Rewdulon trojan, anybody know how to get rid of it?

Fuelman · Mar 14, 2013

I went through the entire malware removal setup and thought it was gone but it poped up again and cant seem to dispose of it.

My Avira keeps coming up with :

C:\program files(x86)\windowsGames\iexplore.exe contains: BDS/Rewdulon.A.142

Any help appreciated
Thank you.
Brian

chaslang · Mar 16, 2013

Fuelman said: ↑

I went through the entire malware removal setup
Click to expand...

Okay so where are the logs we requested? We need the logs inorder to provide support.

Fuelman · Mar 19, 2013

sorry Chaslang, been working out of town and not had my personal laptop with me, since I posted till now.

Trying to attach logs now.

chaslang · Mar 19, 2013

Okay! You still need to attach the C:\MGlogs.zip file requested from running MGtools. Also a copy should be on your Desktop too.

Fuelman · Mar 20, 2013

MG Logs attached hopefully

chaslang · Mar 24, 2013

Please download OTM by Old Timer and save it to your Desktop.

Run it by double clicking on it (Note: if using Vista, Win7, or Win8, don't double click, use right click and select Run As Administrator).

Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
(or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
the code box
Code:
:Processes
explorer.exe

:Services
Bandoo Coordinator
IEPro
KService
 
:Files
C:\ProgramData\46BD61B78C7BA048000046BD1AFFA57C
C:\Program Files (x86)\WindowsGames
C:\Users\brian\Desktop\Disk Antivirus Professional.lnk
C:\Users\brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Disk Antivirus Professional
C:\Users\brian\AppData\Local\Temp\*.*
:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9D425283-D487-4337-BAB6-AB8354A81457}"=-
:Commands
[purity]
[EmptyTemp]
[start explorer]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
) and choose Paste.

Now click the large button.

If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.

Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

the C:\_OTM\MovedFiles log

C:\MGlogs.zip

Make sure you tell me how things are working now!

Fuelman · Mar 27, 2013

I couldnt figure out how to attach the first file so I copy and pasted it here, hope thats not an issue. MGLogs in attachment.
Thank you for your help Chaslang.
.... and yes, havnt gotten tthat popup since it ran.

Fuelman

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== SERVICES/DRIVERS ==========
Error: No service named Bandoo Coordinator was found to stop!
Service\Driver key Bandoo Coordinator not found.
Error: No service named IEPro was found to stop!
Service\Driver key IEPro not found.
Error: No service named KService was found to stop!
Service\Driver key KService not found.
========== FILES ==========
C:\ProgramData\46BD61B78C7BA048000046BD1AFFA57C folder moved successfully.
C:\Program Files (x86)\WindowsGames\TempFiles folder moved successfully.
C:\Program Files (x86)\WindowsGames folder moved successfully.
File/Folder C:\Users\brian\Desktop\Disk Antivirus Professional.lnk not found.
File/Folder C:\Users\brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Disk Antivirus Professional not found.
C:\Users\brian\AppData\Local\Temp\AdobeARM.log moved successfully.
C:\Users\brian\AppData\Local\Temp\aipflib.log moved successfully.
File move failed. C:\Users\brian\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
C:\Users\brian\AppData\Local\Temp\LManager.log moved successfully.
C:\Users\brian\AppData\Local\Temp\LMworker.log moved successfully.
C:\Users\brian\AppData\Local\Temp\StructuredQuery.log moved successfully.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C04B7D22-5AEC-4561-8F49-27F6269208F6}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: brian
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 31642595 bytes
->Flash cache emptied: 700 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1062114 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 5278656 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67496 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 36.00 mb

OTM by OldTimer - Version 3.1.21.0 log created on 03272013_181826

Files moved on Reboot...
C:\Users\brian\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\dsiwmis.log scheduled to be moved on reboot.
File C:\Windows\temp\TMP00000008E4CAF1FEA27EB65E not found!
File C:\Windows\temp\TMP0000000980C8EE8A03F1A608 not found!

Registry entries deleted on Reboot...

chaslang · Mar 31, 2013

You're welcome.

Fuelman said: ↑

I couldnt figure out how to attach the first file
Click to expand...

Same way as other attachments.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Go back to step 4 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Rewdulon trojan, anybody know how to get rid of it?

Fuelman Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

RKreport[2]_S_03072013_02d0731.txt

QuarantineReport (2).txt

mbam-log-2013-03-09 (09-06-26).txt

HitmanPro_20130305_1009.log

mbam-log-2013-03-05 (09-40-33).txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Rewdulon trojan, anybody know how to get rid of it?

Fuelman Private First Class

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Fuelman Private First Class

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches