Bubnix virus - have I finally got rid of it?!

Discussion in 'Malware Help (A Specialist Will Reply)' started by kerspoon, Sep 16, 2010.

  1. kerspoon

    kerspoon Private E-2

    Firstly thanks for the guide and all the help guys, I haven't had to deal with a virus for a while and things have really moved on.

    I have done all the recommended steps in the readme and attached the logs. The only problem I can still see is that zluqcb.sys (an infected file) is still in the list of drivers in device manager even though it appears to be deleted from system32/drivers.

    Basically can you tell me if the computer now safe to use or how I can make sure?

    Cheers!


    --------------------------------------------------------


    Here is some of the history:

    The first time there was a problem I was just browsing the internet and avira antivirus found 2 problems. I quarantined these files, but shortly afterwards it came up with 8 more. Then I ran a full scan and it found about 20 but it didn't managed to fix all of them.

    I tried a few things myself before finding this site (including: re-running avira in safe mode, manually delete the files, uninstalling the infected driver, stopping things on hijackthis, running stinger and clamwin virus scanners). Each found something but nothing would make all the problems go away. The main problem file was system32/drivers/zluqcb.sys nothing could get rid of it. (It was identified by Malwarebytes as Rootkit.Bubnix)

    As I said I have done all the recommended steps in the readme but the zluqcb.sys is still in the list of drivers in device manager.
     

    Attached Files:

    kerspoon, Sep 16, 2010
    #1
  2. kerspoon

    kerspoon Private E-2

    attached
     

    Attached Files:

    kerspoon, Sep 16, 2010
    #2
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Currently reviewing your logs and will post back with an appropriate fix asap. Thanks for your patience. :)
     
    Kestrel13!, Sep 16, 2010
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    So you were using Avira but you uninstalled it? I am seeing remnants from Norton Internet Security also. After we have finished here you will have to install some AV.

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::

Driver::
Norton Internet Security

DirLook::
C:\viruskill

File::
C:\windows\system32/drivers/zluqcb.sys

Folder::
c:\program files\Norton Internet Security

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\zluqcb]
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Also delete all files in the below bold folder except ones from the current date (Windows will not let you delete the files from the current day).
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

    Tell me how things are running now? :)
     
    Kestrel13!, Sep 16, 2010
    #4
  5. kerspoon

    kerspoon Private E-2

    Wow that's fast. This is a really active forum. Thanks kestrel!

    Yes, I previously had Avira but removed it to try other virus scanners (there isn't one currently installed but I will get one when this process is complete). This machine is second hand hence the previous owner might have had Norton installed but I haven't used it.

    ComboFix was run with the script ok. The c:/viruskill folder is one I made to store all the malware removal stuff. The logs are attached.

    I tried to delete the temp files, there were none in C:\Documents and Settings\James\Local Settings\temp, but the one in C:\Documents and Settings\Administrator.Nimlet\Local Settings\temp would not delete. I was logged in as this user.

    It all appears to be running fine now but without any virus scanner or firewall it's hard to say. I also haven't been on the internet except for this site.

    What's next?

    Thanks
     
    kerspoon, Sep 16, 2010
    #5
  6. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Please try again to attach the requested logs for Kestrel.
     
    dr.moriarty, Sep 16, 2010
    #6
  7. kerspoon

    kerspoon Private E-2

    sorry about that, lets hope it worked this time.
     

    Attached Files:

    kerspoon, Sep 16, 2010
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    c:\documents and settings\BenQ\Desktop\cfix.exe <--- rename back to combofix.exe

    C:\viruskill <--- What are the contents of this folder? (Do not click on anything inside)
     
    Kestrel13!, Sep 17, 2010
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    They were shown in the last ComboFix log from the DirLook. It is showing you that full webpages are being saved from the browser with instructions for the cleaning procedures and for other webpages too. This allows offline viewing. ;)
     
    Last edited: Sep 17, 2010
    chaslang, Sep 17, 2010
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Of course *slaps head*

    OK, so how are things running for you now? :)
     
    Kestrel13!, Sep 17, 2010
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds