ADV Virus Rmvr 2009

legareth · Sep 1, 2009

My apologies in advance if I'm doing something incorrectly.

I have read through and attempted to do all of the things in Read & Run First, however in almost all cases I am able to install the software, however I am unable to run all but MGTools.

HiJackThis runs for about 5 seconds and then simply disappears.
Malwarebytes' install and runs for about 5 seconds before disappearing
Combofix will run however receives multiple access denied errors while trying to scan.
SuperAntiSpyware installs, however disappears after about 5 seconds.
I tried running the kaspersky online scan, which ran for about 2 hours before disappearing.

Unable to run regedit. I have run: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
to enable registry, however this does not work when logged in under either standard or safe with networking startup.

unable to launch taskmanager either.

I have attached the MGtools log files.

Any help would be greatly appreciated.

Thanks,
Dan

TimW · Sep 5, 2009

You are seriously infected. We have a lot of work to do to try to get you clean.

First use add/remove programs and uninstall:
Windows Antivirus Pro

Now download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows System Recover!"=-
"Monopod"=-
"NordBull"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"winupdate.exe"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Advanced Virus Remover]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AntiSpyware Service]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Monopod]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\NordBull]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Windows System Recover!]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\winupdate.exe]

[HKEY_LOCAL_MACHINE\software\Microsoft\windows\currentversion\Explorer\sharedtaskscheduler]
"{BD56A320-23F2-42AD-F4E4-00AAC39CAA53}"=-

Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Drivers to delete:
smss

Files to delete:
C:\WINDOWS\Tasks\{7B02EF0B-A410-4938-8480-9BA26420A627}.job
C:\WINDOWS\Tasks\{BB65B0FB-5712-401b-B616-E69AC55E2757}.job
C:\WINDOWS\msa.exe
C:\Documents and Settings\Owner\Local Settings\Temp\sltjthcq7.exe
C:\WINDOWS\system32\drivers\smss.exe
C:\69235804
C:\cuopy.exe
C:\djos.exe
C:\dvrdiqbe.exe
C:\jybmkssu.exe
C:\lcbckjms.exe
C:\sdlb.exe
C:\sndanmiw.exe
C:\WINDOWS\msa.exe
C:\WINDOWS\msb.exe
C:\WINDOWS\msc.exe
C:\WINDOWS\msd.exe
C:\WINDOWS\mse.exe
C:\WINDOWS\msf.exe
C:\WINDOWS\msg.exe
C:\WINDOWS\msh.exe
C:\WINDOWS\msi.exe
C:\WINDOWS\msj.exe
C:\WINDOWS\ppp3.dat
C:\WINDOWS\ppp4.dat
C:\WINDOWS\svchast.exe
C:\WINDOWS\system32\AVR09.exe
C:\WINDOWS\system32\bennuar.old
C:\WINDOWS\system32\cf1158.exe
C:\WINDOWS\system32\CF18496.exe
C:\WINDOWS\system32\cf19560.exe
C:\WINDOWS\system32\cf20716.exe
C:\WINDOWS\system32\cf24494.exe
C:\WINDOWS\system32\cf26433.exe
C:\WINDOWS\system32\CF29954.exe
C:\WINDOWS\system32\critical_warning.html
C:\WINDOWS\system32\dddesot.dll
C:\WINDOWS\system32\desot.exe
C:\WINDOWS\system32\hs7f3uhduhfukde.dll
C:\WINDOWS\system32\onhelp.htm
C:\WINDOWS\system32\sonhelp.htm
C:\WINDOWS\system32\sysnet.dat
C:\WINDOWS\system32\drivers\smss.exe
C:\WINDOWS\system32\drivers\smss.exe_
C:\Documents and Settings\Administrator\Local Settings\Temp\215.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\2356915488.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\489.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\653.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\938.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\a.dat
C:\Documents and Settings\Administrator\Local Settings\Temp\a.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\a..bat
C:\Documents and Settings\Administrator\Local Settings\Temp\acr5.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acr6.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acr7.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acr8.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acr9.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acra.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\acrb.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\b.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\b..bat
C:\Documents and Settings\Administrator\Local Settings\Temp\c.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\cab124647DFW2S39JD.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\d.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\e.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\f.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\jisfije9fjoiee.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\login.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\lsass.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\mdm.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\msxml71.dll
C:\Documents and Settings\Administrator\Local Settings\Temp\setup.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\win.exe

Folders to delete:
C:\Program Files\AdvancedVirusRemover
C:\69235804

Programs to launch on reboot:
C:\Documents and Settings\Administrator\Desktop\combofix.exe
Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
-
Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* C:\Avenger.txt
* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

legareth · Sep 7, 2009

When I try to run add/remove programs I receive the following message twice.

Error
"c:\windows\system32\rundll32.exe" c:\windows\system32\shell32.dll,control_runDLL
c:\windows\system32\appwiz.cpl

I was able to insert the registry entries and run avenger, however when the system reboots, combofix does not run.

I have attached the MGlogs.zip and avenger.txt files for your review.

I now receive 3 errors every time I try to launch a program such as safari or firefox, then the program launches and appears to work correctly.

TimW · Sep 10, 2009

Let do this as many of the items are still there>

You MUST follow these steps exactly and they MUST be performed in the order written.

Download The Avenger by Swandog46, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop but DO NOT RUN IT.

Now download and save the below two files to the root folder of your Windows boot drive. Normally this would be drive C. If you do this correctly, you will then see C:\MGtools.exe and FixAVP.exe

FixAVP

Now run MGtools.exe by following the instructions given here Using MGtools which will help your understand how to run it and what will happen. You don't need to worry about attaching the MGlogs.zip file that it mentions yet because we have more to do and new log will be obtained later.

Now run the FixAVP.exe file by double clicking on it. This will attempt to automatically run Avenger (which you downloaded above) and it should also try to reboot your PC so don't be alarmed when this happens.

After Reboot, and if all goes well, a new scan by MGtools should automatically take place because Avenger will try to run C:\MGtools\GetLogs.bat which will begin all the scans again.

When GetLogs.bat finishes running, there will be a new C:\MGlogs.zip file and now it will be time to attach it to your next message. Make sure that you allow GetLogs.bat to finish running. It will tell you when it is finished. Do not close the command prompt window on your own until it is finished.

Click to expand...

legareth · Sep 10, 2009

Ok, so I downloaded all of the files on to another machine and burned them to a CD and then moved the files into the correct location on the infected machine.

I ran MGTools.exe by following the instructions provided. The DOS window popped up and ran for approx. 30 seconds and then disappeared and it populated a mglogs.zip file.

I ran FixAVP.exe and it almost immediately shut down windows. When rebooted the Avenger log file was generated, however the Getlogs.bat file did not run.
I attempted to run Getlogs.bat myself, however I experienced the same thing. Runs for approx. 30 seconds and then shuts down (I never get a message that the scan is finished even after 1 hour). However this time, theMGlogs.zip file was not generated, meaning that all of files contained in the existing file are time stamped at the time that I ran the original file.

There is no MGLogs.zip file to attach as none was generated. I did attach the avenger log file as that might have some useful info.

Thanks,
Dan

TimW · Sep 15, 2009

You have one of the new infections that is very difficult to remove. Please do the following:
Win32KDiag - How to run

legareth · Sep 15, 2009

Ok, so I downloaded the file to my desktop and ran the program. I received an error that I did not have permission to run the file. I changed it from an exe to a com file and reran the program, it ran for about 30 seconds and then failed giving me the error.

Win32kDiag1.com has encountered a problem and needs to close. We are sorry for the inconvenience.

Send Error Report or Don't Send Error Report.

I've attached a log file and will attach another in a few minutes as it appears that they terminated in 2 separate places.

TimW · Sep 15, 2009

Yup....this is that nasty. Try doing this for the permissions.

Using Inherit to correct program execution permissions issues

legareth · Sep 15, 2009

I downloaded Inherit to a clean machine, burned it to a CD and then dragged and dropped from the CD to the infected machines desktop.

I dropped Win32Kdiag.exe onto inherit.exe and received a message that said ok.

I double clicked win32kdiag.exe and the program ran for approx. 5 minutes prior to posting this entry to the log file.

cannot access: c:\windows\erdnt\8-19-2009\default

then I get the same message as I received before that the program has encountered a problem and needs to close. We are sorry for the inconvenience.

I'll attach the existing log in just a moment.

legareth · Sep 15, 2009

log attached

TimW · Sep 16, 2009

This is going to take a few fixes to try to get this sorted.

First I want you to boot into the recovery console. ( Boot the machine with the OS cd in the drive, then you will chose "R" --> to go to the recovery console).

At the command prompt, type:
copy C:\WINDOWS\ServicePackFiles\i386\eventlog.dll C:\eventlog.dll
Hit enter and then reboot.

After you reboot:

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Files to move:
C:\eventlog.dll | C:\Windows\system32\eventlog.dll

Click to expand...

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.Check your C:\Windows\system32\eventlog.dll ( first making sure it is there ) by right clicking it and choosing properties. Tell me what size it states.

Now, uninstall any versions of SAS, MBAM already installed.
Run CCleaner to remove any leftovers from SAS and MBAM.
Make sure there are no folders existing for SAS or MBAM
Empty the C:\Documents and Settings\Administrator\Local Settings\Temp folder.
Now reboot.

Now download current versions of SAS, MBAM, RootRepeal, ComboFix and run as per R&R ME.

Now download the latest version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one. Try to run the exe file.

Attach the below logs assuming all ran

avenger.txt

SAS

MBAM

RootRepeal

ComboFix

MGlogs.zip

If MGTools does not run, go to start / run / type "cmd" without quotes and then type:
cd C:\MGTools
then type:
ShowNew.bat
hit enter....see if that runs.

if not...try:
GetRunKey.bat

Let me know if it produces any errors.

legareth · Sep 17, 2009

Ok, so I booted up the machine using the OS disk and attempted to access the recovery console. I was prompted to choose the installation that I wanted to repair of which there is only 1. I was then asked for an administrator password. I have no idea what this is, or what it might be. I tried admin, administrator and leaving it blank.

Now I can not boot windows at all, in either safe, safe with networking, safe with command prompt or normal. I also tried choosing last known good configuration and still unable to boot windows. The boot process runs for a minute or so, then the HD just stops.

Any ideas?

TimW · Sep 19, 2009

Did you set the boot order in the bios to cd drive first and hard drive second? Is it still set that way?

legareth · Sep 21, 2009

I did not change my boot priority

TimW · Sep 21, 2009

What is it set at now? If it was set to cd first...then you could or should be able to boot to the cd.

If set to hard drive first, did you boot to windows and then go into the cd? This would be the wrong way to access the recovery console.

legareth · Sep 21, 2009

Was set to CD,HD,Built LAN.

I just changed to HD, CD, Built in LAN, however same result.

The windows loading screen shows and the progress bar goes across for about a minute, then the screen goes blank and stays that way. After about 30 seconds the HD activity stops. Waited for over 1 hour and windows never loaded.

Truly the only thing I did was attempt to access the recovery console, which required an admin password that I didn't have. I attempted admin, administrator and leaving the password blank. After the 3rd attempt I was forced to reboot and since this, I have been unable to boot into windows.

TimW · Sep 21, 2009

I should send you to the software forum at this point as we need you to be able to boot to windows. However, at this point you have three options. One is to do a repair installation. You could also slave your hard drive to another computer and we could work to remove the malware that way. Last, you can do a complete reformat and reinstall.

Log in or Sign up

ADV Virus Rmvr 2009

legareth Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

Attached Files:

avenger.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

Attached Files:

avenger.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

Attached Files:

Win32kDiag.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

legareth Private E-2

Attached Files:

Win32kDiag.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

legareth Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member