I was recently just sitting idle on my computer and suddenly explorer started crashing, starting, crashing. starting...fearing a virus, i checked task manager, and sure enough, a lot of erroneous file names and processes were executing such as "39843ndkne39.exe" and other such nonsense.
Ive been trying to crack this virus all day now, im running Malwarebytes anti-malware and Hijack-This.. though i cant get the HJT Logfiles off the computer..
It seems like a file called "wnzip32.exe" is causing most of the problem.. and its not even letting me log in with safe mode @.@!!
there seems to be a file preceeding wnzip32 when i log in, called something like "drwin" or dmmin or something similar. i cant quite nail it right when the computer boots.
Any ideas? Ive run Virtumonde Be Gone and Vundo Remover tools but none of them seem to be able to catch wnzip32.exe..
All Your Base Are Belong To Us
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
Ill post malwarebytes log once the current scan completes.. though every time i run it, it finds all the files and i do "remove selected" and once its done..it crashes.. and when i start it again, the files are in quarantine, but a new scan shows all the files still there...if not more.
All Your Base Are Belong To Us
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Make sure, you re-enable your security programs, when you're done with Combofix.
I downloaded and ran combofix... everything seems to be going smoothly so far. It restarted my computer while i was away. I have some worries because i didnt have an active internet connection on the computer that is infected [i unplugged it to save the other computers on my network and stop any instructions or files it may be downloading]
I plugged back in the network cable but i still dont have internet. gonna try a reboot.
Explorer has stopped crashing and recrashing and wnzip32 has stoppd loading.. i think it may have worked!
Ill append the log to this message as text.
ComboFix 09-07-03.03 - Admin 07/04/2009 0:27.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.2047.1569 [GMT -4:00]
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Admin\LOCALS~1\Temp\1.wmv
c:\docume~1\Admin\LOCALS~1\Temp\csrss.exe
c:\docume~1\Admin\LOCALS~1\Temp\lsass.exe
c:\docume~1\Admin\LOCALS~1\Temp\services.exe
c:\docume~1\Admin\LOCALS~1\Temp\svchost.exe
c:\docume~1\Admin\LOCALS~1\Temp\taskmgr.exe
c:\docume~1\Admin\LOCALS~1\Temp\winlogon.exe
c:\documents and settings\Admin\Application Data\wiaserva.log
c:\documents and settings\Admin\Application Data\wiaservg.log
c:\documents and settings\All Users\Application Data\15150314
c:\documents and settings\All Users\Application Data\15150314\15150314
c:\documents and settings\All Users\Application Data\15150314\15150314.exe
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\recycler\S-1-5-21-0243636035-3055115376-381863306-1556
c:\recycler\S-1-5-21-2710152531-5817782112-121369617-8295\wnzip32.exe
C:\test.txt
c:\windows\010112010146118114.dat
c:\windows\0101120101464849.dat
c:\windows\Installer\15b139.msi
c:\windows\Installer\167bd.msi
c:\windows\Installer\3670e3.msi
c:\windows\ld12.exe
c:\windows\patch.exe
c:\windows\start.exe
c:\windows\sysguard.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\avast!Antivirus.exe
c:\windows\system32\drivers\7248779e.sys
c:\windows\system32\drivers\a0ef47d7.sys
c:\windows\system32\drivers\b4f10cb0.sys
c:\windows\system32\drivers\e19d35ed.sys
c:\windows\system32\drivers\Xprotector.sys
c:\windows\system32\iehelper.dll
c:\windows\system32\msnmssgr.exe
c:\windows\system32\skinboxer43.dll
c:\windows\system32\wbem\proquota.exe
C:\xcrashdump.dat
----- BITS: Possible infected sites -----
hxxp://npepatch.starwarsgalaxies.com:7040
c:\windows\system32\proquota.exe . . . is missing!!
