Stubborn virus

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by ergeek, Nov 4, 2010.

  1. ergeek

    ergeek Private E-2

    Hello Virus Fighters,

    I have cleaned quite a few systems successfully using your procedures here. However I have run up against one that is being quite stubborn.

    OS = Windows XP Pro. This system was not connecting to the internet via IE (could ping), and could not get to Windows Update so updates were way behind. I ran through the procedures here. Everything seemed fine. So I updated Windows, installed Comodo Firewall and then Microsoft Security Essentials (my preferred AV) and was ready to send it back to the owner (wasn't going to post because everything seemed fine).

    Then Microsoft Security Essentials started finding "Backdoor:Win32/Hupigon.DZ" - but when I asked it to clean it does not get rid of it.

    Attached are the logs.... Thank you for any help!

    Susan
     

    Attached Files:

  2. ergeek

    ergeek Private E-2

    Mglogs
     

    Attached Files:

  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there and welcome. I am currently reviewing your logs and will get back to you with a set of instructions in the next post I make to you.
     
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Let's see if this gets it.

    Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode!!

    If you did not deliberately set this proxy yourself then please include it in the HJT fix below:

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix exit HJT.

    Delete these avg remnants:
    • c:\documents and settings\alm\Application Data\AVG10
    • c:\documents and settings\All Users\Application Data\AVG10
    • c:\documents and settings\All Users\Application Data\MFAData

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::
    
    DirLook::
    c:\windows\system32\DRiVeRs
    Driver::
    MediajCenters
    qicsvont svcto
    TOM serv
    ykvnyqmr
    yplhtlgh
    ystemstores
    Dir
    dss
    his service ned
    MediamCenterbr
    tart serverlt
    Windows Storage Service v2.0
    NetSvc::
    TOM serv
    File::
    c:\windows\system32\qicsvont.exe
    c:\windows\system32\Dir.exe 
    c:\windows\hfdfile.exe
    c:\windows\system32\bvvema-Service.exe
    c:\windows\system32\woss.exe
    c:\windows\system32\tedtis sevir.exe
    C:\WINDOWS\temp\TMP000~1
    2010-11-03 c:\windows\Tasks\ParetoLogic Registration.job
    c:\windows\Tasks\ParetoLogic Registration3.job
    c:\windows\Tasks\ParetoLogic Update Version2.job
    c:\windows\system32\DRiVeRs\urgcbf.rxr
    c:\windows\system32\DRiVeRs\iywghi.rxr
    Folder::
    c:\program files\Symantec AntiVirus
    c:\program files\Common Files\ParetoLogic
    Registry::
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "AvgUninstallURL"=-
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ykvnyqmr]
    [-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\yplhtlgh]
    RegLock::
    [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (Administrator)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
       d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,9e,db,a6,4f,1f,bd,4c,aa,08,4b,\
    "6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
       d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1e,9e,db,a6,4f,1f,bd,4c,aa,08,4b,\
    
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
    @DACL=(02 0000)
    "Installed"="1"
    
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
    @DACL=(02 0000)
    "Installed"="1"
    "NoChange"="1"
    
    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
    @DACL=(02 0000)
    "Installed"="1"
    
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      [​IMG]

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Please also download MBRCheck to your desktop

    • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
    • It will show a Black screen with some data on it
    • Right click on the screen and select > Select All
    • Press Control+C
    • Open a notepad and press Control+V
    • now please ATTACH that report to this thread

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

    Tell me how things are running now? :)
     
  5. ergeek

    ergeek Private E-2

    Hello Kestrel13! !

    Thank you very much for your assistance.

    I followed your post and the logs are attached. Now when I run MSE, it finds "Trojan:DOS/Alureon.A" Alert level severe. I did not let MSE clean this yet, but it then said it automatically removed it (actually did it while I was typing this!).

    The system seems to be running fine. I'll reboot and scan again with MSE to see if it finds it again.

    Sorry about the msconfig - I had set that and then forgot I disabled some HP stuff with CCleaner. It should be good now.

    Thanks again !!

    Susan
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes let me know! And show me exactly what and where it is finding it.

    Delete this folder using windows explorer.

    • c:\windows\system32\DRiVeRs\Avg

    I need you to download and install Registrar Lite (Screenshot included of how we want to go about this)

    Now using the program navigate to the following key, click on it:

    HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost

    In the right pane, if you see any of the following keys you will need to right click and delete them:
    • cplhtl
    • meiynz
    • ystemstores

    Let me know how you get on. Then:

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
     

    Attached Files:

  7. ergeek

    ergeek Private E-2

    Ok, I made the registry edits and ran another MSE scan and it finds the same problem - Trojan:DOS/Alureon.A" Alert level severe (full finds it, quick does not).

    Here are the details:


    Category: Trojan

    Description: This program is dangerous and executes commands from an attacker.

    Recommendation: Remove this software immediately.

    Microsoft Security Essentials detected programs that may compromise your privacy or damage your computer. You can still access the files that these programs use without removing them (not recommended). To access these files, select the 'Allow' action and click 'Apply actions'. If this option is not available, log on as administrator or ask the local administrator for help.

    Items:
    file:C:\Qoobox\Quarantine\MBR_HardDisk0.mbr

    Thank you again!!
     

    Attached Files:

  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    This is just something caught up in combofix's quarantine folder, when you follow final steps it will no loner be detected.

    Run combofix again by double clicking it's icon.

    Then:
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.
     
  9. ergeek

    ergeek Private E-2

    Ran combofix again, attached MGlogs and also the combofix log just in case.

    Running another MSE scan now....

    Thank you!!
     

    Attached Files:

  10. ergeek

    ergeek Private E-2

    And MSE just found the same file again.....
     
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What, the one I explained was in Combofix's quarantine folder? Like I said, that will be gone when you follow final steps. Speaking of which, how are things running now because those logs look good. :) Let me know.
     
  12. ergeek

    ergeek Private E-2

    Ok, sorry - I get it! Everything is running fine!
     
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    That's good to hear!

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  14. ergeek

    ergeek Private E-2

    Kestrel13! thank you very much for all the prompt excellent help! It is truly appreciated!!

    I am now returning the clean system to its owner (where hopefully they will follow instructions to keep it clean!)

    Susan
     
  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    ... *most* welcome. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds