Bugerion

Virtua/win32 virus or agent NBP

37 posts in this topic

People I need help.I have virus win32 on my computer or agent NBP as some call it Idk how to remove it plz help me.I have AVG free antivirus but it cant totaly dwtroy it because it cant heal it and its in system files so I cant delete it. :D:):) Help!!!!!!I heard this is best forum to post this so I hope you will help. :)

Share this post


Link to post
Share on other sites

Update and Scan with Malwarebytes' Anti-Malware

  • Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  • Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
    • Update Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Update

    [*]When the update is complete, select the Scanner tab

    [*]Select Perform quick scan, then click Scan.

    [*]When the scan is complete, click OK, then Show Results to view the results.

    [*]Be sure that everything is checked, and click Remove Selected.

    [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

    Please create a BOOTLOG
  • Delete the following file if it exists. C:\Windows\ntbtlog.txt
  • Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  • Select "Enable Boot Logging" option and press enter.
  • Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  • This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows

Share this post


Link to post
Share on other sites

I took a long scan because i restarted computer after short one and I cant find that log I dont have documents and setings file(Really I dont)and here is log:

after big sour base

Malwarebytes' Anti-Malware 1.38

Database version: 2349

Windows 6.0.6001 Service Pack 1

29.6.2009 13:21:48

mbam-log-2009-06-29 (13-21-48).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|)

Objects scanned: 241871

Time elapsed: 56 minute(s), 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

can:

But my AVG says there is still virus and this says there is no virus.

Bootlog:

Share this post


Link to post
Share on other sites

Bootlog:Service Pack 1 6 29 2009 13:39:08.484

Loaded driver \SystemRoot\system32\ntkrnlpa.exe

Loaded driver \SystemRoot\system32\hal.dll

Loaded driver \SystemRoot\system32\kdcom.dll

Loaded driver \SystemRoot\system32\PSHED.dll

Loaded driver \SystemRoot\system32\BOOTVID.dll

Loaded driver \SystemRoot\system32\CLFS.SYS

Loaded driver \SystemRoot\system32\CI.dll

Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys

Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS

Loaded driver \SystemRoot\system32\drivers\acpi.sys

Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS

Loaded driver \SystemRoot\system32\drivers\msisadrv.sys

Loaded driver \SystemRoot\system32\drivers\pci.sys

Loaded driver \SystemRoot\System32\drivers\partmgr.sys

Loaded driver \SystemRoot\system32\drivers\volmgr.sys

Loaded driver \SystemRoot\System32\drivers\volmgrx.sys

Loaded driver \SystemRoot\system32\drivers\pciide.sys

Loaded driver \SystemRoot\system32\drivers\PCIIDEX.SYS

Loaded driver \SystemRoot\System32\drivers\mountmgr.sys

Loaded driver \SystemRoot\system32\drivers\atapi.sys

Loaded driver \SystemRoot\system32\drivers\ataport.SYS

Loaded driver \SystemRoot\system32\drivers\fltmgr.sys

Loaded driver \SystemRoot\system32\drivers\fileinfo.sys

Loaded driver \SystemRoot\System32\Drivers\ksecdd.sys

Loaded driver \SystemRoot\system32\drivers\ndis.sys

Loaded driver \SystemRoot\system32\drivers\msrpc.sys

Loaded driver \SystemRoot\system32\drivers\NETIO.SYS

Loaded driver \SystemRoot\System32\drivers\tcpip.sys

Loaded driver \SystemRoot\System32\drivers\fwpkclnt.sys

Loaded driver \SystemRoot\System32\Drivers\Ntfs.sys

Loaded driver \SystemRoot\system32\drivers\volsnap.sys

Loaded driver \SystemRoot\System32\Drivers\spldr.sys

Loaded driver \SystemRoot\System32\Drivers\mup.sys

Loaded driver \SystemRoot\System32\drivers\ecache.sys

Loaded driver \SystemRoot\System32\DRIVERS\fvevol.sys

Loaded driver \SystemRoot\system32\drivers\disk.sys

Loaded driver \SystemRoot\system32\drivers\CLASSPNP.SYS

Loaded driver \SystemRoot\system32\drivers\crcdisk.sys

Loaded driver \SystemRoot\system32\DRIVERS\tunnel.sys

Loaded driver \SystemRoot\system32\DRIVERS\tunmp.sys

Loaded driver \SystemRoot\system32\DRIVERS\amdk8.sys

Loaded driver \SystemRoot\system32\DRIVERS\fdc.sys

Loaded driver \SystemRoot\system32\DRIVERS\serial.sys

Loaded driver \SystemRoot\system32\DRIVERS\serenum.sys

Loaded driver \SystemRoot\system32\DRIVERS\parport.sys

Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys

Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbohci.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys

Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys

Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys

Loaded driver \SystemRoot\System32\drivers\dxgkrnl.sys

Loaded driver \SystemRoot\system32\DRIVERS\nvlddmkm.sys

Loaded driver \SystemRoot\system32\DRIVERS\yk60x86.sys

Loaded driver \SystemRoot\system32\DRIVERS\msiscsi.sys

Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys

Loaded driver \SystemRoot\system32\DRIVERS\rassstp.sys

Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys

Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys

Loaded driver \SystemRoot\system32\DRIVERS\mcdbus.sys

Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys

Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys

Loaded driver \SystemRoot\system32\DRIVERS\umbus.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys

Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS

Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS

Loaded driver \SystemRoot\system32\drivers\RtkHDAud.sys

Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS

Loaded driver \SystemRoot\System32\Drivers\Null.SYS

Loaded driver \SystemRoot\System32\Drivers\Beep.SYS

Loaded driver \SystemRoot\System32\drivers\vga.sys

Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys

Loaded driver \SystemRoot\system32\drivers\rdpencdd.sys

Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS

Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS

Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys

Loaded driver \SystemRoot\system32\DRIVERS\tdx.sys

Loaded driver \SystemRoot\system32\DRIVERS\smb.sys

Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys

Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys

Loaded driver \SystemRoot\system32\drivers\afd.sys

Loaded driver \SystemRoot\system32\DRIVERS\pacer.sys

Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys

Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys

Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys

Loaded driver \SystemRoot\system32\drivers\nsiproxy.sys

Loaded driver \SystemRoot\system32\drivers\csc.sys

Loaded driver \SystemRoot\System32\Drivers\dfsc.sys

Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys

Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys

Loaded driver \SystemRoot\system32\DRIVERS\cdfs.sys

Loaded driver \SystemRoot\system32\DRIVERS\udfs.sys

Loaded driver \SystemRoot\system32\DRIVERS\monitor.sys

Loaded driver \SystemRoot\system32\drivers\luafv.sys

Loaded driver \SystemRoot\system32\drivers\drmkaud.sys

Loaded driver \SystemRoot\system32\DRIVERS\lltdio.sys

Loaded driver \SystemRoot\system32\DRIVERS\rspndr.sys

Loaded driver \SystemRoot\system32\drivers\HTTP.sys

Loaded driver \SystemRoot\System32\DRIVERS\srvnet.sys

Loaded driver \SystemRoot\system32\DRIVERS\bowser.sys

Loaded driver \SystemRoot\System32\drivers\mpsdrv.sys

Loaded driver \SystemRoot\system32\drivers\mrxdav.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb10.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb20.sys

Loaded driver \SystemRoot\System32\DRIVERS\srv2.sys

Loaded driver \SystemRoot\System32\DRIVERS\srv.sys

Did not load driver \SystemRoot\System32\DRIVERS\srv.sys

Loaded driver \SystemRoot\system32\DRIVERS\parvdm.sys

Loaded driver \SystemRoot\System32\Drivers\TBPanel.SYS

Loaded driver \??\C:\Windows\System32\16771.sys

Loaded driver \SystemRoot\system32\DRIVERS\atksgt.sys

Loaded driver \SystemRoot\system32\DRIVERS\lirsgt.sys

Loaded driver \SystemRoot\system32\drivers\peauth.sys

Loaded driver \SystemRoot\System32\Drivers\secdrv.SYS

Loaded driver \SystemRoot\System32\drivers\tcpipreg.sys

there hope that helped. :D:)

Share this post


Link to post
Share on other sites

Look virus is not spreding now it was spreading some time ago so i will contact you if it spreads again. :D:)

Share this post


Link to post
Share on other sites

Well you have a file loading that certainly appears to be invalid and possibly an unwanted file. C:\Windows\System32\16771.sys

Please run the following and we'll see if we can determine more about it or any other undesirable programs that might be running.

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:
how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.

Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

Note:

The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

Share this post


Link to post
Share on other sites

hERE IS THE log:ComboFix 09-06-29.07 - Name 30.06.2009 19:00.1 - NTFSx86

Microsoft

Share this post


Link to post
Share on other sites

I dont know if I done it right but it didnt ask for recovery console(guess I had it)and I closed AVG before scaning after scaning started AVG again same resoults 13 infected files like always. :D:)

Share this post


Link to post
Share on other sites

That is not the FULL Combofix log. Please try to post the FULL log again.

Thanks.

Share this post


Link to post
Share on other sites

There is nothing in combofix folder I will scan with combofix again and post again. :D:)

Share this post


Link to post
Share on other sites

Here new log:ComboFix 09-06-29.07 - Name 01.07.2009 13:02.2 - NTFSx86

Microsoft

Share this post


Link to post
Share on other sites

I'm sorry but I just had too many other things to do tonight and I'm out of time. I'll pick back up on this tomorrow.

Share this post


Link to post
Share on other sites

Well nothing obvious showing in the logs. A lot of Game and Torrent stuff that can easily get you infected.

Lets try the following.

STEP 01

    Download and install CCleaner
  • CCleaner
  • Double-click on the downloaded file "ccsetup220_slim.exe" and install the application.
  • Keep the default installation folder "C:\Program Files\CCleaner"
  • Click finish when done and close ALL PROGRAMS
  • Start the CCleaner program.
  • Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  • Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  • Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  • Click on Run Cleaner button on the bottom right side of the program.
  • Click OK to any prompts

STEP 02

Please download to your Desktop: Dr.Web CureIt

  • After the file has downloaded, disable your current Anti-Virus and disconnect from the Internet
  • Doubleclick the drweb-cureit.exe file, then click the Start button, then the OK button to perform an Express Scan.
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
  • Once the short scan has finished, Click on the Complete scan radio button.
  • Then click on the Settings menu on top, the select Change Settings or press the F9 key. You can also change the Language
  • Choose the Scanning tab and I recomend leaving the Heuristic analysis enabled (this can lead to False Positives though)
  • On the File types tab ensure you select All files
  • Click on the Actions tab and set the following:
    • Objects Infected objects = Cure, Incurable objects = Move, Suspicious objects = Report
    • Infected packages Archive = Move, E-mails = Report, Containers = Move
    • Malware Adware = Move, Dialers = Move, Jokes = Move, Riskware = Move, Hacktools = Move
    • Do not change the Rename extension - default is: #??
    • Leave the default save path for Moved files here: %USERPROFILE%\DoctorWeb\Quarantine\
    • Leave prompt on Action checked

    [*]On the Log file tab leave the Log to file checked.

    [*]Leave the log file path alone: %USERPROFILE%\DoctorWeb\CureIt.log

    [*]Log mode = Append

    [*]Encoding = ANSI

    [*]Details Leave Names of file packers and Statistics checked.

    [*]Limit log file size = 2048 KB and leave the check mark on the Maximum log file size.

    [*]On the General tab leave the Scan Priority on High

    [*]Click the Apply button at the bottom, and then the OK button.

    [*]On the right side under the Dr Web Anti-Virus Logo you will see 3 little buttons. Click the left VCR style Start button.

    [*]In this mode it will scan Boot sectors of all disks, All removable media, and all local drives

    [*]The more files and folders you have the longer the scan will take. On large drives it can take hours to complete.

    [*]When the Cure option is selected, an additional context menu will open. Select the necessary action of the program, if the curing fails.

    [*]Click 'Yes to all' if it asks if you want to cure/move the files.

    [*]This will move it to the %USERPROFILE%\DoctorWeb\Quarantine\ folder if it can't be cured. (in this case we need samples)

    [*]After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list

    [*]Save the report to your Desktop. The report will be called DrWeb.csv

    [*]Close Dr.Web Cureit.

    [*]Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.

    [*]After reboot, post the contents of the log from Dr.Web you saved previously to your Desktop in your next reply with a new hijackthis log.

    drweb.jpg

Share this post


Link to post
Share on other sites

ComboFix.exe/data002\32788R22FWJFW\FIND3M.bat C:\Users\Name\Desktop\ComboFix.exe/data002 Probably BATCH.Virus

data002 C:\Users\Name\Desktop Archive contains infected objects

ComboFix.exe C:\Users\Name\Desktop Container contains infected objects Moved.

Here it is I hope that is it.

Share this post


Link to post
Share on other sites

Please click on START - RUN and type in COMBOFIX /U to remove Combofix and reset time on the computer and folder settings.

You can also remove Dr Web and it's files and folders.

How is the computer running now? Are there still any signs of infection?

Share this post


Link to post
Share on other sites

Did you rename Combofix to get it to run? You can download a NEW copy and temporarily disable your Anti-Virus and then run the Combofix with the /U switch to uninstall it.

Share this post


Link to post
Share on other sites

I redownloaded it but it still says there is no combofix then i renamed it but still says there is no my renamed file.Can I delete it via control panel?

Share this post


Link to post
Share on other sites

No, just go ahead and make sure your date and time are correct and delete the folder and all files if they exist named: C:\QOOBOX

So are there any other signs of infection?

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.