Infection help please

Okay let's start by working on you multiple layered Vundo infection. Please run the below tool multiple time until it come up not finding anything.

Virtumonde aka Trojan Vundo Removal

Then attach the log from VundoFix and also new logs from ShowNew and HJT so we can continue with more manual removal steps which will more than likely be necessary.

 

I just notice that you were not in Normal Startup mode. You must not use MSconfig to control any startups. See step 0 of the READ ME. Get into Normal Startup mode before you attach any new logs!

I also need a new log from GetRunKey after you are in Normal Startup mode.

 

Continue by downloading two tools we will need

- ProcessExplorer

- Pocket KillBox

Extract them to their own folder somewhere that you will be able to locate them later.

Make sure you have rebooted in Normal Mode (do not open any other processes)

Make sure that one and only one Internet Explorer browser is opened up

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe
properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of any of the below DLL files (if found) and then click the kill
button.
bvwbsbtr.dll
ddabc.dll
khfggda.dll
mljhihe.dll
pmnoppm.dll
tuvwutr.dll

After you have killed all instances of any of the above DLLs under winlogon click ok.
(If you do not find these DLLS, just continue on.)

Next double click on explorer.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
bvwbsbtr.dll
ddabc.dll
khfggda.dll
mljhihe.dll
pmnoppm.dll
tuvwutr.dll

After you have killed all instances of any of the above DLLs under Explorer click ok.
(If you do not find these DLLS, just continue on.)

Next double click on iexplore.exe and again click once on each instance of any of the below DLL files (if found) and then click the kill button.
bvwbsbtr.dll
ddabc.dll
khfggda.dll
mljhihe.dll
pmnoppm.dll
tuvwutr.dll

After you have killed all instances of any of the above DLLs under iexplore click ok.
(If you do not find these DLLS, just continue on.)

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\mljhihe.dll
O2 - BHO: (no name) - {5250B385-7A9C-410F-AB90-6D8530ABA557} - C:\WINDOWS\system32\jkkli.dll (file missing)
O2 - BHO: (no name) - {C32BC639-A29D-41C3-AE5D-9CAB66A8E41C} - C:\WINDOWS\system32\vtutu.dll (file missing)
O2 - BHO: (no name) - {C999BE53-0081-4BE6-848D-D5BFEAA16191} - C:\WINDOWS\system32\ddaya.dll (file missing)
O2 - BHO: PsapiAnalyzer Object - {CB8B69CF-31AF-40D0-A119-5A8435BC1534} - c:\windows\servicepackfiles\i386\odbctask.dll (file missing)
O2 - BHO: (no name) - {CC5806B6-9033-43A5-9F29-F10347F615Be} - C:\WINDOWS\system32\bvwbsbtr.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IESet] IExplorer.dll .dbt
O4 - HKCU\..\Run: [u7jte] C:\DOCUME~1\HDebo\LOCALS~1\Temp\crasos.exe
O4 - HKCU\..\Run: [mbrfu6dt58] C:\DOCUME~1\HDebo\LOCALS~1\Temp\crasos.exe
O20 - AppInit_DLLs:
O20 - Winlogon Notify: mljhihe - C:\WINDOWS\SYSTEM32\mljhihe.dll


After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as"
type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp
  Files.
• Then after it deletes the files click the Exit (Save Settings)
  button.

NOTE: Pocket Killbox will only list the added files it is able to find on
the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing

• CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\1174837885f877.html

C:\Documents and Settings\HDebo\Local Settings\Temp\crasos.exe
C:\WINDOWS\system32\5640.exe
C:\WINDOWS\system32\IExplorer.dll .dbt
C:\WINDOWS\system32\imuptiqd.exe
C:\WINDOWS\system32\bvwbsbtr.dll
C:\WINDOWS\system32\ddabc.dll
C:\WINDOWS\system32\khfggda.dll
C:\WINDOWS\system32\mljhihe.dll
C:\WINDOWS\system32\pmnoppm.dll
C:\WINDOWS\system32\tuvwutr.dll
C:\WINDOWS\system32\exdhmtgn.ini
C:\WINDOWS\system32\cbadd.ini
C:\WINDOWS\system32\XunLei.dll

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue
(But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.


Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

Make sure you tell me how things are working now!

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

That's because most of the items I had you fixing did not get fixed. Are you sure you carefully checked for ALL DLL file names in Process Explorer? Are you sure you clicked Fix Checked with HijackThis? Pocket Killbox failed to properly delete most of the files and some new infections now appeared.

I will need to prepare another fix, but first I want you to try manally deleting the below files. Note which ones cannot be deleted, then reboot into safe mode and try again.

C:\WINDOWS\system32\imuptiqd.exe
C:\WINDOWS\system32\bvwbsbtr.dll
C:\WINDOWS\system32\bvyqyppt.dll
C:\WINDOWS\system32\ddabc.dll
C:\WINDOWS\system32\khfggda.dll
C:\WINDOWS\system32\madproyu.dll
C:\WINDOWS\system32\mljhihe.dll
C:\WINDOWS\system32\mlljk.dll
C:\WINDOWS\system32\pmnoppm.dll
C:\WINDOWS\system32\tuvwutr.dll
C:\WINDOWS\system32\kjllm.bak1
C:\WINDOWS\system32\cbadd.ini
C:\WINDOWS\system32\exdhmtgn.ini
C:\WINDOWS\system32\kjllm.ini

Then reboot in normal mode attach a new log from ShowNew.

Is CounterSpy the free trial from the READ ME? If so please uninstall it now since we are finished with it. There is also a possibility it is blocking some of our fixes.

 

- Run Process Explorer

In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of mlljk.dll once and then click the kill button.
After you have killed all of the mlljk.dll under winlogon click ok.
(If you do not find the dll, just continue on.)

Next double click on explorer.exe and again click once on each instance of mlljk.dll and kill it.
(If you do not find the dll, just continue on.)

Next double click on iexplore.exe and again click once on each instance of mlljk.dll and kill it.
(If you do not find the dll, just continue on.)

Now just exit Process Explorer.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {55DB983C-BDBF-426f-86F0-187B02DDA39B} - C:\WINDOWS\system32\bvyqyppt.dll
O2 - BHO: (no name) - {C32BC639-A29D-41C3-AE5D-9CAB66A8E41C} - C:\WINDOWS\system32\vtutu.dll (file missing)
O2 - BHO: (no name) - {C6507AFE-22B9-48D7-988C-80FBCBF5D5F4} - C:\WINDOWS\system32\mlljk.dll
O20 - Winlogon Notify: mlljk - C:\WINDOWS\system32\mlljk.dll

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe

• select File, Cleanup, Delete All Backups
• Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
• Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\mlljk.dll
C:\WINDOWS\system32\kjllm.ini

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.

If you receive a PendingFileRenameOperations prompt, just click OK to continue (But please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.
Either way, please boot into safe mode upon reboot.

Once in safe boot mode, double check to make sure the below two files have been deleted. If not then delete them.
C:\WINDOWS\system32\mlljk.dll
C:\WINDOWS\system32\kjllm.ini

Now run Ccleaner!

Now attach the below new logs and tell me how the above steps went.

1. GetRunKey
2. ShowNew
3. HJT

 

Your logs from safe mode showed that three new files appear that must be deleted.

Delete the below files:
C:\WINDOWS\system32\msorcl32.exe
C:\WINDOWS\system32\kjllm.tmp
C:\WINDOWS\system32\kjllm.ini2


Then from normal boot mode attach the below new logs:

1. GetRunKey
2. ShowNew
3. HJT

How are things running?