Not clean yet :( Help

mag00 · Dec 23, 2006

I have followed the guideline above, and still today, my ZA got a warning on win32.p2p.worm

In the windows system32\bszip.dll

Should I post the hjt log?

I don't have the saved log of when I ran the avg free, but clicked fix or the appropriate action. Then restarted out of safe mode.

Scanned last night with avg and was clean, haven't been online and zone alarm gave me the above warning. I can post a screenshot.

I had alcan worm & sdbot worm and now, I get p2p worm

This laptop has not been on a p2p site, and has does not do adult sites.

I have transfered some software from another machine, but that machine seems to be OK

I do use yahoo IM and T-mobile hotspot

I had trouble a half year ago and posted here...http://forums.majorgeeks.com/showthread.php?t=89502 ... and thought I was clean.

Well last week my ebay account was locked as ebay detected fraudulent activity on my account. I went and changed all password etc, put fraud alert on credit etc. I am totally paranoid now, and haven't even been trusting the AV software companies.

I do know I have gotten exempliary help here at MG, and and trust the knowledge and wisdom of the techs here, even if some of my opinions in other non tech forums may differ.

Anyway, can someone advise on next steps to take. I do not want to hook the laptop online, but can.

Thanks much
Dave

bjgarrick · Dec 24, 2006

If you have followed all the steps below, then attach the requested logs.

http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

CounterSpy

AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
Click to expand...

mag00 · Dec 24, 2006

I couldn't follow all the steps as described

Machine was not online and I had to transfer files from a dial up connection over to the laptop to run stuff.

When I did the scan, I forgot to tic the save log, But I have the log before things got fixed from avg free. After that log, avg fixed those items. Then restarted to normal startup and finished fixing.

Some of the downloaded software would not run without online authentication.

I am not comfortable connecting it still. I get a p2p.worm warning from zone alarm, and I am not online.

I have run many scans all say I am clean, and I still get this zone alarm warning.

I am on my mac for now, and all I will use it until I either get this bunk of the laptop or put a new HD in. I really don't think I should have to install a new hd.

Last night a tech friend and I went through alot of the registry manually, found some odd scripts in dreamweaver registry values, full on java,

I have uninstalled dreamweaver and smart ftp

So with exception to some screenshots and some before logs, and one report, I have none of the above to post except all clean scans.

mag00 · Dec 24, 2006

This is what has me worried yet, all scans say I am clean and this happens???

I am not confident it is gone even using the delete from za.

Any help on locating this and removing it permanently, (not quaranteen) would be appreciated.

Thanks and Merry Christmas
Dave

mag00 · Dec 24, 2006

screenshot won't attatch

bjgarrick · Dec 24, 2006

You didn't attach these logs?

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

mag00 · Dec 27, 2006

bjgarrick said:

You didn't attach these logs?

Bitdefender - from step 6

Panda Scan - from step 6

runkeys.txt - the log from GetRunKey.bat

newfiles.txt - the log from ShowNew.bat

Click to expand...

2hours into the bitdefender scan, my laptop shut down. (half way done)

Earlier panda scan was clean I do not see the point in running yet another annoying scan

I don't have a persistant internet connection, starbucks does close up for the night, and I must work during the day. And my other internet is dialup

I attatched what I have, will you or anybody help?

chaslang · Dec 28, 2006

You need to run GetRunKey and ShowNew and attach the logs as requested. Between the two of them they run in a minute or less. In fact ShowNew would have even deleted the bszip.dll file and told you that it did (that is assuming it is still present.)

In the future please remember to save logs after fixing things. We don't need AVG Antispyware (or any programs log) that only shows what they found. We also need to see what was fixed so that we know what remains to be fixed manually.

mag00 · Dec 30, 2006

chaslang said: ↑

You need to run GetRunKey and ShowNew and attach the logs as requested. Between the two of them they run in a minute or less. In fact ShowNew would have even deleted the bszip.dll file and told you that it did (that is assuming it is still present.)

In the future please remember to save logs after fixing things. We don't need AVG Antispyware (or any programs log) that only shows what they found. We also need to see what was fixed so that we know what remains to be fixed manually.
Click to expand...

That last post was supposed to have the two you mentioned attatched. I must have missed a step in attatching, seems I'm good at missing steps. I noticed it yesterday, and just haven't been able to get to the laptop and remember to add them.

The runkey and shownew. I have those. I will post them soon.

(on my mac now)

Happy New Year!
Dave

mag00 · Dec 31, 2006

Here it is hopefully

chaslang · Jan 2, 2007

mag00 said: ↑

Here it is hopefully
Click to expand...

Well that's better but those are not the current versions of GetRunKey and ShowNew. However, I see no malware anyway and the bszip.dll file was not detected by GetRunKey so it must already be gone.

You do need to uninstall your outdated Sun Java version ( J2SE Runtime Environment 5.0 Update 2 ) and install the current version from Sun Java Runtime Environment

Also you should not be installing HijackThis like below into the base folder of C:\Program Files. It should be in
Code:
"C:\Program Files\"
analyse.exe   Dec 18 2006      218112  "analyse.exe"
hijack~1.log  Dec 27 2006        7138  "hijackthis.log"

Log in or Sign up

Not clean yet :( Help

mag00 Sergeant

bjgarrick MajorGeeks Admin - Malware Expert

mag00 Sergeant

Attached Files:

REPORT.TXT

avgreportfirst.txt

12-23-2pm.log

mag00 Sergeant

mag00 Sergeant

bjgarrick MajorGeeks Admin - Malware Expert

mag00 Sergeant

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

mag00 Sergeant

mag00 Sergeant

Attached Files:

runkeys.txt

newfiles.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member