Missing Hosts File

Did you update MalwareBytes before running a scan? It should've been able to remove "Volcano Security Suite".
Anyway Combofix should take care of it, just attach the log.


You can also restore MS default Hosts file.
Download the HostsXpert 3.7 - Hosts File Manager.
http://www.funkytoad.com/download/hoster.zip

Unzip HostsXpert 3.7 - Hosts File Manager to a convenient folder such as C:\HostsXpert 3.7 - Hosts File Manager
Run HostsXpert 3.7 - Hosts File Manager from its new home
Click "Make Hosts Writable?" in the upper right corner (If available).
Click "Restore Original Hosts" and then click OK.
Click the X to exit the program.

I am attaching the combofix amd malware bytes logs. The malwarebytes is from the first scan I did which was a quick scan. I then updated again and ran a full scan and 2 items were found.

OH, yeah, almost forgot, the same batch of IP addresses still show up in HJT.

I ran the Hosts File Manager.and got an error message saying it could not create the hosts file. I am attaching the hosts file and the current hijackthis log. There is also an lmhosts file which I am attaching.

When fixing entries in Hijackthis make sure that all windows are closed except hijackthis before you click the "Fix checked' button.

Run combofix again using this script.

1. Open Notepad.
2. Now copy/paste the bolded text between the lines below into the Notepad window:
------------------------------------------------------------------------
Folder::
C:\documents and settings\Brian\Application Data\Volcano Security Suite
c:\documents and settings\All Users\Application Data\VSSSys

------------------------------------------------------------------------
3. Save the above as CFScript.txt in the same location as Combofix.exe.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

That Combofix log you posted is the result of the second run... did Combofix deleted any bad files on its first run?

Here's the writeup on Volcano Security Suite at Bleepingcomputer.
http://www.bleepingcomputer.com/virus-removal/remove-volcano-security-suite#files

I only ran combofix once.

Ran combofix again and am attaching log file. No chance in HJT log.

I didn't see your latest post sorry.

Combofix had deleted those folders.
When you fix those 01 entries they still come back?


Can you please run Gmer and RootRepeal to see if there are hidden drivers that CF is not seeing.

1.  Download the GMER Rootkit Scanner. Unzip it to your Desktop.
http://www.gmer.net/gmer.zip

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
Click NO
In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.



2. Download RootRepeal from the following location and save it to your desktop.
Zip Mirrors: (Recommended)
http://rootrepeal.googlepages.com/RootRepeal.zip
http://ad13.geekstogo.com/RootRepeal.zip

Rar Mirror:
http://ad13.geekstogo.com/RootRepeal.rar

Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.
Click the "Report" tab.
Click the "Scan" button.
Check all seven boxes:

o Drivers
o Files
o Processes
o SSDT
o Stealth Objects
o Hidden Services
o Shadow SSDT

Push Yes
Check the box for your main system drive (Usually C:), and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the "Save Report" button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

OK here are the log files you requested.

I also ran smitfraudfix and a registry repair tool. After repairing the registry the desktop shortcut for Volcano Security Suite was gone but combofix still finds it as an active antivirus. When I check all the O1 entries to be fixed by HJT the are right back again on the next scan.

OK, I treid something else while waiting for your analysis. I opened HJT and went to Mics. Tools. I clicked on "Open Hosts File Manager." It showed the path where my hosts file is supposed to be but it isn't there. It also listed all the rogue ip addresses. When I click on one and tried to delete it the message is that the hosts file is locked for reading and can not be edited.

So even making the Hosts writable still no joy?

Thanks for the logs, the log shows all legit entries and it doesn't tell me if any files are patched so I'm 'no wiser'.

Can you please run this tool, OTL.exe

Download OTL to your Desktop
http://oldtimer.geekstogo.com/OTL.exe
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Under the Custom Scan box paste the below bolded text in

netsvcs
%SYSTEMDRIVE%\*.exe
%SYSTEMDRIVE%\eventlog.dll /s /md5
%SYSTEMDRIVE%\scecli.dll /s /md5
%SYSTEMDRIVE%\netlogon.dll /s /md5
%SYSTEMDRIVE%\cngaudit.dll /s /md5
%SYSTEMDRIVE%\sceclt.dll /s /md5
%SYSTEMDRIVE%\ntelogon.dll /s /md5
%SYSTEMDRIVE%\logevent.dll /s /md5
%SYSTEMDRIVE%\iaStor.sys /s /md5
%SYSTEMDRIVE%\nvstor.sys /s /md5
%SYSTEMDRIVE%\atapi.sys /s /md5
%SYSTEMDRIVE%\IdeChnDr.sys /s /md5
%SYSTEMDRIVE%\viasraid.sys /s /md5
%SYSTEMDRIVE%\AGP440.sys /s /md5
%SYSTEMDRIVE%\vaxscsi.sys /s /md5

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy the contents of these files..

And also Win32KDiag.exe
Please download this tool and run it.
http://ad13.geekstogo.com/Win32kDiag.exe

Double-click on Win32Diag.exe to run it.
A black command prompt window shall appear.
It will now begin to scan. This may take a while, please be patient until the scan is complete.
Once it's done, in the black screen it will say "Finished! Press any key to exit....
A log file called Win32KDiag.txt will be created on your desktop.
Please copy and paste the contents of that log file here in your next reply please.

Can not download OTL.exe. McAfee recognizes it as a trojan and then I get a message "Cannot copy OTL[1] Access is denied. Here is the win32diag log though.

I went into the recovery console and did a "dir" on the C:\WINDOWS\System32\drivers\etc folder and there is a hosts fils and a hosts.txt file there. The hosts file has a size of 5912 and its attributes are -arhs---. I tried to delete it but I gor the Access Denied message.
This same file does not appear when in Windows going to the same directory.

I got the hosts file to show up by unhiding system files and all of those IP addresses are in it. I can't change the file or delete any entries. I get the Access denied message.

McAfee is just false positively flagging OTL as a trojan... you would then need to turn off McAfee's shield.

Did you also remove its attributes before you tried deleting Hosts file?
attrib -h -r -s

I was denied access when I tried to delete from the recovery console and from Windows. I was was unable to change the attributes - message that the parameter was incorrect. Do I need to type the whole path - C:\WINDOWS\System32\drivers\etc\hosts?

<<<"Do I need to type the whole path - C:\WINDOWS\System32\drivers\etc\hosts?">>>

I expect you would, unless you're already in the directory -->C:\WINDOWS\System32\drivers\etc
then you don't need to.

attrib -h -r -s Hosts

By the way, running Combofix supposed to also reset your hosts file. So something is strange here... are you able to do an online scan? if so an onlline scan with Kaspersky might be a good idea to check for any patched file.

Try Symantec's trojan.qhosts removal tool http://www.symantec.com/security_response/writeup.jsp?docid=2003-100312-1206-99

Kapersky's online scan found nothing and the qhosts removal tool didn't find anything rither. As for changing the attributes, I have tried nearly every combination imaginable to try and get that done with no success. What is the command if I am in C:\WINDOWS?

You can delete your Hosts file without using Recovery Console.. i deleted mine via XP's command prompt.

So If you're already in C:\Windows>
then your next command would be:

cd system32\drivers\etc

then remove the attributes using the command below:

attrib -r -h -s hosts

and you shouldn't get the 'access denied' error
then delete the hosts

del hosts

I opened a command prompt window and had to change the directory from C:\Documents and Settings\Brian to C:\Windows and then to C:\Windows\system32\drivers\etc. When I tried to use the command attrib -r -h -s hosts the response was Access denied - C:\Windows\system32\drivers\etc\hosts. So I trier going back to C:\Windows\system32\drivers\etc. and using the del hosts command and the response was COuld not find C:\Windows\system32\drivers\etc\hosts.

I checked another system and the hosts file is not read only but the parent folders are.

Maybe the Hosts file had been deleted.

At the command prompt, when you're in that directory:

C:\Windows\system32\drivers\etc>

type the dir command and if the Hosts file exists it will be listed like below:

C:\WINDOWS\system32\drivers\etc>dir
Volume in drive C has no label.
Volume Serial Number is 90EC-5860

Directory of C:\WINDOWS\system32\drivers\etc

31/10/2009  03:26 PM    <DIR>          .
31/10/2009  03:26 PM    <DIR>          ..
31/10/2009  03:26 PM               698 HOSTS
18/08/2001  10:30 PM             3,683 lmhosts.sam
18/08/2001  10:30 PM               407 networks
18/08/2001  10:30 PM               799 protocol
18/08/2001  10:30 PM             7,116 services
              5 File(s)         12,703 bytes
              2 Dir(s)  12,098,486,272 bytes free

C:\WINDOWS\system32\drivers\etc>

Good job...  then you can use HostsXpert to restore MS default Hosts file.

Or you can use Winhelp2002 customized hosts file that blocks major parasites and hijackers.
http://www.mvps.org/winhelp2002/hosts.htm