Core.cache.dsk

[Ravi]

Unwanted ad-popups while opening IE.

Almost ran all kind of tools and scans, with MS tech.

Detecting a suspecious file Core.cache.dsk in system32\drivers.

While checked in the internet found it can cause this kind of issues.

Unable to delete the file using any force delete tools.

Anyone got any idea??? What the file is about ??

-Rav

 

[David H. Lipman]

From: "Ravi" <ravi.shankar.kgr@hotmail.com>

| Unwanted ad-popups while opening IE.
|
| Almost ran all kind of tools and scans, with MS tech.
|
| Detecting a suspecious file Core.cache.dsk in system32\drivers.
|
| While checked in the internet found it can cause this kind of issues.
|
| Unable to delete the file using any force delete tools.
|
| Anyone got any idea??? What the file is about ??
|
| -Rav
|



Download and execute HiJack This! (HJT)
http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Create a HJT log file and post it in one of the below locations...

{ Please - Do NOT post the HJT Log here ! }

Forums where you can get expert advice for HiJack This! (HJT) logs.

NOTE: Registration is REQUIRED in any of the below before posting a log

Suggested primary:
http://www.thespykiller.co.uk/index.php?board=3.0

Suggested secondary:
http://www.bleepingcomputer.com/forums/forum22.html
http://castlecops.com/forum67.html

Suggested tertiary:
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.atribune.org/forums/index.php?showforum=9
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://forum.networktechs.com/forumdisplay.php?f=130
http://forums.maddoktor2.com/index.php?showforum=17
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.spywareinfo.com/index.php?showforum=18
http://forums.techguy.org/f54-s.html
http://forums.tomcoyote.org/index.php?showforum=27
http://forums.subratam.org/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.malwarebytes.org/forums/index.php?showforum=7
http://makephpbb.com/phpbb/viewforum.php?f=2
http://forums.techguy.org/54-security/
http://forums.security-central.us/forumdisplay.php?f=13


--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[Milo]

you better do it in safe mode only to delete such and one more thing the core
file comes with a brother... delete such first before deleting the dsk.

--
Milo



"Ravi" wrote:

> Unwanted ad-popups while opening IE.
>
> Almost ran all kind of tools and scans, with MS tech.
>
> Detecting a suspecious file Core.cache.dsk in system32\drivers.
>
> While checked in the internet found it can cause this kind of issues.
>
> Unable to delete the file using any force delete tools.
>
> Anyone got any idea??? What the file is about ??
>
> -Rav
>
>
>

 

[Ravi]

Thanks Milo,
We tried to delete from the safe mode, still no effect.
when u say brother file for dsk, any way to find it....

RAv

"Milo" <connojara@yahoo.com> wrote in message
news:806BB279-755C-4068-A76A-D5DD06B7B8A9@microsoft.com...
> you better do it in safe mode only to delete such and one more thing the
> core
> file comes with a brother... delete such first before deleting the dsk.
>
> --
> Milo
>
>
>
> "Ravi" wrote:
>
>> Unwanted ad-popups while opening IE.
>>
>> Almost ran all kind of tools and scans, with MS tech.
>>
>> Detecting a suspecious file Core.cache.dsk in system32\drivers.
>>
>> While checked in the internet found it can cause this kind of issues.
>>
>> Unable to delete the file using any force delete tools.
>>
>> Anyone got any idea??? What the file is about ??
>>
>> -Rav
>>
>>
>>

 

[David H. Lipman]

From: "Ravi" <ravi.shankar.kgr@hotmail.com>

| Thanks Milo,
| We tried to delete from the safe mode, still no effect.
| when u say brother file for dsk, any way to find it....
|
| RAv
|

Undef the Rdcovery Console you wil be able to. The only qustion is there OTHER malware
still lingering and thus my suggestion.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[Milo]

Here's the technique to find the brother file arange the entire files in
drivers folder by date - see what's the file nearest and or exactly same as
core.dsk

please post here the filenames

--
Milo



"Ravi" wrote:

> Thanks Milo,
> We tried to delete from the safe mode, still no effect.
> when u say brother file for dsk, any way to find it....
>
> RAv
>
> "Milo" <connojara@yahoo.com> wrote in message
> news:806BB279-755C-4068-A76A-D5DD06B7B8A9@microsoft.com...
> > you better do it in safe mode only to delete such and one more thing the
> > core
> > file comes with a brother... delete such first before deleting the dsk.
> >
> > --
> > Milo
> >
> >
> >
> > "Ravi" wrote:
> >
> >> Unwanted ad-popups while opening IE.
> >>
> >> Almost ran all kind of tools and scans, with MS tech.
> >>
> >> Detecting a suspecious file Core.cache.dsk in system32\drivers.
> >>
> >> While checked in the internet found it can cause this kind of issues.
> >>
> >> Unable to delete the file using any force delete tools.
> >>
> >> Anyone got any idea??? What the file is about ??
> >>
> >> -Rav
> >>
> >>
> >>
>
>
>

 

[David H. Lipman]

From: "Milo" <connojara@yahoo.com>

| Here's the technique to find the brother file arange the entire files in
| drivers folder by date - see what's the file nearest and or exactly same as
| core.dsk
|
| please post here the filenames
|

Not a bad idea

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

 

[Ravi]

Thanks for the response,

there was a files named dimoo, which was created at the same date, so
deleted dimoo file and then the core.cache.dsk, we were able to get ride of
the file.
Now the IE opens without any popup.

Actually i own a netcafe, so i have the same infection on the other
computer, but dimoo file in the drivers dir, googling dimoo says its a
virtumondo, which is a malware i belv.

-Rav

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:evOiEUrbIHA.5400@TK2MSFTNGP03.phx.gbl...
> From: "Milo" <connojara@yahoo.com>
>
> | Here's the technique to find the brother file arange the entire files in
> | drivers folder by date - see what's the file nearest and or exactly same
> as
> | core.dsk
> |
> | please post here the filenames
> |
>
> Not a bad idea
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp
>
>