View original (French)

Starts only in ss failure --> infection?

grog Posted messages 32 Status Member -  
grog Posted messages 32 Status Member -
Hello and thank you to those who will respond to my call.
I believe I have been infected by a trojan-type virus (?). My computer has become increasingly slow until it completely crashes upon each startup. It works properly in safe mode. I have performed several scans with Ad-Aware, and in each scan, the software discovered malicious cookies and two keys or registry values (the same two each time). I conducted a scan with eTrust Antivirus, which found nothing. However, Avast! found some viruses that I successfully deleted. But the problem is not resolved. Thank you for helping me resolve this issue.

Attached is the Ewido Spyware scan report; those from the antivirus will follow. Thank you in advance.

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:21:09 07/09/2006

+ Scan result:

C:\Documents and Settings\G U S\Cookies\g u s@247realmedia[1].txt -> TrackingCookie.247realmedia : No action taken.
C:\Documents and Settings\JOJO L'escargot\Cookies\jojo l'escargot@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\G U S\Cookies\g u s@bluestreak[1].txt -> TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\G U S\Cookies\g u s@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\G U S\Cookies\g u s@serving-sys[1].txt -> TrackingCookie.Serving-sys : No action taken.
C:\Documents and Settings\G U S\Cookies\g u s@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken.
C:\Documents and Settings\G U S\Cookies\g u s@weborama[2].txt -> TrackingCookie.Weborama : No action taken.

::Report end

The cookies have been deleted, but new ones appear in each scan.

1 answer

  1.
    grog Posted messages 32 Status Member 3
     
    Attached is also the antivirus analysis report:

    BitDefender Online Scanner

    Scan report generated at: Thu, Sep 07, 2006 - 13:36:02

    Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;

    Statistics

    Time
    01:03:48

    Files
    410102

    Folders
    6996

    Boot Sectors
    4

    Archives
    9130

    Packed Files
    18945

    Results

    Identified Viruses
    2

    Infected Files
    5

    Suspect Files
    0

    Warnings
    0

    Disinfected
    0

    Deleted Files
    5

    Engines Info

    Virus Definitions
    453056

    Engine build
    AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

    Scan plugins
    13

    Archive plugins
    38

    Unpack plugins
    6

    E-mail plugins
    6

    System plugins
    1

    Scan Settings

    First Action
    Disinfect

    Second Action
    Delete

    Heuristics
    Yes

    Enable Warnings
    Yes

    Scanned Extensions
    *;

    Exclude Extensions

    Scan Emails
    Yes

    Scan Archives
    Yes

    Scan Packed
    Yes

    Scan Files
    Yes

    Scan Boot
    Yes

    Scanned File
    Status

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051798.exe
    Infected with: DeepScan:Generic.Malware.SN!!.948370C5

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051798.exe
    Disinfection failed

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051798.exe
    Deleted

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051800.exe
    Infected with: DeepScan:Generic.Malware.SN!!.948370C5

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051800.exe
    Disinfection failed

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP66\A0051800.exe
    Deleted

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP70\A0060155.exe
    Infected with: DeepScan:Generic.Malware.SN!!.948370C5

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP70\A0060155.exe
    Disinfection failed

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP70\A0060155.exe
    Deleted

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP82\A0076285.exe
    Infected with: DeepScan:Generic.Malware.SN!!.948370C5

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP82\A0076285.exe
    Disinfection failed

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP82\A0076285.exe
    Deleted

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core2.zip
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core2.zip=>lib/rt.pack
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>CHANGES
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>LICENSE
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>README.txt
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>THIRDPARTYLICENSEREADME.txt
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>Welcome.html
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>lib/classlist
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>lib/cmm/CIEXYZ.pf
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>lib/cmm/GRAY.pf
    Clean

    C:\System Volume Information\_restore{1C714A9C-992B-43ED-8366-D7FDDF1AF384}\RP97\A0095662.msi=>(Embedded CAB)=>core3.zip=>lib/cmm/LINEAR_RGB.pf
    Clean

    C:\WINDOWS\system32\drivers\etc\hosts
    Infected with: Generic.Qhost.A8E64EF3

    C:\WINDOWS\system32\drivers\etc\hosts
    Disinfection failed

    C:\WINDOWS\system32\drivers\etc\hosts
    Deleted
    0