Problem with Hard-drive opening!

[jalal]

well it was so much annoying that finally it ended up on formating each and every drive..... and it took my whole day coz i have to safe data to other drive and then to format that drive then shifting back of data huh!

its the first time in my life too ,that I've seen such problem..... it never happened before..... still wondering what was that..... was that a Trojan or a virus that changed my drive" OPEN AND EXPLORE" icons when i right click on my drives.... but its done but with no cure and all went up with format.......

any ways thanks for you people efforts and though it didn't go that way it should be ... but still try was gr8..... and i hope that should have some kinda logical solution.... any ways thanks again...
jalal

[liam858]

and it took my whole day coz i have to safe date to other drive and then to format that drive then shifting back of data huh!

You need to get that data backed up onto removeable media (DVD-R's) as all hard drives will fail sooner or later, i lost 2 recently.


Liam

[akbar123]

First show system protected files then it worked.
Start|Run type in regsvr32 /i shell32.dll

[the_Architect]

Ok people, i've literally been subjected to this really annoying problem myself over the last few days... i understand why Jalal was so annoyed.

Basically i have the identical problem that Jalal had in the previous posts, but i really cant be bothered to format as i have far to much recent work on this machine, and its a busy time of year etc etc... However i really need help on sorting this out, what i believe is simply some registry fault.

The problem arose when an evil person plugged in their external hard drive and auto-inflicted this sh*te on my machine. Here is the original virus log...

________________________________________________________________
KASPERSKY ONLINE SCANNER REPORT
Monday, April 02, 2007 7:51:26 PM
Operating System: Microsoft Windows Server 2003 family, Professional, Service Pack 1 (Build 3790)
Kaspersky Online Scanner version: 5.0.83.0
Kaspersky Anti-Virus database last update: 2/04/2007
Kaspersky Anti-Virus database records: 290163
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 9519
Number of viruses found: 3
Number of infected objects: 4 / 0
Number of suspicious objects: 0
Duration of the scan process: 00:04:55

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\MDM.EXE Infected: Trojan.Win32.Agent.aei skipped
C:\WINDOWS\SVCHOST.EXE Infected: Trojan.Win32.Agent.abt skipped
C:\WINDOWS\system32\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped
C:\WINDOWS\SysWOW64\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped
________________________________________________________________

>>>>>>>

Right.... So the little sh*tes were removed successfully etc, thanks to the Kaspersky Free Software (thx), system was clear. Hence the Hijack this log.... seems fine to me...

>>>>>>>
________________________________________________________________
Logfile of HijackThis v1.99.1
Scan saved at 00:25:12, on 03/04/2007
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Program Files (x86)\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1170702521453
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CA312965-2554-450B-857F-BC340CB82930}: NameServer = 194.168.4.100,194.168.8.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1.0\r3hook.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc64.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: Windows Service Pack Installer update service (spupdsvc) - Unknown owner - C:\WINDOWS\system32\spupdsvc.exe (file missing)

_________________________________________________________________

Now, im guessing Jalal had followed this same path, but was getting frustrated with the 'drive' errors, as i am ....

Even tho the system is totally clean, any drive via 'my computer' seems to be messed up. To recap, on right-clicking a drive, the 'open' and 'explore' instances have been replaced with gibberish (im guessing the root of this trojan/virus was coded using a foreign language, chinese for example, it reminds me when u visit a page and the machine doesnt have the symbol graphics for the chinese letters). On double clicking the drive, or even right-click 'open' (in gibberish), the 'open-with dialog box comes up. This seems to be causing problems with all sorts of programs, very annoying...

Im kinda hoping there is a really simple registry fix for this, cause it doesnt seem to have any real affect other than not being able to access C: through my computer, all shortcuts etc still work, as does search.
Im actually using windows x64 but have tried the mentioned 'drive assosiation fix', but it didnt work, i have also tried the 'run' fix;

regsvr32 /i shell32.dll

but this hasnt worked either...

Like u guys i havent seen anything like this before and havent got a clue how to fix it, all i know is that this stupid trojan is spreadin like hell throughout my campus and causin all sorts of trouble, can u provide a solution???

The only other info i have about the trojan is that it hides on portable USB media, sticks, harddrives etc, which is really bad for uni's as everyone uses them...

LOL sorry about the length of this post if you need any other info give us a shout! Good luck

[dunedin]

Hello the_Architect

You log is clean, but I don`t think your system is. Look at the "Skipped"

C:\WINDOWS\MDM.EXE Infected: Trojan.Win32.Agent.aei skipped
C:\WINDOWS\SVCHOST.EXE Infected: Trojan.Win32.Agent.abt skipped
C:\WINDOWS\system32\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped
C:\WINDOWS\SysWOW64\winsystems16.exe Infected: Backdoor.Win32.SdBot.bdy skipped

I think you should run another scan

http://www.windowsecurity.com/trojanscan/

and this free program

Spybot Search and Destroy
http://www.safer-networking.org/en/download/

Update it before running. Get it to fix all the RED entries it finds

Elaine

[the_Architect]

Thanks for the Quick Reply Dunedin!

Yeah, sorry i forgot to say about those 'skipped' entries, i scanned a few times, because they were'nt removed the first time round, that was an old log. The system is 100% clean, i used those links you suggested and the found nothing, apart from a few services i have disabled (not related).

So even with a 100% clean system the 'my computer' bug remains, any other suggestions?

[At the moment im considering using the XP installation CD to 'repair' windows when i have some time, would i need to reinstall all my program files/games if i do this?]

[dunedin]

Since the system is clean, one of the repair options should replace any missing/corrupted system files (hopefully)

Try system file check first. If it works you won`t need to reinstall anything

A "Repair" won`t lose any of your data/programs, but you will have to reinstall ALL updates since SP2 (there are a lot) and any unsigned drivers.

