-----Original Message-----
Hi Again Mike ,
See how you get on with Sysclean and then post the hijack
log to show exactly what is runnin on your pc.Also use
Ewido Security Suite and run a full scan with that if the
online scans are taking a couple of hours each time and
not clearing it.
Download Ewido Security Suite
http://download.ewido.net/ewido-setup.exe
(Update then run a full system scan in safe mode together
with sysclean)
It may be because all the virus files are stored in the
windows folder and are all in use which is preventing the
scanners removing them.
Before running the scanners check task manager and end
process for any of these.(press control,alt & delete
together) then goto processes and check for these :
notepad2.exe
popuper.exe
intmonp.exe
intmon.exe
paint.exe
shnlog.exe
aolfix.exe
End process for any found :
turn off system restore before running any fixes
Puper.C
intmonp.exe monitors the main process, and restarts it if
it is terminated. The main process restarts the
monitoring process if it is terminated, and recreates it
if it is deleted.
files connected to this :
C:\WINDOWS\winsx.cab
C:\WINDOWS\winsx.dll
C:\WINDOWS\System32\winsx.dll
C:\WINDOWS\System32\intmonp.exe
notepad2.exe
popuper.exe
also creates the following registry entry to ensure it is
run when the infected computer starts:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\e x
plorer\run
notepad2.exe
popuper.exe
The restarting of the main process by inmonp.exe only
works if the Trojan file is named popuper.exe.
Therefore, the system can be disinfected by first
changing the name of the file popuper.exe, and then
terminating the popuper.exe process.
intmonp.exe will then terminate itself when it cannot
find the main file to re-execute it. Both files can then
be deleted and the registry cleaned.
Puper.D
files connected to this :
C:\WINDOWS\System32\hhk.dll
C:\WINDOWS\System32\intmon.exe
C:\WINDOWS\System32\hpXX.tmp - where XX denotes randomly
generated characters.
paint.exe
shnlog.exe
In order to run itself on startup, the Trojan creates the
following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\e x
plorer\run
paint.exe
shnlog.exe
As Puper.C, intmon.exe monitors the main process, and
restarts it if it is terminated. Meanwhile the main
process restarts the monitoring process if it is
terminated, and recreates the file intmon.exe if it is
deleted.
Troj/Puper-D changes settings for Microsoft Internet
Explorer, including Start Page and search settings, by
modifying values (Hijack this would make this part easier)
HKCU\Software\Microsoft\Internet Explorer\Main
HKCU\Software\Microsoft\Internet
Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet
Explorer\Main\Default_Search_URL
HKCU\Software\Microsoft\Internet Explorer\Search
HKCU\Software\Microsoft\Internet Explorer\Main\Search Page
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKCU\Software\Microsoft\Internet Explorer\SearchUrl
Registry entries are set as follows:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\B r
owser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-
FFFFFFFFFFFA)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\B r
owser Helper Objecta\(FFFFFFFF-FFFF-FFFF-FFFF-
FFFFFFFFFFFA)\(default)
The file hpXX.tmp is registered as a COM object and
Browser Helper Object (BHO) for Microsoft Internet
Explorer, creating registry entries under:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\B r
owser Helper Objects\(FFFFFFFF-FFFF-FFFF-FFFF-
FFFFFFFFFFFA)
HKCR\CLSID\VMHomepage
HKCR\CLSID\(FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA)
HKCR\Interface\(1E1B2878-88FF-11D2-8D96-D7ACAC95951F)
HKCR\TypeLib\(1E1B286C-88FF-11D2-8D96-D7ACAC95951F)
HKCR\VMHomepage
The restarting of the main process by intmon.exe only
works if the main Trojan file is named shnlog.exe.
Therefore, both processes can be terminated by changing
the name of the file shnlog.exe, then terminating the
shnlog.exe process.
intmon.exe will then terminate itself when it cannot find
the main file to re-execute it. Both files can then be
deleted and the registry cleaned.
