Desperately need some help!!!

[shirl A]

Please,im in desprate need of some advice to get rid of a virus or a useful link/tool to get help!!

I recieved a link via skype 2 nights ago thinking its was pictures from my friend..i clicked the link!! needless to say..Im now the new proud owner of a WORM_STRATION LY that is causing havoc on my machine! Im currently running PC cillan and have Windows defender but its not helping. As pc cillan quarantines the folder,it just pops back up again..and there is a folder that cant be quarantined (pc cillan says to manually delete the file but,of cos', It wont let me delete the file(found in my Windows System32 folder)

I absolutely cannot reformat my machine(i can but i dont want to) and its really going slow!!!taking ages to load pages! And of cos, i keep getting the pc cillan pop ups literally every 2 secs kwim?

I have googled this worm but havent been able to find anything really helpful to this particular virus!

I would really appreciate any useful help! (LOL..and in laymans terms so that i can understand!

This is what PC cillan has to say:
Action taken: The Quarantine action was unsuccessful. Manually delete the file if you are sure that it is not needed.
.
Incident name: C:\WINDOWS\SYSTEM32\nv4_icm3.dll
Detection name: WORM_STRATION.LY
User name: Shirley



PLEASE<PLEASE HELP!!!

[shirl A]

Oh and want to add..im running windows XP pro!!(and ive just updated so have the virus removal tool thing!!...which didnt pick it up when i ran a scan!!!)

[oddjob]

Hi shirl A

I recommend you print this out to help you follow the instructions.


Download Ewido/AVG Anti Spyware from here ….

http://www.ewido.net/en/

It has a fully working 30 day trial period.

Install it and update it to the latest definitions.

Do NOT use it yet.

*************

Now boot to safe mode. Here’s a “how to” if you’re not sure ..

http://service1.symantec.com/SUPPORT...01052409420406

*************

When in safe mode run a full system scan with AVGAS and let it fix what it wants to.

REMEMBER TO SAVE THE SCAN REPORT and also remember where you saved it.

*************

STILL IN SAFE MODE .... Go to this file ... in bold ... .and delete it IF it is still present ...

C:\WINDOWS\SYSTEM32\nv4_icm3.dll

Empty your recycle bin.

*************

[FOOTNOTE > this is a good program to use as an “on demand” scanner even after the trial period is over. Keep it updated and use it to scan your computer from time to time].

*************

If this doesn’t succeed in fixing the problem download a self-extracting copy of HijackThis from here …….

http://downloads.malwareremoval.com/hijackthis_sfx.exe

Save it to your Desktop.

Double-click on the file hijackthis_sfx.exe file and it will self-extract into its own folder ……

C:\Program Files\HijackThis

Go to this folder and run the hijackthis.exe file.

From the menu click on "Do a system scan and save a logfile".

Copy and paste both the AVG AS scan report and the HJT logfile to this thread. More specific removal instructions will follow for whatever it is that's causing the problem.


OJ

[staal]

Hi OJ

I've got the same problem, here are the threads:

Logfile of HijackThis v1.99.1
Scan saved at 10:04:47, on 04-03-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Cisco\CSAgent\bin\CSAControl.exe
C:\Program Files\Cisco\CSAgent\bin\leventmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\SITECSOFT\NetMan-pro\NETMANP.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\WINDOWS\Wcgopsvc.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\SITECSOFT\NetMan-pro\RUNNMP.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\ScanSoft\OmniPageSE3.0\OpwareSE3.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Cisco\CSAgent\bin\okclient.exe
C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Borland\InterBase\bin\ibguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\Cwcommu.exe
C:\Program Files\Trend Micro\OfficeScan Client\ofcdog.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Borland\InterBase\bin\ibserver.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\Documents and Settings\Morten\Desktop\hijackthis_sfx.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euroinvestor.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = effw01:8080
F3 - REG:win.ini: load=
F3 - REG:win.ini: run=D:\
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [NetMan-pro] C:\Program Files\SITECSOFT\NetMan-pro\NETMANP.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [WebCam Go Plus Sti Service Application] Wcgopsvc
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] "C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe"
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [OpwareSE3] "C:\Program Files\ScanSoft\OmniPageSE3.0\OpwareSE3.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\RunOnce: [NetMan-pro] C:\Program Files\SITECSOFT\NetMan-pro\RUNNMP.EXE /start
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.12.1.1\PlaxoHelper.exe -a
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\G oogleToolbarNotifier.exe
O4 - Startup: IntelliStor LT Scheduler.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Cisco Security Agent.lnk = C:\Program Files\Cisco\CSAgent\bin\okclient.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.70\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 3.70\MediaManager\grab.html
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk/html/activ.../e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = emborg.local
O17 - HKLM\Software\..\Telephony: DomainName = emborg.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = emborg.local
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\Plugin Manager\Skype4COM.dll
O20 - AppInit_DLLs: csauser.dll nv4_icm3.dll
O20 - Winlogon Notify: drmvndde - C:\WINDOWS\system32\drmvndde.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Cisco Security Agent (CSAgent) - Unknown owner - C:\Program Files\Cisco\CSAgent\bin\CSAControl.exe" -t c (file missing)
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - Unknown owner - C:\WINDOWS\SYSTEM32\DWRCS.EXE (file missing)
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InterBase Guardian (InterBaseGuardian) - Inprise Corporation - C:\Program Files\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server (InterBaseServer) - Inprise Corporation - C:\Program Files\Borland\InterBase\bin\ibserver.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Unknown owner - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

[staal]

and:


---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 08:56:21 04-03-2007

+ Scan result:



C:\Program Files\WeatherCast -> Adware.SaveNow : No action taken.
C:\WINDOWS\Temp\PCL43DE.tmp -> Backdoor.Agobot.nq : No action taken.
C:\Documents and Settings\Guest\Cookies\guest@adtech[1].txt -> TrackingCookie.Adtech : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@adtech[2].txt -> TrackingCookie.Adtech : No action taken.
C:\Documents and Settings\Morten\Cookies\morten@advertising[2].txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@advertising[1].txt -> TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Morten\Cookies\morten@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : No action taken.
C:\Documents and Settings\Guest\Cookies\guest@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@as-eu.falkag[1].txt -> TrackingCookie.Falkag : No action taken.
C:\Documents and Settings\Morten\Cookies\morten@media.fastclick[1].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@ehg-sistic.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@hitbox[1].txt -> TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@ads1.revenue[1].txt -> TrackingCookie.Revenue : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@revenue[2].txt -> TrackingCookie.Revenue : No action taken.
C:\Documents and Settings\Guest\Cookies\guest@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
C:\Documents and Settings\Morten\Cookies\morten@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\Morten\Cookies\morten@statse.webtrendsliv e[2].txt -> TrackingCookie.Webtrendslive : No action taken.
C:\Documents and Settings\Morten\Local Settings\Temp\Cookies\morten@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : No action taken.


::Report end


Hope you can help.

Cheers
Staal

[shirl A]

Thank you Oddjob for responding but my problem has been sorted!!My machine is clean!

Staal..good luck..this virus is a nightmare and hope you get it fixed soon!

[oddjob]

Originally Posted by shirl A

Thank you Oddjob for responding but my problem has been sorted!!My machine is clean!

Good news BUT - to help us all understand what's going on - please tell us how your machine was cleaned. What did the trick?


If you are certain you have no more trouble you should clear out all old System Restore points then immediately create a new one so you have something to fall back on should anything go awry again. Also remember to make SR points on a regular basis.

More on System Restore ...

http://www.microsoft.com/windowsxp/u...w_03may19.mspx


What may have lead up to your infection and help keep your computer free of malware …

http://www.castlecops.com/t7736-So_h...rst_place.html

http://www.help2go.com/Tutorials/Pro...Hijackers.html

There is a little duplication but these tutorials are both well worth reading.

If you do suffer an infection again you should run first Ccleaner to clean out your system. Get Ccleaner here but ensure you install it WITHOUT the optional Yahoo Toolbar download (you must untick/uncheck the relevant box on download) …

http://www.ccleaner.com/


Also run through this before posting another HijackThis log …

http://www.help2go.com/Tutorials/Pro... jackers.html


Best wishes.


Staal.. please start your own thread in this forum and post your log reports there. We do not answer questions relating to anyone who hijacks someone else's thread.

Thanks.


OJ

[shirl A]

LOL..in all honesty..i cant really pinpoint what did the trick..my entire desktop was covered in removal tools/spyware and logs!!(everything from AVG to OTMove it) It took me 3 days to get rid of it!

I think this is what did it thou'

I followed this tut on Pc cillan
http://uk.trendmicro-europe.com/ente... _STRATION.LY
(although it didnt get rid of the virus..it helped)

Then I downloaded Avenger with the text file and isolated it.
Then i ran a hijack scan and fixed the 020 drmvndde file.
Ran a pc cillan scan ,which quarantined the avenger zip file where the virus was..and deleted it and it was gone...just had a bit of cookies and and my system restore which i fixed. I hope this all makes sense to you!

Ran a final scan after rebooting and come up clean..ran another this morning to be sure and still clean(and did an online scan and MS defender)...and ive had no pop-ups from pc cillan!
(at one stage i could hardly type for all the pop-ups)

Thats pretty much the gist of it.. It sounds so easy but im sure ive left out things that i did along the way that prolly added to the cause!

Unfortunately I cant take the credit..that goes to someone called Acrobaze (LOL I know he will see this entry) who patiently talked me through it while i was undergoing heart-pulpitations! )

OJ..thanx for responding and for the tuts..im on my way to read them..i dont EVER want this to happen again!

Thanks again
Shirl

[oddjob]

Well ... if Acrobaze has been helping you then I'll say now more. Acrobaze is highly trained and, like me, is a member of ASAP. You can have every confidence in what Acribaze recommends. I didn't even know he was a member of ST&T.

Mind you, It would have been good if the advice was posted here so all can see it but he probably thougt that, if he was going to use Avenger, his advice shoudn't be posted in open forum.

Watch out if you are ever told to use Avenger again. It is a deadly program in the wrong hands. It has the power to trash a computer compleletly if used incorrectely.

Safe surfing.


OJ