith Devotee
Posts: 2592
Joined: 2003-03-04 08:10pm
Location: England
Contact:
Contact Dorsk 81

Problem With AVG Finding Trojans

Post by Dorsk 81 »

For the past few days, whenever I run a scan on AVG, it always picks up a "Trojan horse Downloader.Generic.DRX" in "C:\Documents and Settings\Owner\Local Settings\Temporary Interent Files\Content.IE5\MH6VQFG5\WinTS[4].cab:\WToolsS.exe" and "C:\Documents and Settings\Owner\Local Settings\Temporary Interent Files\Content.IE5\MH6VQFG5\WinTS[4].cab".

Now, I've moved the file to the virus vault, deleted it, but it always comes back. Sometimes it doesn't come up on the scan for a, but then an hour or so later if I do one, it'll show up.

Help? Is this a problem with AVG, or what?
"I would, for instance, fellate a smurf before I pick death." Dylan Moran
"Only two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." Albert Einstein
EBC's Devonian Deviant | GALE's Supplementary Bi Brit | BoTM's Raw Recruit | GDC's Horny Delphinidae | I'm with RMA | CoIB
Top
Datana
Jedi Master
Posts: 1011
Joined: 2002-07-04 03:16am
Contact:
Contact Datana

Post by Datana »

It's spyware which regenerates itself everytime you move or delete it. Create and post a HijackThis! log, and I'll take a look at it.
Member of the Anti-PETA Anti-Fascist League
Top
User avatar
Dorsk 81
Sith Devotee
Posts: 2592
Joined: 2003-03-04 08:10pm
Location: England
Contact:
Contact Dorsk 81

Post by Dorsk 81 »

Logfile of HijackThis v1.99.1
Scan saved at 04:07:06, on 08/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.seekerbar.com/ie.aspx?tb_id=50154
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profilenation.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O1 - Hosts: 203.161.127.141 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\RunServices: [KERNEL32] KERNEL32.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O17 - HKLM\System\CCS\Services\Tcpip\..\{5971116C-D2C7-4A67-BF11-EEB1CC2C9707}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
"I would, for instance, fellate a smurf before I pick death." Dylan Moran
"Only two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." Albert Einstein
EBC's Devonian Deviant | GALE's Supplementary Bi Brit | BoTM's Raw Recruit | GDC's Horny Delphinidae | I'm with RMA | CoIB
Top
Datana
Jedi Master
Posts: 1011
Joined: 2002-07-04 03:16am
Contact:
Contact Datana

Post by Datana »

Under the Spyware Tools section of G&C's FAQ, you'll find a link to numerous antispyware/antitrojan sites. The link you want is specifically this one, which is a direct link to the latest version of HijackThis!. Run it and save a log, then copy and paste it here or in the HJT! thread stickied at the top of the forum.

EDIT: Looks like you already found it. I'm going over the log now.
Member of the Anti-PETA Anti-Fascist League
Top
User avatar
Dorsk 81
Sith Devotee
Posts: 2592
Joined: 2003-03-04 08:10pm
Location: England
Contact:
Contact Dorsk 81

Post by Dorsk 81 »

Damn, I was hoping I could have edited the other post before anyone saw it. :oops:
"I would, for instance, fellate a smurf before I pick death." Dylan Moran
"Only two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." Albert Einstein
EBC's Devonian Deviant | GALE's Supplementary Bi Brit | BoTM's Raw Recruit | GDC's Horny Delphinidae | I'm with RMA | CoIB
Top
Datana
Jedi Master
Posts: 1011
Joined: 2002-07-04 03:16am
Contact:
Contact Datana

Post by Datana »

This should take care of things, but may mess up any homepage settings you've assigned.

First, restart into Safe Mode. If you're not familiar with that, just hit F8 while Windows is starting up (the white bar at the bottom of a black screen) until you get the option to start in Safe Mode; do so.

Start up HijackThis!. Check the boxes by the following entries after you've run a scan, and hit "Fix checked" to deal with them:

Code: Select all

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.seekerbar.com/ie.aspx?tb_id=50154 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.profilenation.com/ 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freeserve.com/ 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.seekerbar.com/ie.aspx?tb_id=50154 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [KERNEL32] KERNEL32.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file) 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file) 
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.com/
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
These are all pieces of the trojan. Afterwards, to be safe, go to C:\Program Files\Common Files\ via Explorer (Windows+E) and rename the WinTools directory to anything else. Restart in standard mode, and you should be clean.

EDIT: Caught a typo.
Member of the Anti-PETA Anti-Fascist League
Top
User avatar
Dorsk 81
Sith Devotee
Posts: 2592
Joined: 2003-03-04 08:10pm
Location: England
Contact:
Contact Dorsk 81

Post by Dorsk 81 »

Ok, done all that and did another scan.

Logfile of HijackThis v1.99.1
Scan saved at 04:41:56, on 08/09/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Saitek\Software\Profiler.exe
C:\Program Files\Saitek\Software\SaiSmart.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\BCMSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\My Documents\Cool Stuff\HijackThis.exe

O1 - Hosts: 203.161.127.141 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe
O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{5971116C-D2C7-4A67-BF11-EEB1CC2C9707}: NameServer = 205.188.146.145
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)
"I would, for instance, fellate a smurf before I pick death." Dylan Moran
"Only two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." Albert Einstein
EBC's Devonian Deviant | GALE's Supplementary Bi Brit | BoTM's Raw Recruit | GDC's Horny Delphinidae | I'm with RMA | CoIB
Top
Datana
Jedi Master
Posts: 1011
Joined: 2002-07-04 03:16am
Contact:
Contact Datana

Post by Datana »

Looks clean now, except for the following entry:

O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe (file missing)

But, as the file's missing (due to your renaming the directory it was in), it probably won't be bothering you. AVG might report a problem one more time as it detects the leftovers in your Temp directory, but that should be the extent of it.

If you're really paranoid, though, you can unregister the leftover service entirely. Open the Run menu (Windows + R or Start button then "Run..."), and enter "services.msc" into the box. Locate any reference to "Wintools for IE" or "Windows Tools" or "IBIS," right-click on it, and select "Properties." Set Startup Type to "Disabled" and click on OK.

Otherwise, you're free of infestation now. Usual advice applies to prevent future infection -- don't install anything you don't trust, keep up with security patches, so on, so forth.
Member of the Anti-PETA Anti-Fascist League
Top
User avatar
Dorsk 81
Sith Devotee
Posts: 2592
Joined: 2003-03-04 08:10pm
Location: England
Contact:
Contact Dorsk 81

Post by Dorsk 81 »

I usually do, keep up and with updates and I don't download anything unless I know what it is, etc, so I'm at a bit of a lose as how I got infected. Oh well.

Thanks for your help.
"I would, for instance, fellate a smurf before I pick death." Dylan Moran
"Only two things are infinite: the universe and human stupidity; and I'm not sure about the the universe." Albert Einstein
EBC's Devonian Deviant | GALE's Supplementary Bi Brit | BoTM's Raw Recruit | GDC's Horny Delphinidae | I'm with RMA | CoIB
Top
Datana
Jedi Master
Posts: 1011
Joined: 2002-07-04 03:16am
Contact:
Contact Datana

Post by Datana »

Well, WinTools is added via drive-by installation -- you go to a website, and it'll spoof itself as something else (usually something essential, like a Java client) and try and install itself before you realize what's going on. That's become less common with popup blockers becoming more popular, but still happens relatively often.
Member of the Anti-PETA Anti-Fascist League
Top
User avatar
Faram
Bastard Operator from Hell
Posts: 5271
Joined: 2002-07-04 07:39am
Location: Fighting Polarbears

Post by Faram »

Locked and next time use the sticky in this forum okay?
[img=right]http://hem.bredband.net/b217293/warsaban.gif[/img]

"Either God wants to abolish evil, and cannot; or he can, but does not want to. ... If he wants to, but cannot, he is impotent. If he can, but does not want to, he is wicked. ... If, as they say, God can abolish evil, and God really wants to do it, why is there evil in the world?" -Epicurus

Fear is the mother of all gods.

Nature does all things spontaneously, by herself, without the meddling of the gods. -Lucretius
Top
Locked

Return to “Gaming, Electronics and Computers”