Massive Spyware and Trojan Problem

Discussion in 'Malware Help (A Specialist Will Reply)' started by a_doostdar, Jul 7, 2006.

  1. a_doostdar

    a_doostdar Private E-2

    Hello,

    I hope you can help me with a massive trojan and spyware problem I've been having recently. I've gone through all the required steps and some of the recommended ones on the "Read and Run This First" thread, but it hasn't really helped much. I have attached the required logs to this thread, including a HijacThis! log.

    So here is the rundown:

    I'm running a Windows XP Professional Service Pack 2 system, Intel Pentium M, 1274 MHz (4 x 319), 512 MB RAM, and with Internet Explorer 6.02.2900.2180 (I also have Firefox but usually use IE). I also run McAfee Security Center (a yearly subsciption version with only the Virus Protection enabled, so no firewall etc.) and ZoneAlarm (most recent free version).

    Since a couple of days ago, I've been getting frequent reports of trojans on my computer from McAfee, which sometimes deletes them but most often says it can't clean, delete, or quarantine. I get reports of GenericDownloader.ab, Vundo Vundo, Generic Multidropper.d, QLowZones-15, BackDoor-CVT, etc. The files that are reported as infected are usually in the Windows Temp folder, or in Temporary Internet Files, and sometimes in system32. Sometimes I've been able to delete the files directly in the folders, but often I haven't (for example one stubborn file in the system32 folder that is infected with BackDoor-CVT won't be deleted, and there are others that seem to pop out of nowhere every now and then).

    The last few start ups, McAfee has told me right at startup that it has found a “suspect file” and it recommends I run virus scan. This still happens after I’ve done all of the "Read and Run First" steps, though I haven’t run McAfee itself (I'm doing that right now as I type these words).

    Other problems:

    1- I sometimes see the command prompt running itself for no reason and then disappearing.

    2- I get variations on the following error (variation as in different file names at different times):

    “win18.tmp.exe – Bad Image

    The application or DLL C:\WINDOWS\system32\hgghfgf.dll is not a valid Windows image. Please check this against your installation diskette.”

    I deleted that one file. However I’ve gotten similar reports before and I may well get others in the future. Also, many of the trojans that are reported to me by McAfee are named things like win18.tmp.exe or win1B.tmp.exe etc (usually they have tmp.exe extensions and start with "win"). ZoneAlarm has been giving me reports of these "programs" trying to access the internet (which I've not allowed). Sometimes it says the program is called "Windows Media Loader" or something like that.

    3- I am also getting this error now right after starting Windows:

    “NSIS Error

    The installer you are trying to use is corrupted or incomplete. This could be the result of a damaged disk, a failed download or a virus.

    You may want to contact the author of this installer to obtain a new copy.

    It may be possible to skip this check using the /NCRC command line switch (NOT RECOMMENDED).”

    4- Finally, a problem that has been happening for a long time and predates my current Trojan problem: When I run Spybot S&D, I invariably get reports of two problems (Windows Security Center.AntiVirusDisableNotify and Windows Security Center.FirewallDisableNotify) along with a new problem (Zlob.Dowloader). I always tell it to fix these, and it says it has, but then I get the same problem reports again if and when I run Spybot again.


    A few days ago, I went thru all the "Read and Run Me First" steps, but decided that I might be able to go from there and solve my own problems (the various virus and trojan catchers caught some trojans and spyware and I thought I could go from there myself). But then things got much worse, with many new reports of Trojans. That's when I ran the required steps a second time, and came up with the attached logs.

    I have not had an actualy virus alert so far. It has all been trojans, spyware, dialers, etc.

    I would really really appreciate it if you could help me with this problem. Please let me know if you need any further information.

    Thanks!
     

    Attached Files:

    a_doostdar, Jul 7, 2006
    #1
  2. a_doostdar

    a_doostdar Private E-2

    One thing I should add:

    Sometimes when I load Windows, I get a prompt from McAfee that asks if I want to set it as the default Virus Scanner. It seems like something is trying to shut it down.

    Also, as I wrote above, when I ran all the "Read and Run Me First" steps, they did catch some problems and resolve them (I don't know how successfully). There weren't any steps that I COULDN'T run. The only thing was that I had to run the last two (ActiveScan and Panda -- see logs attached) in normal mode, since I couldn't connect to the internet in Safe mode, even with "Networking" enabled (I have a wireless connection from the university).
     
    a_doostdar, Jul 7, 2006
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    In step 0 of the READ & RUN ME, you should have uninstalled Viewpoint Manager. Please uninstall it now.

    Start by downloading two tools we will need

    - Process Explorer

    - Pocket KillBox

    Extract them to their own folder somewhere that you will be able to locate them later.

    IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

    Do the above before continuing! Okay unplug your cable now.

    Make sure you have rebooted in Normal Mode (do not open any other processes)

    - Run Process Explorer

    In the top section of the Process Explorer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

    Once you see this screen click on each instance of winrmd32.dll once and then click the kill button. After you have killed all of the winrmd32.dll under winlogon click ok. (If you do not find the dll, just continue on.)

    Next double click on explorer.exe and again click once on each instance of winrmd32.dll and kill it. (If you do not find the dll, just continue on.)

    Now just exit Process Explorer.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R3 - Default URLSearchHook is missing
    O20 - Winlogon Notify: winrmd32 - C:\WINDOWS\SYSTEM32\winrmd32.dll



    Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
    Be sure the "Save as" type is set to "all files"
    Once you have saved it double click it and allow it to merge with the registry.
    Now click Start, Run, and enter cmd and click OK! This will open a command prompt window. In the command prompt window enter the below commands each followed by the Enter key.
    del %windir%\temp\win*.*
    exit


    Now run Pocket Killbox by doubleclicking on killbox.exe
    Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    Then after it deletes the files click the Exit (Save Settings) button.
    Now back on Killbox's main window, Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.
    C:\WINDOWS\SYSTEM32\winrmd32.dll


    If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

    Now attach a new HJT log and tell me how the steps went.

    Now run the below procedure and attach the newfiles.txt log.
     
    chaslang, Jul 7, 2006
    #3
  4. a_doostdar

    a_doostdar Private E-2

    Hi there,

    Thanks for the help! I went through all the steps. Process Explorer didn't find any instances of winrmd32.dll. I think this might be due to the McAfee scan I was performing while writing the above questions and problem description.

    In HijackThis, instead of the second line you mentioned, I had:

    O20 – Winlogon Notify: winrmd32 – winrmd32.dll (file missing)

    So I took the liberty of fixing this instead, along with the first line. I then added the commands you wanted to the registry.

    I've attached the HJT and ShowNew logs. I haven't had any trojan reports for a while, so I hope things are back to normal?
     

    Attached Files:

    a_doostdar, Jul 7, 2006
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Delete the below files that just showed up today:
    C:\WINDOWS\SYSTEM32\ld100.tmp
    C:\WINDOWS\SYSTEM32\ld101.tmp

    If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Jul 7, 2006
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds