Tech Support Forum banner
Cancel
Create thread New Forums
Status
Not open for further replies.

C:\WINDOWS\system32\kavo0.dll02909537 W32/Lineage.HZB.worm

Jump to Latest
2.3K views 1 reply 2 participants last post by  Rahina  
Z
#1 ·
Dear Technical Support

My computer has been acting weird. I can't seem to open my CDrive by jus double clicking on it.It will prompt me to choose a program to open my CDrive.
Usually, i can do it by just double clicking on it.
So i hope you could help me by solving my problem
Thanks

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-04-20 10:33:10
PROTECTIONS: 1
MALWARE: 9
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
AVG 7.5.524 7.5.524 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.casalemedia.com/]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.casalemedia.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.doubleclick.net/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Cookies\mr_smith@doubleclick[1].txt
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.atdmt.com/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.tribalfusion.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[ad.yieldmanager.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\mr smith\Application Data\Mozilla\Firefox\Profiles\c5i7xyus.default\cookies.txt[.questionmarket.com/]
02909536 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\Documents and Settings\mr smith\Local Settings\Temp\i7.dll
02909537 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\WINDOWS\system32\kavo1.dll
02909537 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\WINDOWS\system32\kavo0.dll
02909537 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP65\A0020207.dll
02909537 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020178.dll
02909537 W32/Lineage.HZB.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020191.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020177.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP65\A0020208.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020164.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020156.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\WINDOWS\system32\tavo0.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\WINDOWS\system32\tavo1.dll
02915477 Trj/Lineage.BZE Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{FC65ADED-CC41-4C81-8205-DE77C9416CE2}\RP64\A0020185.dll
;===================================================================================================================================================================================
SUSPECTS
Sent Location #
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description #
;===================================================================================================================================================================================
;===================================================================================================================================================================================
 
#2 ·
Hello! :wave:

1. Please download Malwarebytes' Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Double-click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • If you have trouble with the update process, please download the latest updates here.
  • Double-click the mbam-rules.exe file on your desktop and let it update the application.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart. (see extra note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Please copy and paste the entire report in your next reply. :)
Extra note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

====================

2. Please download Deckard's System Scanner (DSS) and save to your Desktop.
alternate download site

DSS will do the following:
  • Create a new System Restore point in Windows XP and Vista.
  • Clean your Temporary Files, Downloaded Program Files, Internet Cache Files, and empty the Recycle Bin on all drives.
  • Check some important areas of your system and produce a report for me to analyze.
  • Automatically run HijackThis. It will also install and place a shortcut to HijackThis on your desktop if you do not already have it installed. So if HijackThis is not installed and DSS prompts you to download it, please answer yes.
You must be logged onto an account with administrator privileges when using.
  • Close all applications and windows.
  • Double-click on dss.exe to run it and follow the prompts.
  • If your anti-virus or firewall complains, please allow this script to run as it is not
    malicious.
  • When the scan is complete, two text files will open in Notepad:
    • main.txt <- this one will be maximized
    • extra.txt <- this one will be minimized
  • If not, they both can be found in the C:\Deckard\System Scanner folder.
  • Please copy (Ctrl+C) and paste (Ctrl+V) the contents of main.txt and extra.txt in your next reply.
-- When running DSS, some firewalls may warn that it is trying to access the Internet especially if your asked to download the most current version of HijackThis. Please ensure that you allow it permission to do so.
-- If you get a warning from your anti-virus while DSS is scanning, please allow DSS to continue as the scan is not harmful.

====================

3.
In your next reply please post:

- C:\Deckard\System Scanner\Main.txt
- C:\Deckard\System Scanner\Extra.txt
- Malwarebytes log.
 
Save
Like Like
Status
Not open for further replies.
You have insufficient privileges to reply here.
Tech Support Forum
posts
4.8M
members
966K
Since
2002
A forum community dedicated to tech experts and enthusiasts. Come join the discussion about articles, computer security, Mac, Microsoft, Linux, hardware, networking, gaming, reviews, accessories, and more!
Full Forum Listing
Explore Our Forums
Windows 7 , Windows Vista Support Motherboards, Bios|UEFI & CPU Networking Support Hard Drive & SSD Support PC Gaming Support