Persistent, nasty Virtumonde infection

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Bravus, Apr 19, 2007.

  1. Bravus

    Bravus Private E-2

    Hi Guys

    I've been having hassles with a Virtumonde/Winfixer infection on my Dell (XP Pro) laptop over the past few days. It randomly pops up an Internet Explorer window and tries to load a page, but gets a 404 error. It also sometimes creates a new tab in Firefox (my main browser and the only one I usually use) advertising WinAntispyware 2007.

    I've completed all the steps in the 'Read and Run Me First' sticky, although because this is a work laptop I wasn't able to start it and run it in Safe Mode (because of limitations on my login, which is a 'Debugger Users; Administrators' account). Counterspy found and removed several trojan downloaders. I should probably also note that the work nature of the machine means I'm forced to use NAV for antivirus, although I'm not a fan...

    I've also run Vundofix.exe several times. It finds and deletes the 'several random letters.dll' files from c:\windows\system32\, but a few minutes later a new window pops up and Vundo finds new ones, so presumably something is reinstalling Virtumonde.

    I've attached the first few logs to this message and will attach the rest to the next message.

    Thanks in advance for your help, and for the fantastic help you've already given me.
     

    Attached Files:

    Bravus, Apr 19, 2007
    #1
  2. Bravus

    Bravus Private E-2

    Remainder of the logs
     

    Attached Files:

    Bravus, Apr 19, 2007
    #2
  3. Bravus

    Bravus Private E-2

    And just for good measure, the Vundofix log
     

    Attached Files:

    Bravus, Apr 19, 2007
    #3
  4. Bravus

    Bravus Private E-2

    Not sure how I missed it the first time through, but I had old versions of Java (noticed it in the Vundofix log and in another post in this forum). Removed those and ran Vundofix again. No noted infections at this point, so I'll keep my fingers crossed, but please keep the thread open a little longer... I don't trust that it's all gone yet!
     
    Bravus, Apr 19, 2007
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I can only go by what I see in your logs so some steps I post my no longer apply. Check them anyway.

    As you will see from the below procedure, you are far from being clean! ;)

    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 9
    Java 2 Runtime Environment, SE v1.4.2_03

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment


    Uninstall the Sunbelt CounterSpy trial since we are finished with it now! Then delete the below two folders which may be left behind by the uninstall:
    C:\Documents and Settings\All Users\Application Data\Sunbelt Software
    C:\Program Files\Sunbelt Software

    Also delete the below folders
    C:\Documents and Settings\All Users\Application Data\Viewpoint
    C:\Program Files\Viewpoint

    Did you configure this PC to no show the Welcome Screen? This is a less secure way to boot a PC!
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    "NoWelcomeScreen"=dword:00000001

    Also is the below something you configured or do you recognize this?
    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    "1"=\\\\uqistaff\\netlogon\\ad_login.vbs


    Continue by downloading a tools we will need

    - