Haxdoor Strikes Again

In the past I have encountered the Haxdoor Variant Virus and defeated it with spysweeper, but now a new variant is out, and spysweeper does detect it, but upon delete it cannot prevent it from returning. I am on windows 2000 pro jus for basic 411, but here r the details and some links.
=================================================================
Attempts for Removal:
1.) HijackThis 1.99.1 logs it as: O20 - Winlogon Notify: avpu32 - C:\WINDOWS\SYSTEM32\avpu32.dll
However upon delete it returns as it is a autorun Registry value.

2.) Xoftspy 4.15 Build 109 logs as: <SW NAME = "Haxdoor"><FILE NAME = "C:\WINDOWS\system32\ps.a3d"/> <FILE RES = "C:\WINDOWS\system32\ps.a3d Successfully ReMoved"/>
However when rescanning it comes back up.

3.) Webroot Spy Sweeper 4.0.3.405 Detects and Removes Haxdoor, However it returns also when removed.
=================================================================
Links:
1.) http://securityresponse.symantec.com...haxdoor.e.html
The one I have is a variant of Haxdoor E (E = avpx32.dll not avpu32.dll)

2.) http://www.kephyr.com/spywarescanner...es/index.phtml
read the post Highconvert.com - 17 Aug 2005
=================================================================
Ports Opened:
1.) Opens back door TCP ports 17986, 39340, and 16661.
Active Ports 1.4 verifies this.

=================================================================
Registry Value in question:
1.) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32
(deleted but comes back after deleted)
=================================================================


:( HELP ME PLEASE !!!!!!!!!!!!!!!

Just curious if the MS Antispyware Beta removes this pest for you?

I have not tried that yet, but it could be worth a shot. thanks I will let you know how that works out.

MS spy did not detect the regostry key, but it did manage to mess up my IE browser. NOw whenever I click on home page set about:blank it crashes and i get error, and windows updates crashes my browser as well even after i reinstalled IE. I do not recommend IE ant-spy it simply sucks.

wow it even managed to mess up my yahoo and msn i can't even get on MSN or yahoo now thanks a lot for the MS antispy recommendation. next time please don't suggest crap for software.

can't even get into hotmail now without IE crashing. this is just great. MS - Anti-Spyware really did a number on me

wow that was scary luckily i fixed it by reinstalling ms anti spy and restoring browser stuff.
now back to haxdoor

Have a look at 'edit' button on top of the post. Keeps things a helluva lot neater.

Anyway, have you been scanning and fixing in safe mode ? If you don't everything you undo can be done again . . .

this virus prevents me from updating my windows updates. after i download all the security updates from microsoft it tells me that it is unsuccessful in installing them.

hesperus look I already combatted this virus in the past the problem does not lie within safe scanning or editing posts to be neat it lies within undetected traces of virri instructing the reg key to autorun, not to be rude or anything but if u don't know what ur talking about please don't comment on the issue. stop speculating. thanks.

If I was you, I would download ad-aware along with the latest update, boot to safe mode (per hesperus' advice) and try it. You have nothing to lose. At worst, it will just come back and you will have proved me and hesperus wrong.

Also, a few questions:

What leads you to believe this registry key is the key in question? HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpu32

How do you know it "autoruns"?

When does the key come back? Immediately after deletion? Or after reboot?

Have you tried searching on google for Haxdoor? The first link looks interesting...

And finally two suggestions:

1. Stop using IE (Mozilla, Netscape, or Opera will do on Windows machines)
2. I would strongly suggest to be curteous to other AO members, especially when they are trying to help you.

-ik

You are right, I replied too fast with 'safe mode', but you should be doing this anyway.

This is a rootkit, not just spyware. Have you tried any rootkit tools ? Here are two that may dig a little deeper than regular spyware detectors :

Quote:

---

Most of these detectors require quite a bit of technical skill to interpret the results but one of the simplest to use and most effective is also free. It's called BlackLight [1] and is currently available as a free beta from F-Secure until the 1st of October 2005. I suggest everyone download this product and scan their PC. The chances of you being infected are small but for five minutes work it's not worth taking the risk. BlackLight will detect most rootkits missed by AV scanners but can still be fooled by state-of-the-art rootkits like Hacker Defender. To detect this and a few other insidious rootkits, you need heavier artillery. Currently the biggest gun in the rootkit detection war is a free Chinese product called IceSword [2]. It will reveal absolutely everything running on your PC. Usage, however, requires considerable skill together with the patience to work out the program which is currently only documented in Chinese. In the hands of an expert, its an amazing tool.
[1] http://www.f-secure.com/blacklight/cure.shtml Windows 2000 and later, 911KB.
[2] http://www.Xfocus.net/tools/200505/1032.html slow Chinese site, 1.5MB[

---

http://www.techsupportalert.com/best..._utilities.htm

Rooted twice ? Hmmm . . .

Good luck.

thank u all for trying to help i managed to fix it . there were 2 hidden trace files in windows\system32 folder called avpu32.sys & avpu64.sys and by using killbox i managed to prevent those 2 files from making the registry value return. I apologize to hasperous for getting out of line i was just a lil frustrated cuz i spent the past 24 hours without sleep trying to get rid of this menacing plague.

thank you both for trying to help me. problem is resolved.


by the way i will check out the rootkit software jus for kicks. lol