Vundo,Rundll32 and other Malware Problems

Hello,

I was recommended to your site from a friend when I started experiences computer issues. Last week I was having a hard time going on the internet and doing any processes on the computer. My friend has helped me do all the steps in the run & read me file and now I would like to make sure everything looks good because I have had issues for awhile now.

The "windows update" (was malware) symbol is finally gone and is not stopping my processes, however my Norton bar is checked on IE but there is nothing on it anymore and I am not sure about a couple things.

I have attached all the logs for your review. (this and the next post)
Thank you for any help you can give and for already helping me thus far.

 

Next Logs

 

Hi Danimal33,
Welcome to Major Geeks!

You still have quite a bit of malware on your computer. Please use your computer as little as possible and avoid unnecessary reboots until one of us can look through your logs and post a set of instructions to you. This takes some time, so thanks for being patient.

abri

 

Hi Danimal33,

Please do the following:


1) Please go to Start / Run and type in msconfig. In the window that opens up, put a checkmark next to normal system start, click on accept and okay.

2) Install the current version of Sun Java from: Sun Java Runtime Environment

3) If you do not use Windows Messenger (not to be confused with MSN Messenger!!) I would like you to run Disable/Remove Windows Messenger


4) Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (Note: if using Vista, don't double click, use right click and select Run As Administrator). Select Do a system scan only). In the box that opens, find the following entries and put a checkmark next to them (if you need some of them to be in the trusted zone, leave them). After check-marking them, close all your open browser windows and click on FIX:

O2 - BHO: (no name) - {13CE19F2-39A3-45D2-B362-69044CC4FE6B} - C:\WINDOWS\system32\urqOGxwW.dll (file missing)
O2 - BHO: {f4bf6a7a-ec73-921a-b214-2e8bcee9a1ef} - {fe1a9eec-b8e2-412b-a129-37cea7a6fb4f} - C:\WINDOWS\system32\kxvbglei.dll (file missing)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


Do you need for the following programs to load at startup? If not, please fix them as well.

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

After you click fix, just close hijackthis.



5) Download and install Erunt. Use it to create a backup of your registry.

6) Please copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the File Type is set to "all files" Once you have saved it, look for it on your desktop and when you find it, double-click it and allow it to merge with the registry.

7) Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the 'Execute' button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

8) Now run CCleaner at the default setting with the Windows tab as the top one.

9) Please run C:\MGtools\GetLogs.bat and attach the fresh MGlogs.zip along with the Avenger or Combofix log, whichever we used.


Let me know how things are running now?

abri

 

Hi Abri, after using avenger and the reboot started i got a window on the startup that said

Windows- No Disk


X Exception Processing Message c0000013 Parameters 75b6bf7c 4 75b6bf7c 75b6bf7c

 

Hi, Things seem to be ok but I still have a few glitches
1. when I go on the internet on IE in the menu and links bar I am supposed to have a Norton bar that is for phishing, has my identidy login and my identidy passwords to get on my websites. I right click in the tool bar area and click on the show norton toolbar, but when I click on it the area it is supposed to be in, its just blank. Phishing does not work even though it is clicked to on position in norton. I cant sign in to my password protect sites.

How can I get this back on, because norton is keeping all my passwords stored but will not respond when on any password type websites.

 

Hi I had trouble get on this site last night but all good now. For the question about the norton toolbar that is the one I am talking about. In the manage add on's it is clicked on enabled so I dont know why that is not working.

2. I also have been having problems with my computer rebooting itself for no reason. It has happened about 4 times in the last couple of days and it woke me up this morning at 4:30 am when my computer went from standby mode and turned on and rebooted itself.

3. Also in my shutdown mode for my computer which is set to automatically shut down doesn't seem to work at all. My settings for my shutdown when I am on desktop I right click desktop then properties and under the screensaver tab I have None selected for screensaver then under the power button in that same screensaver tab setting I click on that power settings button.
(a.) On that screen the power scheme is set to Always on.
Power scheme settings are
(b.) Turn off monitor is set to turn off in 10 minutes
(c.) Turn off hard disks is set to Never.
(d.) System standby is set to turn off at 25 minutes
(e.) System hiberate is set at to hibernate at 2 hours.

When I let my computer just sit to let it shut down on it's own the monitor will turn off in the 10 minute time period which it does but it will never go into standby mode and will not hibernate. Neither of those functions seem to work it has only worked a couple of times and that was last week. I just started using the power mode a couple of months ago for the first time and only the monitor would turn off everything else stayed on. Like I said it worked a couple of times but now it will not shutdown properly.
The only way that it goes into standby mode is if I click the start munu and manually click the standby mode which then it will shut down and then it will go into hibernation.

How can I get those settings to work for me so I can just leave my computer alone and it will take care of itself on shutdown and not to get it to reboot by itself for no reason.

Thank you so far for everything and all your help. Everything else has been working pretty good so far except those couple of glitches I have here.

 

So far everything seems to be running great, the help you gave me was just the best. I would like to thank chaslang and abri for all there help keep up the good work and thanks again.


Danimal33

 

Hi, sorry I haven't gotten back to you sooner I was on vacation.
Do I have to uninstall these programs because I would like to keep them on my computer for anything in the future may I need it.

Thank you again Danimal33

 

Hi there, I have uninstalled the items suggested such as avenger hijack this. I cannot get the combofix to delete through the start run way that you explained. When I put in "%userprofile%\Desktop\cf" /u in the run box it says windows cannot find C:/Documents and settings/HP_Administrator/Desktop/cf I did create combofix on my desktop so where do I go from here to get rid of combofix. Also do i need to get rid of Erunt. I did see a Erunt Registry in my add or remove programs do I remove that also?

Thank you Danimal33

 

Hi, chaslang that worked just great and uninstalled the combofix and also answering my next question about the erunt. That seems to answer everything unless there is something else I need to do just let me know

 

Yes I did everything and seems great. I did run malwarebytes yesterday and it did find a vundo which i removed. Did you need a log for that? if not and you think everything seems right after completing the steps you gave me I am good with everything am seems to work pretty good. I cant express enough how great you guys were in helping me and have told a few friends about your site for which now they are hooked.

Thanks Major Geeks and Chaslang

 

here is the log also since I have uninstalled all the programs sucsessfully my computer is rebboting itself anytime it wants weather I am in a program or on the internet do you know why that is happening?

Thank You Danimal33

 

I uninstalled all the ones listed except super anti spyware because i am going to purchase that program the other programs are gone.

As for the Start Run proceedure it says under the properties
Date: 06-20-08
Source: Service control manager
Time: 12:53pm
Type: Error
Event ID:7206

The following boot-start or system-start driver(s) failed to load:
ftsata2
for more info go to http://go.microsoft.com/fwlink/events.asp.
I am not sure if that letter is a G or a Q in the web address.
When I clicked on the link this is what it gave me below.


Details
Product: Windows Operating System
ID: 7026
Source: Service Control Manager
Version: 5.0
Component: System Event Log
Symbolic Name: EVENT_BOOT_SYSTEM_DRIVERS_FAILED
Message: The following boot-start or system-start driver(s) failed to load: %1

Explanation
The specified drivers did not load correctly. The driver might not be in the expected location.


User Action
Do all of the following:

Verify that the drivers are configured correctly.
Verify that the computer is running the most current version of the drivers.



Version: 5.2
Symbolic Name: EVENT_BOOT_SYSTEM_DRIVERS_FAILED
Message: The following boot-start or system-start driver(s) failed to load: %1

Explanation
The specified drivers did not load correctly. The driver might not be in the expected location.


User Action
Do all of the following:

Verify that the drivers are configured correctly.
Verify that the computer is running the most current version of the drivers.


Currently there are no Microsoft Knowledge Base articles available for this specific error or event message. For information about other support options you can use to find answers online, see http://support.microsoft.com/default.aspx.

There Where also the 3 other errors at that same time of 12:53pm
Event ID:7203
The IPSEC Services service terminated with the following error:
the authentication service is unknow and that also had the same microsoft weblink.

Event ID: 7000
The MCSTRM service failed to start due to the following error:
the system cannot find the file specified.

Event ID: 7000
The Nsynas32 service failed to start due to the following error:
the system cannot find the file specified.

 

HI I tried to send the log but it tells me it exceeds the 250 kb and the log is 400 something kb.

Also it is saving the log as an *.evt file but i also made it as text too.

 

Hi there, well here is the log.
I don't have a windows cd i have windows xp media center and it came with no cd of that sort.

I checked the ftsata2.sys and it is not in the C:\windows\system32\drivers folder.

I guess my next stop is the hardware section in the forum.

 

Hi chaslang,
Hey thank you very much for all your help with the malware issues. Everything is running good on the antivirus stuff. Great job.
Well it looks like I need to go to the hardware forum. You said that you would send me over to the hardware section with the problems that I am having now. Do you have someone in mind that willl help me?
I did post a thread in the forum earlier today but got no replies as of yet.

 

Hi there I uninstalled everything except superantispyware because i purchased that one aslo I kept malwarebytes search and destroy and added Avg Antivirus. Did some more scans today and malwarebyes found 1 item ans S&D found 2 and I removed the one file but kept the other which was a microsoft windows security center antivirus overide plus S&D found Quite a few other things when I went into the recovery part of S&D. I attached some logs of those scans I did today.

 

Thanks for the info on the autoexec.bat I no longer have that file I did a search and it found it in the D drive and says its a MS-DOS batach file. When I click on the file it gives a warning that D:\autoexec.bat is not a valid Win32 application. That's about all I can give you on that one.

 

Got the file and put in notepad and there is nothing in the file it shows 0kb. It is blank.