Problem with Hard-drive opening!
hi.... i am using win xp...... yesterday when i logged on to my computer, i got prompt form anti virus that some back door Trojan has been detected so i deleted it... and so on i scanned my computer and then restarted..... now after re-booting my computer i can't access my hard-drives i.e.. C,D,E,F,G.... when ever i double click on each drive it opens window of "open with" and thus similar thing occurs when i try to open other dives, it comes with "open with" ????
also when i right-click on my each drive, there is no tab of explore etc... and its in some charecters form which i can't type but in the end it ends with (0) and on next line its divide symble with(x).... i never seen this before.....
now please i need help about how to fix this problem and how to open back my hard drive again.... please give me suggestion, am waiting for it.. thanks
jalal.
here is the trojan detected!!
Infected: Trojan program Trojan.Win32.Agent.abt C:\windows\SVCHOST.EXE 48 KB
Infected: Trojan program Trojan.Win32.Agent.aei C:\windows\MDM.EXE 21.5 KB
Infected: Trojan program Trojan.Win32.Agent.abt C:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt D:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt E:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt F:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt G:\RavMon.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026144.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.aei c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026146.exe 21.5 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026157.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026157.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt c:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026167.exe 48 KB
Infected: Trojan program Trojan.Win32.Agent.abt g:\system volume information\_restore{ddea8416-0950-47dc-b4d0-245e9d61e737}\rp29\a0026166.exe 48 KB
this is all i have shown in the antivirus deleted programs.... please... tell me how can i open again my hard-drives , as i mentioned you ppl that it can be open'd form disk managment but by double clicking on hard-drive(any) it opens the window of " OPEN WITH".... please sort out this problem.. plz.!
sorry, it ended up with format :/
well it was so much annoying that finally it ended up on formating each and every drive..... and it took my whole day coz i have to safe data to other drive and then to format that drive then shifting back of data huh!
its the first time in my life too ,that I've seen such problem..... it never happened before..... still wondering what was that..... was that a Trojan or a virus that changed my drive" OPEN AND EXPLORE" icons when i right click on my drives.... but its done but with no cure and all went up with format.......
any ways thanks for you people efforts and though it didn't go that way it should be ... but still try was gr8..... and i hope that should have some kinda logical solution.... any ways thanks again...
jalal
Can you find the solution to the previous problem???
Ok people, i've literally been subjected to this really annoying problem myself over the last few days... i understand why Jalal was so annoyed.
Basically i have the identical problem that Jalal had in the previous posts, but i really cant be bothered to format as i have far to much recent work on this machine, and its a busy time of year etc etc... However i really need help on sorting this out, what i believe is simply some registry fault.
The problem arose when an evil person plugged in their external hard drive and auto-inflicted this sh*te on my machine. Here is the original virus log...
________________________________________________________________
KASPERSKY ONLINE SCANNER REPORT
Monday, April 02, 2007 7:51:26 PM
Operating System: Microsoft Windows Server 2003 family, Professional, Service Pack 1 (Build 3790)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 2/04/2007
Kaspersky Anti-Virus database records: 290163
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
Scan Statistics:
Total number of scanned objects: 9519
Number of viruses found: 3
Number of infected objects: 4 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:04:55
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\MDM.EXE Infected: Trojan.Win32.Agent.aei skipped
C:\WINDOWS\SVCHOST.EXE Infected: Trojan.Win32.Agent.abt skipped
C:\WINDOWS\system32\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped
C:\WINDOWS\SysWOW64\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped
________________________________________________________________
>>>>>>>
Right.... So the little sh*tes were removed successfully etc, thanks to the Kaspersky Free Software (thx), system was clear. Hence the Hijack this log.... seems fine to me...
>>>>>>>
________________________________________________________________
Logfile of HijackThis v1.99.1
Scan saved at 00:25:12, on 03/04/2007
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)
Running processes:
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Hijack This\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1170702521453
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA312965-2554-450B-857F-BC340CB82930}: NameServer = 194.168.4.100,194.168.8.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1.0\r3hook.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: Windows Service Pack Installer update service (spupdsvc) - Unknown owner - C:\WINDOWS\system32\spupdsvc.exe (file missing)
_________________________________________________________________
Now, im guessing Jalal had followed this same path, but was getting frustrated with the 'drive' errors, as i am ....
Even tho the system is totally clean, any drive via 'my computer' seems to be messed up. To recap, on right-clicking a drive, the 'open' and 'explore' instances have been replaced with gibberish (im guessing the root of this trojan/virus was coded using a foreign language, chinese for example, it reminds me when u visit a page and the machine doesnt have the symbol graphics for the chinese letters). On double clicking the drive, or even right-click 'open' (in gibberish), the 'open-with dialog box comes up. This seems to be causing problems with all sorts of programs, very annoying...
Im kinda hoping there is a really simple registry fix for this, cause it doesnt seem to have any real affect other than not being able to access C: through my computer, all shortcuts etc still work, as does search.
Im actually using windows x64 but have tried the mentioned 'drive assosiation fix', but it didnt work, i have also tried the 'run' fix;
regsvr32 /i shell32.dll
but this hasnt worked either...
Like u guys i havent seen anything like this before and havent got a clue how to fix it, all i know is that this stupid trojan is spreadin like hell throughout my campus and causin all sorts of trouble, can u provide a solution???
The only other info i have about the trojan is that it hides on portable USB media, sticks, harddrives etc, which is really bad for uni's as everyone uses them...
LOL sorry about the length of this post :) if you need any other info give us a shout! Good luck
Back again.... (with possible fix :) )
Hello again...
Thanks for all the help people, unfortunately nothing seemed to be working...
Thanks Magikalfly for the-
http://windowsxp.mvps.org/
-drive fix, unfortunately i had already tried this, with no luck, and i didnt fancy deleting all the registry drive entires so never actually tried that idea.
Also, the method-
Start/Run and type in
sfc /scannow (there is a space before /)
OK
-had no effect
Anywho, i decided to do as dunedin suggested, bite the bullet and repair the windows installation. So after an 30-40 mins of searching for my 64bit RAID floppy, :( i eventually repaired the installation, and was back in windows, all drivers, services etc annoyingly reset...and guess what?!
...the problem remained, exactly as before... i couldn't believe it!
Needless to say the windows disc was thrown some way down the corridor. I was quite p*ssed off, and was contemplating finding a decent external HD to start the slow backup/complete format process, but i decided to have one last go at finding some b*sta#rd file or registry entry. I couldn't see anything obvious in the registry so had a last look in the root of c:. And there it was a stupid AutoRun.inf file...
Inside was the following:
[AutoRun]
open=RavMon.exe
shell\open=´ò¿ª(&O)
shell\open\Command=RavMon.exe
shell\explore=×ÊÔ´¹ÜÀÃ*Æ÷(&X)
shell\explore\Command="RavMon.exe -e"
Hurray! i had found the dumb script that had been messing up the 'open' instances. Im guessing that everyone else who has had this problem has this file on each affected drive, the only problem is im not completely sure if this file can be simply deleted to fix the drives, (but im bl**dy hoping so), messing with files here is extremely bad, especially the 'ntldr' file.
So hopefully the final question for the experts is, can this file be deleted safely or should there be a different piece of script in here? An easy way to find out would be to look on a computer that isnt affected, unfortunately there aint one round here LOL.
So hop to it people this could be the end of this evil trojan!