[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Sins of a Solar Empire Launcher.lnk]
path=c:\documents and settings\Admin\Start Menu\Programs\Startup\Sins of a Solar Empire Launcher.lnk
backup=c:\windows\pss\Sins of a Solar Empire Launcher.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_USERS\S-1-5-21-1645522239-1060284298-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:83,b8,d8,19,c1,c7,86,68,6e,7b,13,cb,18,1a,45,a8,57,c6,02,82,58,44,a6,
26,65,cc,0e,5b,f8,52,d0,43,f6,18,fc,f3,41,e9,f8,f8,e9,63,2f,26,cc,c7,86,a2,\
"??"=hex:83,14,61,ee,99,95,dc,c3,83,d9,49,0e,31,5f,3e,d8
^- note from me, avast! seemed to be part of the virus. Its still running now but i dont see any adverse affects..
.
**************************************************************************
.
Completion time: 2009-07-04 0:37 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-04 04:37
Last edited by Magelan; July 4th, 2009 at 12:47 AM.
All Your Base Are Belong To Us
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
after restoring a file i mistakenly deleted with HJT my internet is now back..
i do not use an antivirus as normally this computer is unconnected from the internet. i think a virus propogated through my home network because another computer in the household got corrupted from a Facebook scam @.@...
but yes, there should be no virus showing up anywhere. the Avast!antivirus one is part of the infection as i have NEVER installed that on my computer.
All Your Base Are Belong To Us
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
- free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.
If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use PC Tools Firewall Plus, or Comodo firewall..
If you decide to install Comodo Internet Security, or just Comodo firewall, make sure, Windows firewall is turned off.
IMPORTANT!Make sure, you use only ONE antivirus, and ONE firewall.
When done....
1. Please open Notepad
Click Start , then Run
Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
Heres some log files... starting with HJT and then Combofix
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:37 AM, on 7/4/2009
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
ComboFix 09-07-03.03 - Admin 07/04/2009 2:06.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.2047.1740 [GMT -4:00]
Running from: c:\documents and settings\Admin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
[HKLM\~\startupfolder\C:^Documents and Settings^Admin^Start Menu^Programs^Startup^Sins of a Solar Empire Launcher.lnk]
path=c:\documents and settings\Admin\Start Menu\Programs\Startup\Sins of a Solar Empire Launcher.lnk
backup=c:\windows\pss\Sins of a Solar Empire Launcher.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_USERS\S-1-5-21-1645522239-1060284298-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:83,b8,d8,19,c1,c7,86,68,6e,7b,13,cb,18,1a,45,a8,57,c6,02,82,58,44,a6,
26,65,cc,0e,5b,f8,52,d0,43,f6,18,fc,f3,41,e9,f8,f8,e9,63,2f,26,cc,c7,86,a2,\
"??"=hex:83,14,61,ee,99,95,dc,c3,83,d9,49,0e,31,5f,3e,d8
winxpsp1_en_pro_bf.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP E Drive" /fastdetect
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 18:25 on 04/07/2009 by Admin (Administrator - Elevation successful)
========== filefind ==========
Searching for "proquota.exe"
No files found.
-=End Of File=-
All Your Base Are Belong To Us
/* this is my desktop, currently not in use.
Windows XP
ASRock AGP/PCIE Motherboard.
Intel E4400 Processor, 2 GHz, Core2 Duo
Geforce 7800 GS CO 256mb AGP
Corsair 2gb DDR2 PC5400? 2 sticks
ULTRA X2 750W Modular Power Supply
[C] 127 GB Drive, currently 22GB free. Main Windows
[E] 127 GB Drive, currently 9GB Free. Backup Windows
[F] 250 GB SATA Drive. Storage
*/
That important Windows file is missing from your c:\windows\system32 folder.
I'm attaching zipped copy of the file from my XP installation.
Unzip it, and paste proquota.exe file into c:\windows\system32 folder.
When done.....
Print these instructions out.
NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe
***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***
* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.
PHYSICALLY DISCONNECT FROM THE INTERNET
Restart computer in Safe Mode. To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen
* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked): - Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again. - Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program. Post SUPERAntiSpyware log.
RECONNECT TO THE INTERNET
RESTART COMPUTER!
STEP 2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop. (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
RESTART COMPUTER!
STEP 3. Post fresh HijackThis log.
Do NOT attempt to "fix" anything!
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Reply With Quote
