I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan....

Discussion in 'Malware Help (A Specialist Will Reply)' started by MagpieMoon, Jul 2, 2010.

  1. MagpieMoon

    MagpieMoon Private E-2

    I'm sorry to say that I am also having problems with a variant of win32/trojandownloader.unruy.BV trojan, as I've noticed someone else recently here has had. I am running Windows XP with Avast and the Windows Firewall.

    The problems started about a week ago, and I've been diligently trying to get rid of it since then. My initial problem was IE opening to ads of its own volition (I use Firefox) and my wave sound being muted. I was doing research for a paper when Avast told me the site was dangerous and I aborted the connection; shortly thereafter the problems started.

    I ran my regular programs (Avast, Spybot, AdAware) and then ramped up the removal by using MBAM and Super AntiSpyWare and elso doing an online eset scan. Avast couldn't handle the problem (which eset says is the variant listed above) because it said the program was in use (it is in my memory.) Some of the other programs didn't even pick it up. Eset contained it...until I started my computer again, and it was back. In the midst of this, I ended up with that stupid AV rogue antivirus (which came with its own host of problems,) but one of the programs seems to have done the trick getting rid of that.

    So, I came here. I diligently followed all the directions in the READ & RUN ME FIRST and the Windows XP Cleaning thread, down to the minutest step. I thought things seemed to be okay when I was done, but I haven't actually restarted my computer yet since I ran MGTools, because it doesn't instruct me to do so in that thread. I haven't had any hits from Avast or IE ads opening, but I am suddenly getting redirects in Firefox, which I wasn't until today after I finished the cleaning procedure, so something is still wrong. I've thought the thing was gone so many times in the last week, only to have it return on reboot, that I am practically terrified to turn the computer off.

    So, as for the requested logs:

    SASI log- I don't have one because it found nothing this last time I ran it.
    MBAM log- see attached
    RR log- see attached
    Combofix log- see attached
    MGtools log- see attached.

    I'm starting to get really frustrated with this- it is taking me hours and hours to try to get the stupid thing off my computer. I'd really appreciate some help. Thanks so much!
     

    Attached Files:

    Last edited: Jul 2, 2010
    MagpieMoon, Jul 2, 2010
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Welcome to Major Geeks!

    You have the "Black Internet" trojan.



    Your infection is in your Master Boot Record (MBR). We need to see the below log before creating a fix.
    • Download bootkit_remover.rar
    • Click the underlined DOWNLOAD text to download the file and save it to your Desktop.
    • You then need to extract the remover.exe file from the RAR using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can use 7-Zip
    • After extracing remover.exe to your Desktop, double click the remover.exe file to run the program.
    • Attach or post inline here, the output from remover.exe
    NOTE: The Command Prompt window text can be copied to the clip board by right clicking on the top bar of the window and using the Edit commands to Mark, Copy, and Paste.

    Your Malwarebytes log shows that you took no action. Did you fix what it found?
    Are you sure the SUPERAntiSpyware is properly updated? It should also have detected the same trojan in System Volume Information.
     
    chaslang, Jul 2, 2010
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    SUPERAntispyware recently found lots of problems on your PC. You need to attach the below logs so we can see if it was more than just cookies
    Code:
    "C:\Documents and Settings\Diane\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
Jun 27 2010  8103  "SUPERAntiSpyware Scan Log - 06-27-2010 - 15-54-27.log"
Jun 27 2010 47364  "SUPERAntiSpyware Scan Log - 06-27-2010 - 21-02-56.log"
     
    chaslang, Jul 2, 2010
    #3
  4. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    1) Thank you SO much for helping.

    2) My SAS is updated- I actually updated two times Thursday AM, and I did each time I ran it. Could it be that it was MBAM that didn't find anything? One of those two programs found nothing the time I ran it following the "READ & RUN," and I really thought it was SAS.

    3) Attached are two old (4 days) SAS logs (from before I came here) and one from today- I'm sorry, I really didn't think there was one from today because I thought it said it didn't find anything, but honestly, I was in a rush, so maybe I am remembering incorrectly.

    4) I thought I did take action on what MBAM found- I can't imagine I didn't, but if the logs say I didn't, then I probably somehow managed not to. Would you like me to run it again and then supply another log?

    Again, thanks, and in the meantime, I will follow the directions in your first post.
     

    Attached Files:

    Last edited: Jul 2, 2010
    MagpieMoon, Jul 2, 2010
    #4
  5. MagpieMoon

    MagpieMoon Private E-2

    Bootkit info

    Is this the correct information?



    Bootkit Remover version 1.0.0.1
    (c) 2009 eSage Lab
    www.esagelab.com

    \\.\C: -> \\.\PhysicalDrive0
    MD5: 33651d4929a84a7ab9d65c115ce1bdc0

    Size Device Name MBR Status
    --------------------------------------------
    149 GB \\.\PhysicalDrive0 Unknown boot code

    Unknown boot code has been found on some of your physical disks.
    To inspect the boot code manually, dump the master boot sector:
    remover.exe dump <device_name> [output_file]
    To disinfect the master boot sector, use the following command:
    remover.exe fix <device_name>
     
    MagpieMoon, Jul 2, 2010
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Bootkit info

    Yes it is. ;)


    Do you have all important data backed up? You really should do this before continuing since we will need to rewrite your MBR to fix this and while most times this can be done without any problem, these infections can react badly and that could result in a PC not being bootable. You really don't have much choice though since these infections are too dangerous to your security to leave on a PC.


    Now - please do the following:
    • Click Start, Run then copy and paste the below into the Run box and click OK.
    "%userprofile%\Desktop\remover.exe" fix \\.\PhysicalDrive0
    • Now reboot your PC and after reboot continue with the below instructions.
    • Disable System Restore on all drives.
    • Look for the below folder and if if it sill exists, delete it.
      • C:\System Volume Information\Microsoft
    • Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

      Then attach the below logs:
      • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 2, 2010
    #6
  7. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Thanks- followed your latest instructions. Though I haven't had any warnings from Avast in the 5 minutes or so since I finished those steps, I am still getting redirects in Firefox, so I don't know if the problem is gone of if I have something else going on in addition. (Taking my online microbiology test this AM was a challenge with those redirects!) ;)

    I've attached the MGtools log.

    Thanks for taking a look at it!!
     

    Attached Files:

    MagpieMoon, Jul 3, 2010
    #7
  8. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Just wanted to add that immediately upon hitting "submit reply" on my last post, Firefox crashed, which I can't recall having happen ever before- not sure if it is related.
     
    MagpieMoon, Jul 3, 2010
    #8
  9. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Little more info so as not to confuse things- Firefox has crashed several times in the last 10 minutes, and a couple times I got, at the same time, an error message about a Firefox program process, plugin-container.exe, so I suspect it is a Firefox software issue and perhaps has nothing to do with the other challenges my poor computer is facing.
     
    MagpieMoon, Jul 3, 2010
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Likely correct.



    We are going to be uninstalling your old version of FireFox and installing the new version. So do the below to save bookmarks:
    • Run FireFox and click Bookmarks.
    • Then select Organize Bootmarks.
    • Then on the next window click File and then select Export. Save the bookmarks.html file to your Desktop for later use in importing.
    Now download and save the installer for the current version of FireFox but DO NOT install it yet. Get it here: Mozilla FireFox

    You will need exit FireFox now and use Internet Explorer to continue with the below until we reinstall FireFox.

    Start by uninstalling FireFox and then reboot. Do not skip the reboot.
    After reboot, delete the below folders:

    C:\Documents and Settings\Diane\Local Settings\Application Data\Mozilla
    C:\Program Files\Mozilla Firefox

    where UserAccount is the actual user account name being used.

    Now reinstall FireFox from the file previously downloaded.
    Import your bookmarks file. (similar process to exporting).


    Is FireFox working okay now?
     
    chaslang, Jul 3, 2010
    #10
  11. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    I tried to remove Firefox using Add/Remove Programs as there is no uninstall option with Firefox in the start menu. Clicking the button did approximately nothing. Any pointers on how to manually uninstall? (I did reboot just in case that might make a difference- it did not.)

