Results 1 to 10 of 10

Thread: Infected - Disabled AVG Anti-Virus

  1. #1
    Junior Member kamo516's Avatar
    Join Date
    Mar 2007
    Posts
    28

    Post Infected - Disabled AVG Anti-Virus

    Recently, AVG picked up a virus infection, but before I could heal or quarantine the virus, the program froze and closed down AVG. Since then, the AVG resident shield and virus database have been disabled and I am unable to re-activate them. I have run an online virus scan, spybot scan in safe mode, and HJT. The logs are posted below. I attempted to run a virus scan with AVG in safe mode but the program kept closing. I have thought about uninstalling and re-installing AVG, but I wanted to see if anyone had any suggestions first. Thanks for the help.

    Panda Online Virus Scan: (Spy-Bot did not seem to pick any of these up and they have not been cleaned)


    Incident Status
    Location

    Adware:adware/powerscan Not disinfected c:\windows\system32\intrigue.dll

    Spyware:spyware/betterinet Not disinfected c:\windows\inf\biini.inf

    Adware:adware/dyfuca Not disinfected c:\windows\optimize.exe

    Adware:adware/adlogix Not disinfected Windows Registry

    Spyware:spyware/bridge Not disinfected Windows Registry

    Adware:adware/comet Not disinfected Windows Registry


    HJT Log:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:51:41 AM, on 4/9/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Webshots\WebshotsTray.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Kevin\My Documents\Programs\Protection\Hijack This\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Fire Fox
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\ZonePro\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O16 - DPF: {58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86} - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {AAF15A90-F3EC-4FEE-9A00-F65B25B83D05} - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {BE1BDC4F-2AAC-494E-88B1-86B2EE4F2D6D} (CopySafe3 Control) - https://www.geneseephoto.com/Plugin/...d/Copysafe.cab
    O16 - DPF: {CA8A9780-280D-11CF-A24D-444553540000} (Adobe PDF Reader) - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - c:\WINDOWS\Downloaded Program Files\mimectl.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB704\webserver\bin\win32\matlabserver.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

    Thanks for the help,

    Kevin

  2. #2
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,538

    Default

    Welcome to the forum, not a lot showing in the HJT log. Here's a little information:
    c:\windows\system32\intrigue.dll >>> http://www3.ca.com/securityadvisor/p...x?id=453094193
    c:\windows\inf\biini.inf: http://www3.ca.com/securityadvisor/p...x?id=453076992
    c:\windows\optimize.exe: http://www.liutilities.com/products/...rary/optimize/

    Unless there is something not showing in the Panda scan, I am surprised AVG anti-virus had these problems. Is the program bring kept updated? Is this version 7.5? You may want to stay offline as much as possible until these issues are resolved. You may have to uninstall and reinstall, but let's do this first.

    Download, install, update and run AVG Anti-Spyware 7.5 from the following link, make sure you delete or at least quarantine anything it locates and save the scan report to post.
    http://forums.security-central.us/showthread.php?t=3165


    Post the scan report from AVG Anti-Spyware and a new HJT log.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  3. #3
    Junior Member kamo516's Avatar
    Join Date
    Mar 2007
    Posts
    28

    Default

    I went ahead and downloaded AVG anti-spyware 7.5 and ran the scan. The log is posted below as well as a new HJT log. I am unsure of what to do with the following:

    c:\windows\system32\intrigue.dll >>> http://www3.ca.com/securityadvisor/p...x?id=453094193
    c:\windows\inf\biini.inf: http://www3.ca.com/securityadvisor/p...x?id=453076992
    c:\windows\optimize.exe: http://www.liutilities.com/products/...rary/optimize/

    I followed the links, but was unsure what action to take since none of them showed up on my HJT log.

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 9:12:20 PM 4/9/2007

    + Scan result:



    C:\Documents and Settings\Kevin\Cookies\kevin@ie.search.msn[2].txt -> TrackingCookie.Msn : Cleaned.


    ::Report end


    Logfile of HijackThis v1.99.1
    Scan saved at 9:17:49 PM, on 4/9/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\pctspk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\Webshots\WebshotsTray.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Kevin\My Documents\Programs\Protection\Hijack This\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Fire Fox
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
    O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\ZonePro\ZoneAlarm\zlclient.exe
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O16 - DPF: {58916BE6-BAFF-4F33-AEFE-B2AA03FE4C86} - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {AAF15A90-F3EC-4FEE-9A00-F65B25B83D05} - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {BE1BDC4F-2AAC-494E-88B1-86B2EE4F2D6D} (CopySafe3 Control) - https://www.geneseephoto.com/Plugin/...d/Copysafe.cab
    O16 - DPF: {CA8A9780-280D-11CF-A24D-444553540000} (Adobe PDF Reader) - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw9fd.law9.hotmail.msn.com/activex/HMAtchmt.ocx
    O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - c:\WINDOWS\Downloaded Program Files\mimectl.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB704\webserver\bin\win32\matlabserver.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

    I am now going to re-install AVG and will await your reply if you can think of anything else that might be causing this problem. Thanks for the help.

  4. #4
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,538

    Default

    Morning (EST) Kevin, first let me say your HJT log is clean, and you saw what AVG Anti-Spyware had to report. I can't really say what occured or why, but you need to get AVG Anti-Virus 7.5 installed, updated and running. As soon as you do that, run a scan and post the results in your topic. Once we know you have virus protection and what it reports, we will know how to proceed. If your antivirus program says you are clean, run Panda again and post those results. Make sure Windows Defender is updated and scan with it also, let me know what the results are. Post any comments you think will help.

    Thanks...Phil
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  5. #5
    Junior Member kamo516's Avatar
    Join Date
    Mar 2007
    Posts
    28

    Default

    Avg 7.5 is installed and I ran the scan and it was clean. The same was true for Windows Defender. I went ahead and scanned with Panda again and it produced similar results; the log is posted below. Everything seems to be working okay, my only thought is that when AVG froze initially, I was attempting to heal the infection, so maybe it did its job, but was damaged in the process. I have a friend who had the same version of AVG I had and their computer is now doing very similar things as mine was with AVG going offline and sorts. He is getting multiple virus infection threats though, so it might be a little more cleanup than mine has been. Let me know what you think, and thanks again for the assistance.

    Panda Online Scan

    Incident Status Location

    Adware:adware/powerscan Not disinfected c:\windows\system32\intrigue.dll
    Spyware:spyware/betterinet Not disinfected c:\windows\inf\biini.inf
    Adware:adware/dyfuca Not disinfected c:\windows\optimize.exe
    Adware:adware/adlogix Not disinfected Windows Registry
    Spyware:spyware/bridge Not disinfected Windows Registry
    Adware:adware/comet Not disinfected Windows Registry

  6. #6
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,538

    Default

    My guess is that is something left from an old infection. Delete those three files:
    c:\windows\system32\intrigue.dll

    c:\windows\inf\biini.inf

    c:\windows\optimize.exe

    You may have to show hidden files and folder to see them:
    http://www.xtra.co.nz/help/0,,4155-1916458,00.html

    To get the other junk you will need to clean the registry. Here is one free cleaner: http://www.ccleaner.com/
    Registry cleaner
    Advanced features to remove unused and old entries, including File Extensions, ActiveX Controls, ClassIDs, ProgIDs, Uninstallers, Shared DLLs, Fonts, Help Files, Application Paths, Icons, Invalid Shortcuts and more... also comes with a comprehensive backup feature.
    If you clean the registry, BE SURE to use the backup feature.

    System Restore does not know the good files from the bad. In case bad stuff has gotten into your System Restore files, follow the instructions in this link to get clean System Restore files. Turn it off, reboot then turn it back on:
    http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

    AVG Anti-Spyware is a good program but it does use some resources. Once the trial is over you can update and use the scanner for as long as you wish, but unless you purchase it you should turn it off completely so it does not run unless you start it manually.

    Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
    http://forums.spybot.info/showthread.php?t=279
    http://russelltexas.com/malware/allclear.htm
    http://forum.malwareremoval.com/viewtopic.php?t=14
    http://www.bleepingcomputer.com/forums/topict2520.html
    http://cybercoyote.org/security/not-admin.shtml

    Thanks...pskelley
    Safer Networking Forums
    http://www.spybot.info/en/donate/index.html
    If you are reading this information...thank a teacher,
    If you are reading it in English...thank a soldier.
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  7. #7
    Junior Member kamo516's Avatar
    Join Date
    Mar 2007
    Posts
    28

    Default

    Everything is looking pretty good now. I deleted those old files, cleaned out the registry, and cleaned system restore. Everything appears to be running smoothly and I havent had any problems since I updated AVG.

    I do have one general virus removal question. If a virus is detected, is the best step to try and "heal" it first, then "quarantine", then delete if no other option is available. I assume this would be best but I wasnt sure. Thanks again for all the help and let me know if anything else should be done.

    Kevin

  8. #8
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,538

    Default

    Thanks for the feeback, be careful, it's a cyber-jungle out there.
    If a virus is detected, is the best step to try and "heal" it first, then "quarantine", then delete if no other option is available. I assume this would be best but I wasnt sure.
    Depending on the AV program, some say heal, some say delete. You want it off the computer if possible, if not, then quarantine it. If you run into a situation where the AV can do neither, then get the name and location of the item. Often you have to enable hidden files and folders to find it:
    http://www.xtra.co.nz/help/0,,4155-1916458,00.html

    At that point you can navigate to the item and scan it free to make sure it is bad:
    http://virusscan.jotti.org/
    http://www.kaspersky.com/scanforvirus
    http://www.virustotal.com/flash/index_en.html

    Once you know it is bad, navigate to it and delete it. If Windows won't let you, boot to safe mode to do it or use this tool:
    http://www.bleepingcomputer.com/tuto...42.html#delreb

    Here are a couple of more handy links:

    Help! My computer is slow!
    http://users.telenet.be/bluepatchy/m...wcomputer.html
    How to prevent Malware
    http://users.telenet.be/bluepatchy/m...revention.html

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  9. #9
    Junior Member kamo516's Avatar
    Join Date
    Mar 2007
    Posts
    28

    Smile

    Thanks for the help. I appreciate it. Have a great week.

    Kevin

  10. #10
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,538

    Default

    As the problem appears to be resolved this topic has been closed.

    If you need it re-opened please send me or a forum staff member a private message (pm) and provide a link to the thread; this applies only to the original topic starter.

    Anyone else with similar problems please start a new topic.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •