Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
Hello again Geri! Thank you for the help last time in thread: Virtumonde trouble
It was for that reason that I have comeback again with another problem!
That reason I never followed up on your previous post last time is because I was never able to get either of the online scanners to work, and tried them both now and again for weeks and both kept crashing and what not on me.
Anyway, as of today it seems the Virtumonde has come back. Not as malicious as last time, but I have been getting some annoying popups and such today. I have run both Spyware Doctor and Ad-Aware and both deleted a lot of ****, but Spyware Doctor detected some Virtumonde files that it was unable to fix/delete. Can you help me with this?
Here is the DSS main file:
_______________________
Deckard's System Scanner v20071014.68
Run by Jordan on 2008-10-10 16:40:42
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Percentage of Memory in Use: 79% (more than 75%).
-- HijackThis (run as Jordan.exe) ----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:41:20 PM, on 10/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Hi Blitzkrieg
Welcome back.
Stick with me on this one until you get the all clean from me.
Ok please do this in the order given.
Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.
Double click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan', then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.
Close all open programs and windows
Double click combofix.exe and follow the prompts.
Vista users right click Combofix.exe and select Run As Administrator.
When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
Memory Processes Infected:
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{998dae3e-7d4f-4952-a71f-467d8fe64407} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkjyvpj (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{998dae3e-7d4f-4952-a71f-467d8fe64407} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcpgmj0ej85 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\rhcpgmj0ej85 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explo rer\Run\csrcs (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\jkkJyVPj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcccbBSI.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nnnkKDuv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqmucbmv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wgoahfxr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sgksdehl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\byXRhEXP.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ljJbXpQj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\CTSN93HJ\upd105320[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\UG7EJPH1\file[1].exe (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\Temporary Internet Files\Content.IE5\XA0WGV59\nd82m0[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Application Data\Adobe\Player.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\BM8b4a583c.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSS3f66.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSd94a.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSdce4.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\TDSSdd7e.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\smchk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\pwrmgr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\sft_ver1.1454.0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jordan\Local Settings\temp\myconfig.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.
_______________
ComboFix 08-10-10.09 - Jordan 2008-10-11 18:16:37.1 - NTFSx86
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;
Filename: CFScript.txt
Save As Type: All Files (*.*)
Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.
NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.
Hold down the Shift key and insert your flash drive. (USB thumb drives)
It is important to hold the shift key while plugging in flash drive so the virus does not run and re-infect system.
Double-click Flash_Disinfector.exe to run it.
Follow any prompts that may appear.
Your desktop will vanish for a while, and then reappear. This is normal.
Wait until the program has finished scanning, then please exit the program.
Repeat this step if you have more than one flash drives.
Update your Java.
Please download JavaRa and save the file to your desktop.
Right click and Extract All
Once extracted, open and run JavaRa.exe
Click Search For Updates
Select Update Using jucheck.exe
Click Search
If a newer version is found, allow it to be installed
Uncheck the Google Toolbar option. (if you don't want the Google tool bar)
When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed
When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go
Exit the tool when complete.
Read and then You can delete the gpl-2.0.txt file.
The Java update wouldn't work due to a server being down or something, I tried a couple of times and it kept getting an error in the same place. I shall try again later.
___________
ComboFix 08-10-10.09 - Jordan 2008-10-12 12:43:28.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.608 [GMT 11:00]
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jordan\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
Click on “Accept” If your pop –up blocker blocks any windows from opening.
Click Run on the window that opens. Windows Vista users you must open the web browser using the Run as Administrator command.
The program will launch and then begin downloading the latest definition files:
Under Scan on the left side.Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
I finally got the Java to update, but as was the problem last time, the online scanner would not work for me. I was able to use the other online scanner that you suggested last time though, here are the results:
;************************************************************************** *************************************************************************** ******************************
ANALYSIS: 2008-10-20 10:47:17
PROTECTIONS: 1
MALWARE: 25
SUSPECTS: 0
;************************************************************************** *************************************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;========================================================================== =========================================================================== ==============================
Kaspersky Anti-Virus 8.0.0.357 Yes Yes
;========================================================================== =========================================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;========================================================================== =========================================================================== ==============================
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Application Data\Mozilla\Firefox\Profiles\j595b8md.default\cookies-1.txt[.atdmt.com/]
00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Cookies\jordan@clickbank[1].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Jordan\Cookies\jordan@searchportal.information[1].txt
00366244 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Jordan\Desktop\virus ****\Flash_Disinfector.exe[C:\Documents and Settings\Jordan\Desktop\virus ****\Flash_Disinfector.exe][nircmd.exe]
00390780 W32/Sohanat.FP.worm Virus/Worm No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP710\A0105826.exe
00394756 Bck/SDBot.LYF Virus/Trojan No 1 Yes No C:\WINDOWS\system32\mem.exe.tmp
00394756 Bck/SDBot.LYF Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP708\A0105749.exe
00394780 W32/IRCBot.CFI.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP715\A0111332.exe
00394780 W32/IRCBot.CFI.worm Virus/Worm No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP714\A0111273.exe
00396707 Bck/Bifrose.BHA Virus/Trojan No 0 Yes No C:\WINDOWS\system32\cftmem.exe
00410913 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0119995.dll
00411026 Adware/SpywareNo Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121023.exe
00411261 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121028.exe
00411271 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121025.exe
00411281 Adware/VistaAntivirus Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121027.exe
00411533 Trj/Agent.JZG Virus/Trojan No 1 Yes No C:\WINDOWS\system32\MediaCodec.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094756.EXE
01895148 Malicious Packer SecRisk No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0117799.dll
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094745.sys
02970484 Trj/KeyStroke.B Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP643\A0092671.exe
03310100 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP646\A0094734.dll
03310100 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\kbltomae.dll.vir
03738686 Generic Malware Virus/Trojan No 0 No No C:\Documents and Settings\Jordan\Desktop\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03834121 Generic Trojan Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121032.dll
03834627 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121030.exe
03839851 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP728\A0125158.sys
03843122 Adware/RogueAntimalware2008 Adware No 0 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP723\A0121022.exe
03894793 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP722\A0119996.dll
;========================================================================== =========================================================================== ==============================
SUSPECTS
Sent Location
;========================================================================== =========================================================================== ==============================
;========================================================================== =========================================================================== ==============================
VULNERABILITIES
Id Severity Description
;========================================================================== =========================================================================== ==============================
;========================================================================== =========================================================================== ==============================
Highlight and copy the contents of the code box below and paste it into a blank Notepad, then save it to your desktop as;
Filename: CFScript.txt
Save As Type: All Files (*.*)
Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Click here to see how to use CFScript.txt
Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.
Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
After a few attempts it worked for me. I kept on getting prompt boxes come up with the following messages:
"C:\32788R22FWJFW\pv.cfexe is not a valid Win32 application"
&
"C:\ComboFix\pv.cfexe is not a valid Win32 application"
I pressed the ok button through many of those interuptions, and after a few attempts, I had success. Here is the log:
ComboFix 08-10-19.03 - Jordan 2008-10-20 16:40:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.605 [GMT 11:00]
Running from: C:\Documents and Settings\Jordan\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jordan\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\system32\cftmem.exe
C:\WINDOWS\system32\MediaCodec.exe
C:\WINDOWS\system32\mem.exe.tmp
.
/wow section not completed
((((((((((((((((((((((((( Files Created from 2008-09-20 to 2008-10-20 )))))))))))))))))))))))))))))))
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
Click Start > Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing any infected files there as well.
Please check and verify that C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.
We need to turn off and on system restore. There are infections in it and by using system restore you would reinfect yourself.
You must be logged in as an Administrator to do this. If you are not logged in as an Administrator, the System Restore tab will not be displayed.
Turning off System Restore will clear out all previous restore points.
To turn off Windows XP System Restore:
NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.
To turn on Windows XP System Restore:
1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK
6. Make a new restore point.
7. Click Start, All Programs, Accessories, System Tools, System Restore.
Choose Create a restore point and clicked Next, Under “Type a description for your restore point…”put a name in the box,. Click Create. In the next window click Close.
Run ATF Cleaner, Make sure you do the Firefox instructions also.
I forgot to mention, everytime I start up windows, I get this prompt:
"Windows cannot find 'csrcs.exe'. Make sure you typed the name correctly, then try again. To search for a file, click the start button, and then click search."
Hi
OK the Kaspersky scan looks good., Just a cookie showing.
Please do this.
Please backup your registry using ERUNT before proceeding to any of the steps.
Download ERUNT from Derfisch or Aumha and save it to your desktop.
Use the setup program to install ERUNT on your computer
Click ERUNT.Setup.exe to install ERUNT and backup your registry.
Uncheck the "Create NTREGOPT desktop icon” box.
In the window that comes up to Create an ERUNT entry to the Start up folder select No.
By Default the backup location is C:\windows\erunt\ (current date)
Click OK to continue with the registry backup.
If the folder does not exist then let ERUNT create the folder for you by clicking Yes
You should see a progress bar when ERUNT is backing up the Windows Registry.
After ERUNT has completed the Windows Registry backup. Click OK to exit ERUNT
Now do this.
Open “Notepad” Copy the contents of the code box below to the blank Notepad.
Click "File" > "Save as"
In the "Save In" box at the top click the down arrow and select DeskTop
In the “File name” type in: fix.reg
In the “Save As Type” select: All Files
Once saved, Go to your desktop double click “fix.reg file” and let it merge with the registry.
