Trojan prob

LOL! Sorry about that, once in MSCONFIFG, click the box next to "Normal Startup" and click OK but do not reboot. Attach a fresh HJT once complete.

 

here are the new logs...i needed to use a fix for run keys and shownew...i wondered why i had to press ignore every time i'd run the apps.

 

oh and yeah i assumed you'd have me tick normal startup...the logs below are after i did that

 

Have you had McAfee installed before? I see some traces that we can remove if it's not going to be used.

 

Yes I had Mcafee installed once, I've tried about 10 different anti virus solutions for hupigon.saz
edit: I wont be using it again, so removing the traces would be good.

 

Let's run ComboFix one more time...

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Once this scan is complete, attach the new log from it. Also, attach two fresh logs from ShowNew & GetRunKey.

 

Combofix says that it's expired, and to please download an updated copy.

 

ok I got around the combofix issue by changing my clock back a month.

attached are the new logs.

 

Please download the attached zip file and save to your desktop.

Extract the single exe inside and run it.

This will create a new file on your desktop called procdll.txt

Attach this log as your next post.

 

Procdll log attached.

 

Locate and run Process Explorer, what we used Post 35 and once open follow the below.

On the menu bar, click on FIND and then "Find Handle or DLL". Type in cscript.dll and press enter. When the results come back, look on the left hand side of the search window and let me know what process this file is locking to.

 

Nothing was returned in the search result, I made sure that I typed it correctly, I even tried cscr, csc, and looked through the results, but it isnt showing up.

 

Okay, just run these instructions for now...

Copy the bold text below to notepad. Save it as fixme5.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it
double click it and allow it to merge with the registry.

Now run Avenger again...

• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Once you complete the above, reboot a few times and attach fresh logs from the below.

• GetRunKey
• ShowNew
• HijackThis
• Avenger

 

fresh logs

 

new logs #2

 

Please download Silent Runner's

• Save it to the desktop.
• Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
• You will see a text file appear on the desktop - it's not done, let it run (it won't appear to be doing anything!)
• Once you receive the prompt All Done!, open the text file on the desktop, copy that entire log, and attach it to your next message.

NOTE: If you receive any warning messages from your antivirus or antispyware programs about a script trying to be run , please choose to allow the script to run.

 

log attached

 

Okay, I'm not seeing anything helpful.

See if you can manually locate the file, once you find it, ZIP it and attach it to your next post.

 

Also, let's get a log from the below...

Using Filemon and Regmon

 

cscript.dll attached.

 

Ok, I ran both utilities, for anything to show up in regmon I just opened exes like I.E, firefox, notepad etc as you'll see.
The Trojan seems to monitor opening executables, otherwise regmon and filemon remain fairly static.

I'll test this by leaving my laptop on for a few hours while I go out tonight.

 

http://img337.imageshack.us/img337/6723/57806147ql5.jpg

I'm seeing a ton of buffer overflows coming from bind, wonder if this is the cause/how the trojan got onto my system originally?

Thought you should have a look.

 

New log attached.

 

The only results that were returned were the RegSearchCqw.txt, a shortcut to that file, and another shortcut to that file somewhere in the temporary files.

 

http://img340.imageshack.us/img340/5613/30801866au8.jpg

Yes cscript.dll can be deleted manually, I've always been able to.

- The registry went in successfully.

 

Fresh logs incoming...

 

hjt log

- the cscript.dll folder i created is still there, and the actual cscript.dll that the trojan produces hasn't appeared.

 

Ok hjt hasn't shown the APPINIT_DLL line, but I'll reboot just to be sure.

 

Back from restating.
The cscript line in hjt is back.

 

The AppInit_DLLs is in the hjt scan I just did after following your previous step.

The folder we made is still there, there doesn't appear to be any cscript.dll file made by the trojan in the sys32 directory.

 

It's fine, I mean, the trojan doesn't inhibit anything like surfing, or working with any programs...the only way I knew I had a trojan was because Kaspersky (I use F-Secure, but it uses kasperskys virus engine) detected it, other than that I couldn't tell.

Although, I did notice once that a new trojan jumped onto my system soon after the AV resident told me that cscript.dll was a trojan...but it was deleted and never seen again.


I've had various infections in the past due to this being my laptop and therefore I take it to uni, connect to their wireless network through the cisco vpn client, it seems that I got infections from doing next to nothing I.E I wasnt surfing nasty sites and or downloading anything I shoudn't have been.

I looked at the cscript.dll file in notepad and it seemed to have links to dodgy websites, a lot of the text was unintelligible.

 

Well thank you both for your efforts.
RegMon has an option to 'log boot'...which I tried once, but it produced a log of about 150 meg lol.

I'll give it a go again, and just ctrl+f for cscript and the AppInit_DLLs.

Thanks once again!