Help again!!!!

itsbeef

that should read Win32: Dumador-G

shouldnt have a smiley on it

christie_m

Does AVAST clean it?

What's the name of the scumware, the smiley seems to cover up part of the name.

albertross_2

Did you do it in safe mode, was this the filename

c:\windows\dvpd.dll

albertross_2

are any of these files on your PC

Backdoor.Win32.Dumador.g
port: 1000, 1001, 2283 TCP

dropped files:
c:\Documents and Settings\%user%\Start Menu\Programs\Startup\rundllw.exe
size: 24,600 bytes

c:\WINDOWS\dllreg.exe
size: 24,600 bytes

c:\WINDOWS\guid32.dll (Trojan-Spy.Win32.SilentLog.a)
size: 4,096 bytes

c:\WINDOWS\rundllx.sys
size: 26 bytes

c:\WINDOWS\system32\load32.exe
size: 24,600 bytes

c:\WINDOWS\system32\vxdmgr32.exe
size: 24,600 bytes

startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell"
Old data: Explorer.exe
New data: explorer.exe C:\WINDOWS\System32\vxdmgr32.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows "run"
Data: C:\WINDOWS\dllreg.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "load32"

have you gone to bed?

christie_m

albertross - no response from itsbeef in 20-30 mins...it's gone very quiet in here!

itsbeef

run full scan thro avast and Win32.Dumador.g was deleted

rebooted and Win32.Dumador.g has re-appeared

christie_m

itsbeef is still showing as online...maybe he's fallen asleep at the keyboard!

itsbeef

now have DCOM-exploit coming up as being detected by AVAST??

itsbeef

and LSASS Exploit keeps being blocked by AVAST

??

albertross_2

Did you do it in safe mode (F8 at startup). If not, try it..

P.S. If you are going to bed, pl tell us... first..