After shnlog.exe has been cleared from the system,
standard procedures can be used for disinfection of the
other two components.
Trojan.Qhosts
Qhost is a trojan that prevents access to certain web
sites and reroutes traffic to certain ip addresses. It
also modifies the DNS setting so the unsuspecting user
might be redirected to sites other than those intended.
It is copied onto the system as aolfix.exe. When
aolfix.exe is automatically executed it drops a bat file
in this directory c:\bdtmp\tmp and executes that file,
the name is randomly generated from numerical characters.
The bat file drops these files:
On all systems:
C:\WINDOWS\System32\o.reg
On 2000/XP systems:
C:\WINDOWS\System32\o2.reg
C:\WINDOWS\System32\o.vbs
The o.vbs goes through every key under the keys below and
changes the NameServer value to a certain ip number.
HKEY_LOCAL_MACHINE\ SYSTEM\ControlSet001
\Services\Tcpip\Parameters\interfaces\
HKEY_LOCAL_MACHINE\ SYSTEM\ControlSet002
\Services\Tcpip\Parameters\interfaces\
After that it will create a new hosts file in those
directories %windir%\hosts and %windir%\help\hosts. That
file will contain a text that will look something like
this:
<random ip number> elite
<random ip number>
www.google.akadns.net
<random ip number>
www.google.com
<random ip number> google.com
<random ip number>
www.altavista.com
<random ip number> altavista.com
<random ip number> search.yahoo.com
<random ip number> uk.search.yahoo.com
<random ip number> ca.search.yahoo.com
<random ip number> jp.search.yahoo.com
....
After it has completed the above tasks it will delete the
files it dropped. But the C:\bdtmp\tmp directory will
still be there, empty.
Go to Start->Run and type in regedit and press [ENTER].
Then change the following registry keys.
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\
MSTCP]
"EnableDNS"="1" change this value to "0"
"HostName"="host" remove this value
"Domain"="mydomain.com" remove this value
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main]
"Search Page"="
http://www.google.com" remove this value
"Search Bar"="
http://www.google.com/ie" remove this value
[HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\SearchURL]
""="
http://www.google.com/keyword/%s" remove this value
"provider"="gogl" remove this value
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
Explorer\Search]
"SearchAssistant"="
http://www.google.com/ie" remove this
value
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001
\Services\Tcpip\Parameters]
"DataBasePath"="DataBasePath"="%SystemRoot%\help" change
this value to "%SystemRoot%\System32\drivers\etc"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002
\Services\Tcpip\Parameters]
"DataBasePath"="DataBasePath"="%SystemRoot%\help" change
this value to "%SystemRoot%\System32\drivers\etc"
Close regedit.
Now locate the dropped hosts file and delete it.
It is located here :
\Windows\help\hosts
HTML.Helpcontrol
HTML.Helpcontrol!exploit is a generic detection of web
pages or e-mail messages which attempt to exploit
the "Microsoft Internet Explorer HTML Help Control Local
Zone Security Restriction Bypass" vulnerability.
(Basically you have visited a malicious web site that has
written malicious code into their web pages to infect
people with malware-probably where most of your problems
came from) Crack & Serial website are the worst offenders
for this,
This does not necessarily mean that a virus has been
found. It merely means that HTML code was found which
attempts to activate additional executable code without
the user's express permission.
Maybe it remains in a quarantine folder belonging to your
antivirus software which may need clearing,if its showing
in temp folders,then use Ccleaner or open a internet
window and goto tools then Internet options delete
cookies and files(include all offline content when
deleting files)
Win32.alemond.A
Ive not heard of this one and even searchin eTrusts isnt
showin a match for this,If eTrust has detected this on
the C/drive double check the spelling or see if it shows
where the Virus is saved and under what name.Again it
could be detecting something in a quaratine folder that
belongs to the antivirus sofware(To check this open
c/drive then the folder for the antivirus software you
have and check here for a quarantine folder- If found
open the folder and delete the contents but not the
folder)
Regards Andy Manc
.
