TR/Crypt.Xpack.Gen and Worm/rous.a

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by thefreed, Mar 15, 2011.

  1. thefreed

    thefreed Private E-2

    I am staying in Korea at the time, and I got this computer to use like a month ago.

    I had my avira anti virus keep on telling me there was a trojan (TR/crypt) that kept making these tmp-16 files in my temp folder and other places.

    I also had worm/rous.a and it won't go away. I have a few other file logs that I would like to share so please bare with me.

    Ummm I'll copy paste the root peal one cause it wouldn't let me save it without writing over another file log and I thought if it didn't have the right name, someone might think it's a virus.

    When I first got this computer it was super fast but now youtube would buffer and take forever and all these sites take a while to load...
    Also the edb.log in system32 catroot2 folder seems to be infected. Or atleast that's what my avira tells me, I can't delete it and there's this weird tmp.edb file that won't get deleted also.

    ROOTREPEAL (c) AD, 2007-2009
    ==================================================
    Scan Start Time: 2011/03/15 23:36
    Program Version: Version 1.3.5.0
    Windows Version: Windows XP SP3
    ==================================================

    Hidden/Locked Files
    -------------------
    Path: \\?\C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\3F4ZUY62\*
    Status: Could not enumerate files with the Windows API (0x00000003)!


    Path: \\?\C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\52TGIUD9\*
    Status: Could not enumerate files with the Windows API (0x00000003)!


    Path: \\?\C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\CTOASI20\*
    Status: Could not enumerate files with the Windows API (0x00000003)!


    Path: \\?\C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Internet Explorer\DOMStore\WIDHUZ0B\*
    Status: Could not enumerate files with the Windows API (0x00000003)!
     

    Attached Files:

    Last edited: Mar 15, 2011
    thefreed, Mar 15, 2011
    #1
  2. thefreed

    thefreed Private E-2

    Here are my other logs.

    Please help me...
     

    Attached Files:

    thefreed, Mar 15, 2011
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing any malware in the rest of your logs. However, I suggest you take that file and have it checked at Jotti:

    Click on the following link and use the below steps to scan a file: Virustotal

    Click the Browse... button.
    Navigate to the file FileToBeScanned

    Where FileToBeScanned is the actual file to be scanned. Like C:\WINDOWS\System32\vdmt16.sys
    [/LIST]
     
    TimW, Mar 15, 2011
    #3
  4. thefreed

    thefreed Private E-2

    I know I am so stupid but it seems like I've been infected with another virus... It's called phoenix.exe (diagnosis: Malware family: Trojan.Win32.Busky
    I think I got it because I got this computer a little while ago and I forgot to do system update it.

    I am going to do system update for sure after I get this cleaned but I am afraid to restart my computer because it's going to reinstall the virus and I am sure it'll get worse >_>.

    ==========
    I got this from downloading this phoenix.exe 1.4 thing by this guy named $t@t!c_V()1D. And he kept on going around advertising that it's a false positive and I guess I fell for it... :cry

    Here's some information on it. http://www.virustotal.com/file-scan...0926f7e3d83ad98369b658acab57dc5c3c-1290175769

    I know it's a virus because the ad-aware notified me and I immediately deleted it but after awhile it turned up in my system tray next to the date and time thingy and when I browsed over it, it disappeared.

    I am shitting bricks right now O_O.

    ROOTREPEAL (c) AD, 2007-2009
    ==================================================
    Scan Start Time: 2011/03/16 07:37
    Program Version: Version 1.3.5.0
    Windows Version: Windows XP SP3
    ==================================================

    Hidden/Locked Files
    -------------------
    Path: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\hu8k9i00.default\sessionstore.js
    Status: Could not get file information (Error 0xc0000008)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_001_
    Status: Size mismatch (API: 588673, Raw: 581890)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_002_
    Status: Size mismatch (API: 500762, Raw: 492787)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_003_
    Status: Size mismatch (API: 1082451, Raw: 1050416)

    Path: C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\hu8k9i00.default\Cache\F62FAF84d01
    Status: Visible to the Windows API, but not on disk.



    I looked everywhere about this virus... and I can't seem to do anything about it....

    Thx and please help me again it's much appreciated.
     

    Attached Files:

    thefreed, Mar 15, 2011
    #4
  5. thefreed

    thefreed Private E-2

    It seems I got another virus... It's so stupid of me but I think I got it cause I got this computer not too long ago and the system update wouldn't show up...

    Anyway I am going to do system update from now on but I am scared that if I restart my computer, malwares would reinstall itself and start getting worse. To the point that I can't browse the web.

    Anyway it's called phoenix.exe (diagnosis: Malware family: Trojan.Win32.Busky)

    And i got it from downloading it on a site with some guy named $t@t!c_V()1D.
    He advertised that it's a false positive EVERYWHERE. And I've done a fair bit of research and there was a ton of guys saying it wasn't a virus but I guess I fell for it.

    I deleted it right away but after some time, it's icon showed up in my system tray and when I browsed over it.
     
    thefreed, Mar 15, 2011
    #5
  6. thefreed

    thefreed Private E-2

    Sorry I got to bump because I forgot to put in attachments.

    ANyway when I browsed over it, it disappeared... My ad-aware detected it and said it would block it... but after 5 minutes it showed up... I am scared my anti viruses won't be able to fix it...

    Anyway please help me if you can, I've tried looking all over to try to get rid of it but there's like no information on the net regarding how to remove it.

    ROOTREPEAL (c) AD, 2007-2009
    ==================================================
    Scan Start Time: 2011/03/16 07:37
    Program Version: Version 1.3.5.0
    Windows Version: Windows XP SP3
    ==================================================

    Hidden/Locked Files
    -------------------
    Path: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\hu8k9i00.default\sessionstore.js
    Status: Could not get file information (Error 0xc0000008)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_001_
    Status: Size mismatch (API: 588673, Raw: 581890)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_002_
    Status: Size mismatch (API: 500762, Raw: 492787)

    Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\hu8k9i00.default\cache\_cache_003_
    Status: Size mismatch (API: 1082451, Raw: 1050416)

    Path: C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\hu8k9i00.default\Cache\F62FAF84d01
    Status: Visible to the Windows API, but not on disk.
     

    Attached Files:

    thefreed, Mar 15, 2011
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please re-run both SAS and MBAM. Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * MBAM log
    * SAS log
    * C:\MGlogs.zip
     
    TimW, Mar 16, 2011
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds