Show Posts
1
Tech Clinic / request help on HJT logfile
« on: April 29, 2005, 12:29:20 AM »
Questolo,
First of all, let me apologize for the delay in getting back with you. Too much wildness to describe here. If you are still able to ck. out this log file, the results Ive found will follow. On Jotti's site, there seemed to be a problem loading so I question whether I did it right. However, I believe I have the root of the problem, just needs your expert eye.
______________________
1.
scanned C:\csrss.exe
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr. web found BACKDOOR.trojan Probable variant.
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found Win32/VB.VE
Norman Virus Control Found nothing
VBA32 Found nothing
_____________________________
2.
Scanned mscomm.exe on Jotti.org
Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found modification of BackDoor.Generic.815
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found nothing
_______________________________
3.
scanned c:\WINDOWS\system32\dll32\cssrs.exe
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found BACKDOOR.Trojan (probable variant)
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found Win32/VB.VE
Norman Virus Control Found nothing
VBA32 Found nothing
_____________________________
4.
In C:\WINDOWS\system32\dll
There are four files:
1. csrss.exe ( This file accompanied by the name "Transparent Proxy Server" ) W/ icon of PC and monitor.
2. makensis.exe w/ windows"frame" icon.
3. Script.nsi NSI file 2KB
4.ScriptTemp.nsi NSI File 2KB
Again, sorry for the delay. Let me know if I can provide more info. THANKS......theroadisalover
P.S. Please advise if perhaps you know of another site w/ scan. or?
perhaps answer will be apparent.
First of all, let me apologize for the delay in getting back with you. Too much wildness to describe here. If you are still able to ck. out this log file, the results Ive found will follow. On Jotti's site, there seemed to be a problem loading so I question whether I did it right. However, I believe I have the root of the problem, just needs your expert eye.
______________________
1.
scanned C:\csrss.exe
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr. web found BACKDOOR.trojan Probable variant.
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found Win32/VB.VE
Norman Virus Control Found nothing
VBA32 Found nothing
_____________________________
2.
Scanned mscomm.exe on Jotti.org
Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found modification of BackDoor.Generic.815
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found nothing
_______________________________
3.
scanned c:\WINDOWS\system32\dll32\cssrs.exe
AntiVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found BACKDOOR.Trojan (probable variant)
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
mks_vir Found nothing
NOD32 Found Win32/VB.VE
Norman Virus Control Found nothing
VBA32 Found nothing
_____________________________
4.
In C:\WINDOWS\system32\dll
There are four files:
1. csrss.exe ( This file accompanied by the name "Transparent Proxy Server" ) W/ icon of PC and monitor.
2. makensis.exe w/ windows"frame" icon.
3. Script.nsi NSI file 2KB
4.ScriptTemp.nsi NSI File 2KB
Again, sorry for the delay. Let me know if I can provide more info. THANKS......theroadisalover
P.S. Please advise if perhaps you know of another site w/ scan. or?
perhaps answer will be apparent.