Vundo infection, porn links on desktop and probably more.

Hello,

A couple of days ago i downloaded a piece of software off a torrent and it got my pc all screwed up.

i got infected with the vundo trojan, had a fake security center, it added some links to porn websites on my desktop, removed the icons for mp3 avi and doc files and screwed up my Symantec Endpoint Protection 11 anti virus (since then it allways says "file system auto protect is malfunctioning", even after i tried to repair the installation).

i managed to clean part of it thanks to the malware removal guide, since i dont have the fake security center anymore, but the porn icons are stil appearing every time i reboot.

also, when i reboot i noticed on the process manager that at the same time the porn shortcuts appear there's a bunch of net.exe and net1.exe opening and closing.

and if i try to delete the porn icons they will show up again, unless i shutdown the userinit.exe and rundll32.exe processes..

im going to scan my pc again with the software recommended in the malware removal guide and i'll post all the logs when it's done.

thanks in advance.

 

combofix and mg logs attached

 

super anti spyware and malwarebytes logs attached

 

Welcome! to MajorGeeks.com!


Pre-Instructions:

1. First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.
   
2. Print out these instructions or save them to a text file so that you can operate with All Browser Windows CLOSED.

Step 1:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

Again, make sure ALL browser windows are closed when you click FIX.

Step 2:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save and save to C:\fixme.reg. Make sure you save it to C:\ or else the next step will not work thoroughly. Once you have it saved to C:\fixme.reg proceed to Step 3.

Step 3:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will pop up for you to view when you login after reboot. Please attach this log to your next post.

Step 4:
Default Security Settings

To Default Security Settings:
For Internet Explorer 6 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up navigate to the Security Tab and click Default Level for the following:

• Internet
• Local Intranet
• Trusted Sites
• Restricted Sites.

Click OK to exit.

For Internet Explorer 7 users:
Click Start > Run > type inetcpl.cpl and press ENTER, when Internet Properties comes up, navigate to the Security Tab and simply click the "Reset all zones to default level" button. Click OK to exit.

NOTE: If it's "grey" then it's already at the default level.​

Step 5:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Step 6:
Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\Avenger.txt
• C:\MGlogs.zip

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

hello again,

i followed the procedure you posted and the links still appear on the desktop everytime i login and symantec endpoint protection still has the "file system auto protect is malfunctioning" error

i posted 2 logs from avenger because it was one for each user account.

on those logs there's entries that say that he couldnt find crd and some other files, because i ran avenger once before and forgot to copy the first log, then i made a mistake and started the whole process again..

i know it removed crd and some other weird services (one of them was gtflashswitch) i had on the services control panel.

another question, i did half of the stuff in safe mode because hijackthis was crashing while doing the scan in normal mode..

should i do everything in safe mode or is it no difference?

thanks a lot for the help.

 

You should only be doing things I request exactly as I request. Doing anything else could change something on your system making my fix useless.

Let's get a new log from ComboFix. Download a fresh copy from the link below.

• http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Once downloaded, double click to run the program. Once it's complete attach the log it creates.

 

yea i know, sorry about that..

attached the log.

 

First, the file you created from Step 2 in my previous fix, locate this file and double click on it. When it prompts to merge into the registry click YES.

Next, we need to use ComboFix to remove some malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Finally, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

new log!

 

managed to fix the icons issue.

i noticed that in the boot process it would open init32.exe just before the icons appeared, so i googled for ini32.exe and found it wasnt a windows file and deleted it.

i tried rebooting after it everything was ok. anti virus working fine, no weird icons.

then i opened msconfig to check the boot process and it wasnt set for normal mode, even though i did set it before, so i put it in normal mode but now i got that log on log off loop problem, that i cant login any account, not even on safe mode..

i've been looking at some solutions to it, but all i can find is solutions that involve fixing the path on the registry to the userinit.exe file, and i checked it using remote registry, and the path is correct (c:\windows\system32\userinit.exe).

 

nevermind, userinit.exe wasnt even there..

i copied it from another pc that had the exact same installation of windows and now everything seems fine.

thanks a lot for the help