Vundo.gen! virus - How I removed it

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by margetc, Jun 21, 2008.

?

Was this helpful

  1. Yes - It cleared my problem

    0 vote(s)
    0.0%
  2. Yes - I tried but still have problem

    0 vote(s)
    0.0%
  3. No - I tried but still have problem

    0 vote(s)
    0.0%
  4. No - total waste of time

    0 vote(s)
    0.0%
  1. margetc

    margetc Private E-2

    Hi,
    My first post so I apologise if this is the wrong place or not the correct protocol. However, as I have used MG for a long time as a great resource, I thought it about time I shared something I found to be of use.

    I had been trying to rid myself of the Vundo trojan for a few days and I was just about to go through the process identified in MG prior to submitting HJT logs etc - I'm not a techy so I was putting it off.

    Anyway, I thought I'd try one last thing before resorting to HJT etc - I downloaded the 90 trial of Windows Live OneCare. I followed the steps, did the scans and, fingers crossed, I've not had one annoying pop-up window advertisement since.

    To conclude: prior to doing the Windows Live OneCare thing I had removed my sun java, I had installed and run ComboFix and I had run a scan using my previously loaded trial McAfee.

    Anyway, as I said, my apologies if this is the wrong place but I hope others may find my experience of use.

    All the best,
    :)
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    If you had a true Virtumonde infection (especially the current form - there are many forms), then more than likely you are still infected and should complete the READ & RUN ME and attach all of the logs. Window Live OneCare will not find and fix all components of Virtumonde. You were definitely helped along by ComboFix since it will help somewhat with Vundo but even it often leave quite a lot behind. Vundo has always required additional manual cleaning to get everything removed and the more recent forms a much much worse than the old forms which are trivial by todays standards.
     
  3. margetc

    margetc Private E-2

    Hi Chas,
    Thanks for the comments. I think you might be right. I just ran HJT and there are a couple of "no name" enrties such as
    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file), and "file missing" enrties such as O20 - Winlogon Notify: hgGXrPhi - hgGXrPhi.dll (file missing).

    From my previous research it seems like these type of entries were related to virus problems.

    I will have a go at the READ & RUN.

    Thanks once again.
     
    Last edited: Jun 22, 2008
  4. margetc

    margetc Private E-2

    Hi Chas,
    Well, I've now managed to followthe READ & RUN procedure and I have the log files - this reply and the next (more than 3 files).
    I'd be very grateful if you/someone could take a look and advise if I need to take any further action.

    Thanks once again.
    Chris
     

    Attached Files:

  5. margetc

    margetc Private E-2

    The remaining logs.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looks like you are in pretty good shape. We only have some minor cleaning to do. You must have caught the infection early enought to keep it from spreading too much.

    First you need to disable Spybot's Teatimer as requested in the READ & RUN ME. See this: How to disable Spybot's TeaTimer


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O20 - Winlogon Notify: hgGXrPhi - hgGXrPhi.dll (file missing)

    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.


    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  7. margetc

    margetc Private E-2

    Hi Chas,
    Thanks for the instructions.
    I remember un-checking Teatimer so I don't know why it was still selected.

    Anyway, I ran C:\MGtools\analyse.exe but I could not see : O4 - HKCU\..\Run: [SpybotSD TeaTimer]

    Also the O2 and O3 entries were all named so I selected the two that had the same registry codes as those in your instructions :
    {AA58ED58-01DD-4d91-8333-CF10577473F7}
    {2318C2B1-4965-11d4-9B18-009027A5CD4F}

    I noticed when I selected Fix that one of the comments was "file not found" or something similar - it flashed past pretty quickly.

    I did everything else - the fixme.reg said it was successful.

    I've attached the files as requested plus the HJT log as displayed prior to Fix.

    Thanks again,
    Chris

    PS I'm assuming your name is Chas from your ID - please accept my apologies if its not.
     

    Attached Files:

  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Your logs are clean.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\cf" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  9. margetc

    margetc Private E-2

    Hi Chas,
    Thanks for the latest instructions.
    Fingers crossed that all is fine now. I followed the instructions and have a couple of questions if you would be so kind.

    As you may remember, I have Windows Live OneCare free 90 day trial installed. I also use Windows Defender along side it. I downloaded Online Armor Personal Firewall and this automatically disabled Windows Firewall.
    Q. Do I need an AntiVirus tool and AntiSpyware tool as well as Windows Live OneCare?
    Q. Do I need SpyBot and SpywareBlaster also?

    Thanks again,
    Chris

    PS No doubt I will revert to the other free AV tools when OneCare expires.
     
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Windows Defender is rather poor (as noted in the How to protect link) on Windows XP. So you really should consider better protection when you 90 trial expires. You cannot install any other antivirus program while still having Windows Live OneCare installed.

    Yes keep these installed. Enable all protection with SpywareBlaster, and for Spybot only use the SDHelper (called the bad download blocker) and the Immunize feature which you should run after you get updates. Always keep these updated by checking for updates at least weekly. Spybot used this way provides some protection from bad websites and does not cost you much in the way of system resources as it is not running until you run a scan to look for malware. It will serve as a secondary scanner for you. Malwarebytes also serves the same way and finds many nasty things that Spybot will not find or remove. You should keep Malwarebytes installed and updated.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds