#1
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
[Resolved] backdoor.win32.emogen.a Virus - Can't Remove
I have a virus(s) on my laptop that I can't remove. I tried using Norton 2008 Anti Virus and Kaspersky Anti Virus. Any help would be appreciated. Here are my log files:Total Physical Memory: 503 MiB (512 MiB recommended). dss .exehttp://www.google.com/ie http://www.google.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/search?q=%s http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ie http://www.google.com/ie http://www.hobbittravel.com (HKCU)https://turbotax.com (HKCU)http://turbotax.com (HKCU)https://support.microsoft.com/OAS/ActiveX/MSDcode.cab http://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/microsof...?1188503929505 http://update.microsoft.com/microsof...?1188503896347 http://aerial.leepa.org/ecwplugins/ncs.cab http://www.crucial.com/controls/cpcScanner.cab http://192.168.1.9/activex/decoder/aac_dec.cab http://192.168.1.9/activex/decoder/mpeg4_dec.cab http://www.adobe.com/products/acrobat/nos/gp.cab http://download.macromedia.com/pub/s...sh/swflash.cab http://192.168.1.100/activex/AMC.cab ms -help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dllHTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exeWLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>PCI \VEN_8086&DEV_4220&SUBSYS_27518086&REV_05\4&16793A72&0&58F0PCI \VEN_8086&DEV_4220&SUBSYS_27518086&REV_05\4&16793A72&0&58F0
Didn't find the information you thought to find?Similar Threads
#2
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Welcome to WindowsBBS mikeschumann
Quote:
S4 GrayPigeon_Hacker.com.cn - c:\windows\hacker.com.cn.exe
Lets get rid of it. Highlight an copy the bolded command below.sc stop GrayPigeon_Hacker.com.cn sc delete GrayPigeon_Hacker.com.cn hacker.com.cn.exe
#3
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
I made your suggested changes. I am currently running a full computer scan with Kaspersky Anti-Virus. Very early into the process it found a virus Heur.Backdoor.Generic in file C:\tmp.exe/data0000.cab/1.exe.
#4
Inactive
Profile: Join Date: Jan 2008
Posts: 2
Computer Experience:
Thank you very much!
#5
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
My scan finaly finished. Here's the log:
#6
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Looks like you did good! The Content.IE5 folder is where Temporary Internet files are stored, and it's normal to have a number of subfolders that might appear suspicious (Windows names them randomly). What I find odd is the loaction .......... in the LocalService account.
Quote:
not found: virus Heur.Backdoor.Generic File: C:\WINDOWS\Hacker.com.cn.exe
I'd like to see if the service entry was removed using the sc command. Please run dss again and post the new log.
#7
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
Here's my latest DSS log:Total Physical Memory: 503 MiB (512 MiB recommended). dss .exehttp://www.google.com/ie http://www.google.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/search?q=%s http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.google.com/ie http://www.google.com/ie http://www.hobbittravel.com (HKCU)https://turbotax.com (HKCU)http://turbotax.com (HKCU)https://support.microsoft.com/OAS/ActiveX/MSDcode.cab http://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/microsof...?1188503929505 http://update.microsoft.com/microsof...?1188503896347 http://aerial.leepa.org/ecwplugins/ncs.cab http://www.crucial.com/controls/cpcScanner.cab http://192.168.1.9/activex/decoder/aac_dec.cab http://192.168.1.9/activex/decoder/mpeg4_dec.cab http://www.adobe.com/products/acrobat/nos/gp.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://192.168.1.100/activex/AMC.cab ms -help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dllHTTP ) (VAIOMediaPlatform-IntegratedServer-HTTP ) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
#8
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Highlight and copy the bolded command below."E:\Deckards System Scanner\dss .exe" /config Drivers
#9
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
Deckard's System Scanner v20071014.68Total Physical Memory: 503 MiB (512 MiB recommended). atapi (Standard IDE /ESDI Hard Disk Controller) - c:\windows\system32\drivers\atapi .sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>ISA /EISA Bus Driver) - c:\windows\system32\drivers\isapnp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>PCI (PCI Bus Driver) - c:\windows\system32\drivers\pci .sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>TCP /IP Protocol Driver) - c:\windows\system32\drivers\tcpip.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver>HTTP - c:\windows\system32\drivers\http .sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>IP Network Address Translator) - c:\windows\system32\drivers\ipnat.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>BIOS Driver) - c:\windows\system32\drivers\mssmbios.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>WAN Driver) - c:\windows\system32\drivers\ndiswan.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>WAN Miniport (PPTP)) - c:\windows\system32\drivers\raspptp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>WAN Miniport (L2TP)) - c:\windows\system32\drivers\rasl2tp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>LAN Adapter>IP ARP Driver) - c:\windows\system32\drivers\wanarp.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>
#10
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
Continued.......IP Traffic Filter Driver) - c:\windows\system32\drivers\ipfltdrv.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>IP in IP Tunnel Driver) - c:\windows\system32\drivers\ipinip.sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>Dhcp (DHCP Client) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>DNS Client) - c:\windows\system32\svchost.exe -k networkservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>TCP /IP NetBIOS Helper) - c:\windows\system32\svchost.exe -k localservice <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>ICS )) - c:\windows\system32\svchost.exe -k netsvcs <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>HTTP SSL) - c:\windows\system32\svchost.exe -k httpfilter <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>MS Software Shadow Copy Provider) - c:\windows\system32\dllhost.exe /processid:{b98e13b5-c74f-47b7-b119-68b74ddbb5da} <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>UPS (Uninterruptible Power Supply) - c:\windows\system32\ups .exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>HTTP (VAIO Media Integrated Server (HTTP )) - "c:\program files\sony\vaio media integrated server\platform\sv_httpd.exe" /service=vaiomediaplatform-integratedserver-http /regroot="software\sony corporation\vaio media platform\2.0" /regext="applications\integratedserver\http " <Not Verified; Sony Corporation; SV_Httpd.exe>
#11
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Looks good. Everything still working properly?
#12
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
Everything seems to be working great. Thanks for all of your help.
#13
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
Delete the folder C:\Deckard then empty the recycle bin. You should probably clear your system restore points as well, so there's no chance of using one that might put the infection back in place.Clear past system restore points and create a new one. Verify a new restore point was created.
#14
Inactive
Profile: Join Date: Jan 2008
Location: St. Paul, MN
Posts: 8
Computer Experience:
All done! Thanks for your help!
#15
SuperGeek
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,523
Computer Experience:
You betcha!
All times are GMT +1. The time now is 08:52 .