System File Check. You will need your XP CD for this
Start/Run and type in
sfc /scannow (there is a space before /)
OK

It will run and not produce a report at the end. You just have to check if any problems are fixed.

If that does not help try a "Repair"
A repair won't lose any data, other than Service Pack (if not on CD), any Windows Updates and unsigned drivers, which will need to be re-installed afterwards.
Stay offline to do a repair and do not go online again without a firewall enabled. After repairing XP, install Service Pack (if necessary), firewall and then you must install all Critical Updates next.

How to Repair XP
Boot up with the XP CD in the drive and let Setup run. Go past the first "R" repair option by pressing Enter just as if you're doing a clean install and you'll eventually come to an option to "Repair an existing installation". Select this one.

Instructions with screen shots
http://www.theeldergeek.com/repairing_windows_xp.htm
Scroll way down page to
Windows Installation CD - Repair Current Installation

http://michaelstevenstech.com/XPrepairinstall.htm

Good luck

Elaine

[magikalfly]

If you don't have any programs that added on stuff to the right click menu, you can try this idea. This is just a wild idea but just might work.

http://windowsxp.mvps.org/

Download the Drive association fix registry file.

Run regedit, delete the entire Drive entry from
HKEY_CLASSES_ROOT\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes

Now when you delete these entries, I believe it'll remove any way of accessing a drive from explorer. Then you run the Drive association fix registry file. That'll, in essence, reset the associations.

I have too many programs installed that require the right click menu additions and too much data to format and what not. I'm looking for a simple registry hack myself.

If you're brave enough or left with no recourse, you can try this out. Also, create a backup of your registry before you attempt this so you can roll back if things go awry.

Now if people would pop into my thread and take a gander, I'd appreciate it. We're all in the same boat people, just trying to solve this annoying problem.

[the_Architect]

Hello again...

Thanks for all the help people, unfortunately nothing seemed to be working...

Thanks Magikalfly for the-

http://windowsxp.mvps.org/

-drive fix, unfortunately i had already tried this, with no luck, and i didnt fancy deleting all the registry drive entires so never actually tried that idea.

Also, the method-

Start/Run and type in
sfc /scannow (there is a space before /)
OK

-had no effect

Anywho, i decided to do as dunedin suggested, bite the bullet and repair the windows installation. So after an 30-40 mins of searching for my 64bit RAID floppy, i eventually repaired the installation, and was back in windows, all drivers, services etc annoyingly reset...and guess what?!

...the problem remained, exactly as before... i couldn't believe it!

Needless to say the windows disc was thrown some way down the corridor. I was quite p*ssed off, and was contemplating finding a decent external HD to start the slow backup/complete format process, but i decided to have one last go at finding some b*sta#rd file or registry entry. I couldn't see anything obvious in the registry so had a last look in the root of c:. And there it was a stupid AutoRun.inf file...

Inside was the following:

[AutoRun]
open=RavMon.exe
shell\open=´ò¿ª(&O)
shell\open\Command=RavMon.exe
shell\explore=×ÊÔ´¹ÜÀÃ*Æ÷(&X)
shell\explore\Command="RavMon.exe -e"

Hurray! i had found the dumb script that had been messing up the 'open' instances. Im guessing that everyone else who has had this problem has this file on each affected drive, the only problem is im not completely sure if this file can be simply deleted to fix the drives, (but im bl**dy hoping so), messing with files here is extremely bad, especially the 'ntldr' file.

So hopefully the final question for the experts is, can this file be deleted safely or should there be a different piece of script in here? An easy way to find out would be to look on a computer that isnt affected, unfortunately there aint one round here LOL.

So hop to it people this could be the end of this evil trojan!

[the_Architect]

Sorted, sorry couldnt wait for a reply, renamed the AutoRun.inf to a *.bak, restarted, and everything is back to normal!
Why i didnt see this in the first place is a mystery, now ive got to reconfigure all my services etc... o well, hope this is of use to somebody in the future!

Thanks for all the suggestions!

[dunedin]

Well, well, I have never seen that before. It is a new one.

Bearing this in mind

The only other info i have about the trojan is that it hides on portable USB media, sticks, harddrives etc, which is really bad for uni's as everyone uses them...

it might be this
http://www.f-prot.com/virusinfo/descriptions/rjump.html

Thanks for posting the solution.

Elaine

[magikalfly]

Wow, I did a search for autorun.inf the normal way and didn't find anything. I set my system to show all hidden files and such and still no luck. I had to open up a dos prompt and pull back some commands from the back of my brain. Doing a dir/a *.inf FINALLY resulting in me being able to see the BLOODY FREAKIN FILE left on my external drive. Of course, the standard del didn't work. Had to use a del/a autorun.inf. I think that took care of it but I need to restart to make sure.

After all this, it's kind of amusing that a virus or worm would do this. Although it'd make a great prank, I'm a bit bitter about this since I was on the receiving end of it.

[dunedin]

As I said, this is a new problem to me.

There are a few of you infected with it at the moment, so it must be spreading.

It uses removal storage devices so you will have to steer clear of them now, and warn all your friends. Nasty since it is spreading through the campus.

Many thanks to the_Architect for discovering it.

Elaine

[Tufenuf]

Elaine, I frequent several other forums and many others are getting infected with this mess. McAfee also has a writeup on it at the link below.

http://vil.nai.com/vil/content/v_139985.htm

Tufenuf

[doda]

hi
i am khaled from egypt

to fix trojan.win32.agent.abt hard drive problems just remove this key entry from the registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

edit by admin: no contact info permitted on the forum, thank you