    An interesting note- only ONE bookmark in Explorer is working correctly anymore. I only have about 4 anyway, but most of them (the link I saved to this thread, the Eset online scanner link, and one other link, can't remember what) do absolutely nothing when I click on them. I can get to these sites by typing in the URL, but I am still getting random redirects in Firefox, like for instance, when I clicked on the link in your last post to got to the Firefox download page, I got redirected to a page to buy "Registry Defender." I am, however, no longer getting Explorer pop-ups, my wave volume has been fine, and I don't get redirects in Explorer.

    Thoughts?

    Big thanks!
     
    MagpieMoon, Jul 4, 2010
    #11
  12. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    FWIW, I also followed the directions from Mozilla support to run the uninstall this way:

    "If the Uninstall Wizard does not run, you can start it manually, by running C:\Program Files\Mozilla Firefox\uninstall\helper.exe"

    This also does nothing. :(
     
    MagpieMoon, Jul 4, 2010
    #12
  13. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Finally found some other Mozilla support info that said to delete the program folder if nothing else worked, so I did it. I rebooted then followed your directions, but in no way am I convinced it worked, because all my bookmarks were still there when I reinstalled. So far, though, no redirects. If clicked through about 20 links so far and nothing.

    What next?

    Thanks!!!
     
    MagpieMoon, Jul 4, 2010
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Download and install FireFox from the link I gave you in my last message.

    Then immediately complete all of my instructions from the point of backing up Bookmarks thru to the end of my last proposed fix
     
    chaslang, Jul 4, 2010
    #14
  15. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Thanks for the quick reply.

    I installed the new version and was able to uninstall, but had to do it twice to get it to work properly. Both times, I was unable to find any Mozilla Firefox folder (it was there before uninstall) and was not permitted to delete the Mozilla folder in application data because the computer says it is in use by another person/program (though I couldn't possibly tell you what.)

    It does seem to be working now, though.

    Did my logs look clean on the last scans? I'd like to believe everything is gone, but just because they seem okay to me right now, doesn't mean they are.

    If things seem clear, what steps do I take to put my system back in order?

    I really appreciate all your help- thanks!

    Happy 4th!
     
    MagpieMoon, Jul 4, 2010
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Yes! BootKit Remover fixed your malware problem.



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. Reenable System Restore if you still have it disabled from running the BootKit Remover fix.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 4, 2010
    #16
  17. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    I ran through all the steps to put my computer back in order. The only thing that didn't go as planned was that, despite my having disabled it and having gotten all sorts of warnings about doing so, my system restore somehow already seemed to be enabled when I went back in. I created a new restore point that indicates it is after my computer was clean. Everything else went smoothly.

    I updated to IE8 and will try to get used to it as your link says it is now generally considered to be safer than Firefox. My bookmarks in IE are working again.

    I downloaded Outpost firewall, disabled my connection, booted the Windows firewall, and enabled Outpost. It seems to be working well. I still have avast running.

    I can't thank you enough for all your help. If there a mechanism whereby I can donate via Paypal to either the website or to you directly? I'm a starving student, so to speak, and can't afford much, but your help has been invaluable- though only my schoolwork (which is already submitted) and some backed-up pictures and music are on this computer, it would have been a colossal pain to reformat as I don't currently have a CD drive.

    Thanks so much fo everything!!!!!!!
     
    MagpieMoon, Jul 5, 2010
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    You're welcome.
    There is no formal process to donate to the site, but some of us do have PayPal accounts. However I suggest that you save your money for school and food and when you get out and hopefully get a good job ;) you can think about pay back. :)
     
    chaslang, Jul 5, 2010
    #18
  19. MagpieMoon

    MagpieMoon Private E-2

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    Thanks a million- you've been a huge help. Hopefully the new firewall will help prevent future problems. :)





    (Haha- just realized I said I booted the Windows firewall. Of course I meant I got rid of it.) ;)
     
    MagpieMoon, Jul 5, 2010
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: I'm also having problems with a variant of win32/trojandownloader.unruy.BV trojan

    You're welcome. Surf safely!
     
    chaslang, Jul 5, 2010
    #20

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds