Infection Help Request - Possible Ramnit.gen!a

Please do an online scan three times!! Reboot between each scan and save the logs. Attach the three logs when you are done:
eSet Online Scan.

 

Now download The Avenger by Swandog46 to your Desktop.

See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
Extract avenger.exe from the Zip file and save it to your desktop.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

1. Extract avenger.exe from the Zip file and save it to your desktop.
2. Run avenger.exe by double-clicking on it.
3. Click OK at the warning to continue to use The Avenger
4. Do not change any of the check box options!
5. Shut down your protection software now to avoid possible conflicts.
6. Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger
   
7. Now click the http://img33.imageshack.us/img33/9159/executeavenger.jpg button
8. Click Yes to the prompt to confirm you want to execute.
9. Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
10. Your PC should reboot, if not, reboot it yourself.
11. A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
12. Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Download OTL to your desktop.

Double-click OTL.exe to start the program.

• Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:

:processes
:killallprocesses
:otl
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,,C:\Documents and Settings\Mike\Local Settings\Application Data\jiqwvtdd\roijgtmt.exe
O4 - HKCU\..\Run: [RoiJgtmt] C:\Documents and Settings\Mike\Local Settings\Application Data\jiqwvtdd\roijgtmt.exe

:files
C:\Documents and Settings\Mike\Local Settings\Application Data\ffjfbldg.log
C:\Documents and Settings\Mike\Local Settings\Application Data\hwoapeud.log
C:\Documents and Settings\Mike\Local Settings\Application Data\jiqwvtdd
C:\Documents and Settings\Mike\Local Settings\Application Data\lmsosthh.log
C:\Documents and Settings\Mike\Local Settings\Application Data\oplavsbm.log
C:\Documents and Settings\Mike\Local Settings\Application Data\spibhvrp.log
C:\Documents and Settings\Mike\Local Settings\Application Data\tgpodsyp.log
C:\Documents and Settings\Mike\Local Settings\Application Data\udfebacg.log
C:\Documents and Settings\Mike\Local Settings\Application Data\uuwktvne.log
C:\Documents and Settings\Mike\Local Settings\Application Data\xydvidjm.log
C:\Documents and Settings\Mike\Local Settings\Application Data\jiqwvtdd

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RoiJgtmt"=-

[HKEY_USERS\S-1-5-21-2025429265-527237240-725345543-1003\Software\Microsoft\Windows\CurrentVersion\run]
"RoiJgtmt"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\SYSTEM32\Userinit.exe,"

:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]

• Then click the Run Fix button at the top.
• Click the OK button.
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\MGlogs.zip

 

In spite of our best efforts, it all is coming back. That is the nature of a Ramnit infection. Your inability to do an online scan is making it impossible to remove the infection. Your best course of action is to reformat and re-install.

The problem is that the damage caused by this infection really makes a PC unreliable/untrustworthy. PE file infectors like Ramnit, Virut,.... etc can infect all executable files (DLL, EXE, SCR....and many more and also HTML). These infections can open back doors that truly may compromise your computer and your security. These backdoors could allow a remote attacker to access and instruct the infected computer to download and execute more malicious files.

In many cases the infected files (which could number in the thousands) cannot be disinfected properly by your anti-virus or by other scanning tools. Also when disinfection is attempted, the files often become corrupted and the system may become unstable or irrepairable. The longer Ramnit remains on a computer, the more files it may infect and/or corrupt so the degree of infection can vary.

Ramnit is commonly spread via a flash drive (usb, pen, thumb, jump) infection where it copies the Ramnit worm using a random file name. The infection is often contracted by visiting remote, crack and keygen sites. These type of sites are a major source of system infection.

 

You are most welcome.