Trogen

John W · June 24, 2010

I just downloaded clamwin for the first time. I have seen all of the permission denied postings, however I know I had a virus, EVERY Tuesday at 5;23pm my send box and YES from AOL would generate an email from me to my whole mailing list with some kind of Viagra link. After running AVG and malwarebytes to find out there was nothing wrong, my son suggested clam. I read your postings and finally ran clam to see that it found 2 trogens, I had checked "put in Quarantine box" prior to running. Now remember I really have no idea what I am doing. It Quarantined the 2 trogens it found. My question is, Is this ok to continue and or can I get the virus out f the actual files it was found in.

Below is JUST a partial of my scan history, I found no need to copy the whole history just the part where the virus was found. What do I do from here. the rest of the history was just all permissions denied.

Thanks much

John W

Scan Started Wed Jun 23 08:11:12 2010

-------------------------------------------------------------------------------

WARNING: Can't open file C:\boot\bcd: Permission denied

WARNING: Can't open file C:\hiberfil.sys: Permission denied

WARNING: Can't open file C:\pagefile.sys: Permission denied

WARNING: Can't open file C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.ilg: Permission denied

WARNING: Can't open file C:\Program Files\InstallShield Installation Information\{40BF1E83-20EB-11D8-97C5-0009C5020658}\setup.ilg: Permission denied

WARNING: Can't open file C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\setup.ilg: Permission denied

WARNING: Can't open file C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\setup.ilg: Permission denied

C:\ProgramData\.clamwin\quarantine\migrator.exe.infected: Trojan.Agent-147844 FOUND

C:\ProgramData\.clamwin\quarantine\migrator.exe.infected not moved/copied since already in quarantine

C:\ProgramData\.clamwin\quarantine\setup.exe.infected: Trojan.Agent-148079 FOUND

C:\ProgramData\.clamwin\quarantine\setup.exe.infected not moved/copied since already in quarantine

WARNING: Can't open file C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\03960095dc3a5dd6d270c42aec252b79_f78b1453-0e94-4d94-a659-a692bbf13204: Permission denied

jwang01 · June 25, 2010

Hello and welcome to the forums.

I am jwang01 and I will be assisting you with your issue.

When we get to working on your computer you may want to print out or save my respones in notepad because there may be times were you will not be able to access them here.

Also, please don't attach your logs unless asked, as they can make them hard to read. Just post them as a reply.

Let's stake a look at whats going on. I would also recommend changing your passwords for all your email addresses.

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
Click on this link to see a list of programs that should be disabled.
Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
Allow the driver to load if asked.
You may be prompted to scan immediately if it detects rootkit activity.
If you are prompted to scan your system click "No", save the log and post back the results.
If not prompted, click the "Rootkit/Malware" tab.
On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
Select all drives that are connected to your system to be scanned.
Click the Scan button to begin. (Please be patient as it can take some time to complete)
When the scan is finished, click Save to save the scan results to your Desktop.
Save the file as Results.log and copy/paste the contents in your next reply.
Exit the program and re-enable all active protection when done.

Next

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Custom Scan box paste this in
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post the logs of GMER and both OTL logs in your next reply.

John W · June 25, 2010

Hello and welcome to the forums.
I am jwang01 and I will be assisting you with your issue.
When we get to working on your computer you may want to print out or save my respones in notepad because there may be times were you will not be able to access them here.
Also, please don't attach your logs unless asked, as they can make them hard to read. Just post them as a reply.
Let's stake a look at whats going on. I would also recommend changing your passwords for all your email addresses.
Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.
Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
Click on this link to see a list of programs that should be disabled.
Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
Allow the driver to load if asked.
You may be prompted to scan immediately if it detects rootkit activity.
If you are prompted to scan your system click "No", save the log and post back the results.
If not prompted, click the "Rootkit/Malware" tab.
On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
Select all drives that are connected to your system to be scanned.
Click the Scan button to begin. (Please be patient as it can take some time to complete)
When the scan is finished, click Save to save the scan results to your Desktop.
Save the file as Results.log and copy/paste the contents in your next reply.
Exit the program and re-enable all active protection when done.
Next
Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Custom Scan box paste this in
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
Please post the logs of GMER and both OTL logs in your next reply.

Thanks jwang01,

I have no idea what I am doing, though I followed your step by step directions which where very good. before I go on with the final reports, I just want to say, My son says " as long as they are in quarantine I do NT have to worry" as per my original post..

Follows are the results of all the test you had me run,"results.log OTL.txt & Extras.txt As I said, I have NO IDEA what any of it means. Thanks very much for your help

John W

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-06-25 11:54:49

Windows 6.0.6002 Service Pack 2

Running: l457lwfm.exe; Driver: C:\Users\JOHNWV~1\AppData\Local\Temp\axldrpoc.sys

---- System - GMER 1.0.15 ----

INT 0x51 ? 83FE6BF8

INT 0x73 ? 85D7CF00

INT 0x83 ? 85D7CF00

INT 0x92 ? 92A04CD0

---- Kernel code sections - GMER 1.0.15 ----

? System32\Drivers\spug.sys The system cannot find the path specified. !

.text USBPORT.SYS!DllUnload 87D8741B 5 Bytes JMP 85D7C4E0

.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C80A340, 0x3FA057, 0xE8000020]

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8060E6D6] \SystemRoot\System32\Drivers\spug.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8060E042] \SystemRoot\System32\Drivers\spug.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8060E800] \SystemRoot\System32\Drivers\spug.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8060E0C0] \SystemRoot\System32\Drivers\spug.sys

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060E13E] \SystemRoot\System32\Drivers\spug.sys

IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8061DB90] \SystemRoot\System32\Drivers\spug.sys

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\explorer.exe[3528] @ C:\Windows\explorer.exe [gdiplus.dll!GdiplusShutdown] [73A57817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396