MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 01-17-12, 09:01
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Ramnit Virus and Blueinit Trojan - have they really gone?

Hi everyone,

I did a Malware Bytes scan yesterday and found my computer was infected with the Ramnit Virus as well as Blueinit Trojan and Trojan.Downloader. I scanned twice with MBAM (a quick scan and a full scan) then did a system restore to a month ago from Safe Mode. This seemed to sort out the problems with browser redirects and Chrome refusing to initialise but then I came across this forum and did some reading about Ramnit and how serious it is. I followed your malware removal guide and also did two ESET scans. The programs removed and quarantined some files and the logs are below. I haven't added Super Anti Spyware as all it found were tracking cookies.

ComboFix.txt

eset.txt

mbam-log-2012-01-16 (11-31-17).txt

mbam-log-2012-01-16 (12-32-16).txt


ESET, MBAM and Norton are now saying my computer is clear of threats but my question is, given the seriousness of Ramnit, can I be sure that my computer is completely safe?

Many thanks for any advice.
Reply With Quote
Sponsored links
  #2  
Old 01-17-12, 09:04
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Posting again to attach my MGlogs files.

MGlogs.zip
Reply With Quote
  #3  
Old 01-17-12, 09:18
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Run the online ESET scan twice more back to back and attach the logs.

Using ESET's Online Scanner
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #4  
Old 01-17-12, 16:38
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Thank you for the quick reply. I've scanned twice more with ESET and it found no threats. It doesn't give a log when it is clean so nothing to attach. Does this mean I'm definitely clear of it? Thanks again!
Reply With Quote
  #5  
Old 01-18-12, 17:38
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Well, it's looking good yes.


Java(TM) 6 Update 23
<--- Uninstall outdated Java.

delete these if you do not know what they are for.

C:\Users\Trish\AppData\Local\fnuwwvli.log
C:\Users\Trish\AppData\Local\hcetwvdb.log


I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run


Please also download MBRCheck to your desktop
  • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
  • It will show a Black screen with some information that will contain either the below line if no problem is found:
    • Done! Press ENTER to exit...
  • Or you will see more information like below if a problem is found:
    • Found non-standard or infected MBR.
    • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
  • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
catface (01-18-12)
Sponsored links
  #6  
Old 01-18-12, 19:04
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Still looking good

Uninstalled Java and deleted those files. TDSS didn't find anything neither did MBRCheck. MBRCheck_01.19.12_00.00.02.txt.

Thanks again for your help
Reply With Quote
  #7  
Old 01-18-12, 19:38
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Quote:
TDSS didn't find anything
Would still like to see the log if you don't mind. And you are most welcome.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
  #8  
Old 01-21-12, 16:00
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Sorry for the delay in replying. Here's the log: tdsskillerreport.txt
Reply With Quote
  #9  
Old 01-22-12, 12:53
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Java(TM) 6 Update 23 <--- uninstall outdated Java.

Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

Another scan with MBAM... if all clean follow the below steps.


If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required (If we renamed it please rename it back to Combofix.exe.
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
catface (01-25-12)
  #10  
Old 01-23-12, 09:19
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Hmmm - I had already uninstalled two out of date versions of Java when you told me to earlier via Control Panel. I'm not seeing anything to uninstall on my Add/Remove programs list. Should I just go ahead and install the most up to date version, or do I need to completely get rid of this old version and, if so, how do I do it as I can't do it via Control Panel?

Many thanks
Reply With Quote
Sponsored links
  #11  
Old 01-23-12, 18:33
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Sorry, that was my bad, just get the latest version installed if not already.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
catface (01-25-12)
  #12  
Old 01-25-12, 07:04
catface catface is offline
Private E-2
 
Join Date: Jan 2012
Posts: 7
Thanks: 3
Thanked 0 Times in 0 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

That's all done, thanks again Kestrel and everyone on this helpful site.

I noticed this thread http://forums.majorgeeks.com/showthread.php?t=252347 - I was getting the same 'do you want to run this program?' messages popping up only I clicked yes as I was stressed and just wanted to get on with my work. I only did something about it when I started getting browser redirects I know, I know, that was seriously stupid and I actually do know better. I will not be so stupid in the future, I was really lucky not to have to reformat my computer.

Anyway, the reason I'm pointing that thread out to you is that I'm not sure if it's OK for me to post in other people's threads and they may have the same version of Ramnit as me that is actually possible to get rid of. Here's hoping!
Reply With Quote
  #13  
Old 01-25-12, 18:19
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 29,122
Thanks: 1,004
Thanked 3,786 Times in 3,687 Posts
Default Re: Ramnit Virus and Blueinit Trojan - have they really gone?

Yes, the warning about Ramnit still applies to you. It looks like you got very lucky, some people do. Keep an eye on things.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
Reply

Tags
blueinit, ramnit

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Ramnit.H Virus Congyz Malware Removal 4 11-14-11 14:24
Ramnit A & H virus nessundio Malware Removal 3 06-01-11 13:14
Ramnit A + H.virus rkane3000 Malware Removal 43 05-22-11 22:26
Ramnit Virus Removal woodchopper88 Malware Removal 16 02-28-11 20:24
Netbook problems, Ramnit trojan(and who knows what else!) :oS kduck Malware Removal 2 10-01-10 14:24


All times are GMT -5. The time now is 23:12.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger