RAMNIT infection

[semiartificial]

Hi,

At the weekend I discovered the laptop that is used by rest of the family has Ramnit.
After reading advice on here, I am currently running the second of three ESETScans, and will attach the logs when complete.
I am now aware that I will probably have to reinstall from scratch, however, and I wanted to check my understanding of what I should be doing in the meantime to protect myself.

1. Change passwords on a clean computer.
I'll use my work computer for this.

2. Back up pictures and any essential documents (only) to USB drive
The last backup was a few months ago so there will be a lot of these as the laptop is used to download pics from our digital cameras.
Should I keep this USB drive away from other computers, or attach it and scan it with ESETScan?

Anything else?

Thanks.

[TimW]

Ramnit infections have really become quit nasty and dangerous. We could attempt to remove it, and we have had some success in the past, but recently it has become even more trouble to remove. It is really safer to just bite the bullet and do a clean reinstall.

The problem is that the damage caused by this infection really makes a PC unreliable/untrustworthy. PE file infectors like Ramnit, Virut,.... etc can infect all executable files (DLL, EXE, SCR....and many more and also HTML). These infections can open back doors that truly may compromise your computer and your security. These backdoors could allow a remote attacker to access and instruct the infected computer to download and execute more malicious files.

In many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus or by other scanning tools. Also when disinfection is attempted, the files often become corrupted and the system may become unstable or irrepairable. The longer Ramnit remains on a computer, the more files it may infect and/or corrupt so the degree of infection can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies the Ramnit worm using a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are a major source of system infection.

So all the above being said, and please do take serious note of the warnings, do you really wish to attempt cleaning even though the stability and security of your be cannot be guaranteed? And also note that we could spend a lot of time trying to fix it and still fail due to the number of files that have been infected. What would you like to do?

We will know better about the condition once you attach the eSet scan results.

[semiartificial]

Here are the ESETScan files.
There are four because number three was interrupted (by my son accidentally touching the trackpad while reading the 'do not touch' notice I put on the PC!).
The fourth seems to have the same result as the third in any case.
I was quite tempted to navigate to the file xniikgwo.exe and delete it, but decided to leave the laptop alone and await further advice.
Thanks for your time.

[TimW]

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to delete:
C:\Users\Matthew\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xniikgwo.exe

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now re-run eSet and attach both the new log and the log from running Avenger/

Now download the latest version of MGtools and save it to your root folder. Run the exe.

Then attach the below logs:

* C:\MGlogs.zip

[semiartificial]

I've attached the Avenger log.

ESET stated no threats, so no log to attach.

When I attempted to save MGtools.exe to C:, I got this message:

C:\MBtools.exe
You don't have permission to save in this location.
Contact the administrator to obtain permission.
Would you like to save in the Dad folder instead.

[semiartificial]

Sorry, on further investigation, the problem with putting MGtools on C: was due to user account control.
It stopped me from putting another file on C:\, but this time it gave me an option to continue and give myself permission.
I was then able to download MGtools.
I also had to run MGtools a second time, as the first attempt was constantly interrupted by user account control on Vista (which I disabled and have subsequently re-enabled).

MGlogs.zip is attached as requested.
Thanks for your continuing help with this.

[TimW]

Looks like you dodged the bullet and got it in time. Your logs are clean, however, you need to clean out these folders:
C:\Windows\Temp\
C:\Users\Dad\AppData\Local\Temp\

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
     
     
   
   
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
   
   
10. After doing the above, you should work thru the below link:
    
    • How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

[semiartificial]

Tim,

I've followed these processes, ran a few extra scans, changed my AV software to Microsoft Essentials ... no further problems.

In view of the warnings about this virus, I did consider a format/rebuild but eventually decided against it.
It was almost certainly my son Matthew who inadvertently assisted the virus, and he was surfing on a standard Vista account.
I'm hoping that this is the reason why we were able to clean it out, and I'm hoping that the lack of admin privileges has prevented any backdoors etc.

Thanks for all your help with this.

[TimW]

You are most welcome, and as I said, you caught it in time.