Trojan Horse Win32/PEPatch.AO

I need some guidance. Here is the story:
Win XP 'puter
missing the explorer.exe file due to ....??? It was causing me to only see the wallpaper at startup. NO icons, NO task bar. This was rectified. I now have full access to the desktop and task bar.(thanks to Nihil and others on the Operating system topic area.)
System is running AVG 8.0.
Now for the problem. AVG is detecting the above trojan in resident shield scan but it is always attached to a valid process. AVG only gives me the option to Ignore it also. I have run Spybot S&D, Malwarebytes Malware scan, AVG, and Hijackthis.
Spybot and MWB both caught things but did not solve the problem.
I thought of this afterwards and did not try it. But, everytime i would run a different virus/*ware scan, the AVG resident shield would detect the trojan. Everytime it would only allow me to ignore. Everytime it was attached to a valid process (in each case, the process was the virus/*ware scanner that I was running at the time. If i disable the Resident shield, then run the scans, will that clear it? or am I dealing with a special case. I cannot seem to find much info on it.
Thanks in advance for the help.
Len Q.

Dump AVG and install Avira AntiVir in its place. AVG's not what it used to be.

edit - try running Killbox to end any rogue process: http://killbox.net/

edit #2 - disable System Restore and empty ALL temp folders (you may need
to toggle Folder Options to make some visible). Also search for any recently
datestamped .exe's, .tmp's, .dll's and .~'s (null) files. Delete those, backup
if necessary.

Have you managed to get hold of an XP installation CD for the same version and SP as the one on the infected machine?

If so try running this: SFC.EXE /SCANNOW

Windows should then replace corrupted/infected system files.

I would also get CCleaner and run it to clear out rubbish.

http://www.ccleaner.com/

Also try using its registry cleaner to get rid of malware remnants.

Follow brokencrow's advice and then re-scan in safe mode.

You might also try scanning with this:

http://www.emsisoft.com/en/software/free/

In safe mode the interactive scan should be turned off by default. You should only be scanning with one tool at a time for best results. ;)

Yes i have a copy of the install disk. I ran:
sfc /scannow
This is the first time i have run this program. Is something supposed to happen afterward? It ran but i did not see any change or difference. no addititional windows popped up or anything.
i will do what brokencrow suggests and let everyone know.
nihil, i will also try ccleaner and emisoft to see what happens.

We are getting closer to getting this blasted thing fixed.
Len

Hi Len,

I believe that you need to reboot afterwards.

All you would expect to see is a progress bar. If you don't get that you can make a registry amendment:

Quote:

---

When you run scannow at logon you do not get a progress bar... This can easily be remedied by adding a new DWORD: SFCShowProgress to the registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
the values available are: 0 = disabled, 1 = enabled

---

It still works with or without the progress bar :)

I would also think about downloading and installing SP3.

Going from bad to worse. Finally got back to this computer. Someone turned it off and now it will not even boot. It keeps restarting right after the Windows Xp screen. They are just going to buy a new one at this time. They want a laptop anyway.
Still going to try to clean this one up though. install disk, repair, etc. We shall see what happens.
Len

Format and reinstall is the fastest and best way to cure

MLF

Quote:

---

Originally Posted by morganlefay

Format and reinstall is the fastest and best way to cure

MLF

---

I agree. You have been fighting this thing for quite some time now... I realize a reformat/reinstall can take a few hours, but that is nothing compared to the time you have invested/will invest in this.

Very true. When you are dealing with a trojan or badly infected machine then a reinstallation is the preferred method.

I generally use DBAN (Darik's Boot & Nuke) or Eraser to do a one pass wipe (Vista will do this with a full format) before re-installation.

You might also look at creating a slipstreamed CD/DVD of the OS to save having to download service packs and updates. Try nLite or vLite.

Quote:

---

Originally Posted by raven955i

Going from bad to worse. Finally got back to this computer. Someone turned it off and now it will not even boot. It keeps restarting right after the Windows Xp screen.

---

Sounds like it's got hardware issues too. It's not unusual to run into
3-4-5-year-old PC's that haven't been serviced and come in with numerous
issues. We used to call that restarting 'rolling reboots' and most often
fixed it by running "chkdsk /r c:" from the command prompt. Might
give that a try if you're desperate enough.




OK, nihil, you can bash me now for reco'ing chkdsk. :eek:

Heh!

Quote:

---

OK, nihil, you can bash me now for reco'ing chkdsk.

---

I have nothing against chkdsk. I am just cautious as to when I use it rather than a manufacturer's diagnostic toolset.

Basically, chkdsk is intended to fix Windows file problems. If you suspect that you have a physical hardware problem then chkdsk can do more harm than good and won't provide a long term solution.

In fact I have just run it on this machine....................but I didn't believe that anything I or my hardware did took out half the town's power supply for twenty minutes :D

Actually, I've taken your critique of chkdsk to heart after noting that
some drives I wasn't fixing by running it seemed to make things worse.
I've been using SpinRite more frequently now, though it typically takes
longer. I have noted mfg'ers diags are not entirely reliable (but neither
is something like SpinRite).

My first line of action on any bad drive is to boot a Live CD (linux) with
a usb drive of varying sizes to recover/backup existing data. Sometimes
it's ironic how users react to a computer gone bad: first they think they're
out a PC, then they think about data.

Having said all that, half the time I see rolling reboots, chkdsk marks
those bad sectors and the thing works. For how long is another question.
Most hardware is just junk so if chkdsk doesn't fix it, you're only out the
data.

Hi brokencrow,

There really isn't any hard and fast rule is there? What I do is pretty much a judgment call based on experience and things like noises, smells, lags etc.

Incidentally, there is a new release of memtest 86 (February 2009) which I think is the first in almost 2 years?

http://www.memtest86.com/download.html

Whilst you are at it you might have a look at this newer version called Memtest 86+ ("Advanced Memtest")

http://www.memtest.org/

There is even an M$ tool:

http://oca.microsoft.com/en/windiag.asp

I just thought I would mention it as I frequently find that HDD and RAM problems are pretty interchangeable as culprits :)

Quote:

---

Originally Posted by nihil

There really isn't any hard and fast rule is there? What I do is pretty much a judgment call based on experience and things like noises, smells, lags etc.

---

Touchē. Thanks for the heads up on the new tools.