Executable help?

[Guest]

[martin11ph]

Previously this has also occured causing me to reformat my hard drive. Now, however, it is being blocked constantly. I cannot delete it however. It also doesn't show up when I search it. How do I fix it?

In Comodo it is written:
Application: \Device\Harddisk1\DP(1)0-0+9\transmit.ex...
Action: Terminate Process
Target: C:Windows\explorer.exe

It repeats every 2 secs.

I viewed active processes and chose terminate and quarantine. Will this solve my problem?

I know this came from my USB Flash Drive, but I'm wondering how it managed to survive a lot of cleaning with ESET Nod32 and was detected only later by Comodo.

[Info-Sec]

Previously this has also occured causing me to reformat my hard drive. Now, however, it is being blocked constantly. I cannot delete it however. It also doesn't show up when I search it. How do I fix it?

In Comodo it is written:
Application: \Device\Harddisk1\DP(1)0-0+9\transmit.ex...
Action: Terminate Process
Target: C:Windows\explorer.exe

It repeats every 2 secs.

I viewed active processes and chose terminate and quarantine. Will this solve my problem?

I know this came from my USB Flash Drive, but I'm wondering how it managed to survive a lot of cleaning with ESET Nod32 and was detected only later by Comodo.

Download:
http://ccollomb.free.fr/unlocker/

It is a tool called unlocker.  What you do is install this, then right click on the file you want to delete hit 'unlocker' under no action hit 'delete' then select one of the processes and hit 'unlock all'

[martin11ph]

Apparently it is a very nasty virus.

http://puretuts.multiply.com/journal/item/111      <<<some dialect in text

Whenever I search any of these files (transmit.exe and isetup.exe) all that is shown is
transmit.exe-251C5485.pf in c:\windows\prefetch   and
isetup.exe=id7fce0c.pf in c:\windows\prefetch

I cannot run unlocker because the file can't be found.

I'm hoping that quarantining it with CFP has stopped it.

[Info-Sec]

Apparently it is a very nasty virus.

http://puretuts.multiply.com/journal/item/111      <<<some dialect in text

Whenever I search any of these files (transmit.exe and isetup.exe) all that is shown is
transmit.exe-251C5485.pf in c:\windows\prefetch   and
isetup.exe=id7fce0c.pf in c:\windows\prefetch

I cannot run unlocker because the file can't be found.

I'm hoping that quarantining it with CFP has stopped it.

Very very odd.  It seems that they are infact rootkits.  I suggest you scan with the following:  (make sure you enable antirootkit in the scanning)

*Avira free
*Avast! free
*NOD32 with advanced heuristics and make sure antirootkit is on

NOTES:  Do not have more then one antivirus installed at a time
If you already have an antivirus installed currently boot into safe mode then scan
If you feel the executable is at bay (COMODO keeping it from running) then don't do anything

[Goose18]

here is Avast Anti Rootkit scanner. I suggest you run it also. It is currently a beta product but i haven't had any bugs with it so i will still suggest running it.

[martin11ph]

NOTES:  Do not have more then one antivirus installed at a time
If you already have an antivirus installed currently boot into safe mode then scan
If you feel the executable is at bay (COMODO keeping it from running) then don't do anything

The IT in a certain company told me that version 2.6 of Nod32 can detect this, I currently have 3.0.642 installed. Although the virus is at bay thanks to Comodo, I don't want to keep blocking it and be wary every time I attach a
flash drive. Before I do any changes to my antivirus, I would like to know which one is the best option.

[Info-Sec]

The IT in a certain company told me that version 2.6 of Nod32 can detect this, I currently have 3.0.642 installed. Although the virus is at bay thanks to Comodo, I don't want to keep blocking it and be wary every time I attach a
flash drive. Before I do any changes to my antivirus, I would like to know which one is the best option.

I think NOD32 is, but you can install Avast! with only the scanner module and it wont conflict with nod32.

[martin11ph]

Thanks a lot Info-Sec!

Also, I just ran F-Secure just to be sure. Nothing seems to be out of the ordinary.

Computer name: SQUARE-EF598D9A
Scanning type: Scan system for malware, rootkits
Target: C:\
Result: 1 malware found
Tracking Cookie (spyware)

    * System

Statistics
Scanned:

    * Files: 25169
    * System: 3618
    * Not scanned: 7

Actions:

    * Disinfected: 0
    * Renamed: 0
    * Deleted: 0
    * None: 1
    * Submitted: 0

Files not scanned:

    * C:\HIBERFIL.SYS
    * C:\PAGEFILE.SYS
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Options
Scanning engines:

    * F-Secure USS: 2.30.0
    * F-Secure Hydra: 2.8.8110, 2008-03-21
    * F-Secure AVP: 7.0.171, 2008-03-23
    * F-Secure Pegasus: 1.20.0, 2008-02-20
    * F-Secure Blacklight: 1.0.64

Scanning options:

    * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
    * Use Advanced heuristics


I am just wondering why those 7 are not scanned. Is it normal?

[Info-Sec]

Thanks a lot Info-Sec!

Also, I just ran F-Secure just to be sure. Nothing seems to be out of the ordinary.

Computer name: SQUARE-EF598D9A
Scanning type: Scan system for malware, rootkits
Target: C:\
Result: 1 malware found
Tracking Cookie (spyware)

    * System

Statistics
Scanned:

    * Files: 25169
    * System: 3618
    * Not scanned: 7

Actions:

    * Disinfected: 0
    * Renamed: 0
    * Deleted: 0
    * None: 1
    * Submitted: 0

Files not scanned:

    * C:\HIBERFIL.SYS
    * C:\PAGEFILE.SYS
    * C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
    * C:\WINDOWS\SYSTEM32\CONFIG\SAM
    * C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
    * C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
    * C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Options
Scanning engines:

    * F-Secure USS: 2.30.0
    * F-Secure Hydra: 2.8.8110, 2008-03-21
    * F-Secure AVP: 7.0.171, 2008-03-23
    * F-Secure Pegasus: 1.20.0, 2008-02-20
    * F-Secure Blacklight: 1.0.64

Scanning options:

    * Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX ANI AVB BAT CMD JPG LSP MAP MHT MIF PHP POT SWF WMF NWS TAR
    * Use Advanced heuristics


I am just wondering why those 7 are not scanned. Is it normal?

Prob running files.  It is normal for not every file to be scanned. 

[martin11ph]

Is there an option to install only the scanner module with avast? I already downloaded Avast Home Edition 4.7.1098.80207 but haven't installed it yet.

[Info-Sec]

Is there an option to install only the scanner module with avast? I already downloaded Avast Home Edition 4.7.1098.80207 but haven't installed it yet.

Ok, when you run the installer, make sure yout hit 'custom' installation, then it will eventually come to a screen where you can choose what modules you want installed.  Uncheck everything except Avast!

Then after you install avast and restart.  Run that installer previously mentioned in this thread, that will give it the antirootkit capability.

[martin11ph]

Err...maybe I downloaded newer version of what you want me to use. Here is the window for the custom install.

http://i307.photobucket.com/albums/nn296/martin11ph/untitled.jpg

[Goose18]

Uncheck all of the Resident protection. Instant messaging, Web Shield, P2P Shield, Internet Mail, Outlook/exchange, Web Shield and Standard Shield. We just want Avast to be a on demand scanner. Installing them would give it real time protection which is not needed since you have Nod32. Hope this helps some.

[Info-Sec]

Uncheck all of the Resident protection. Instant messaging, Web Shield, P2P Shield, Internet Mail, Outlook/exchange, Web Shield and Standard Shield. We just want Avast to be a on demand scanner. Installing them would give it real time protection which is not needed since you have Nod32. Hope this helps some.

Yep.  Then after you do that apply the beta patch, then update your program, install latest signatures, restart then scan.

[martin11ph]

Thanks to you both. Do I need this avast Virus Recovery Database?

Yep.  Then after you do that apply the beta patch, then update your program, install latest signatures, restart then scan.

The beta patch here you mean is Avast Anti Rootkit scanner right?

[Tags:]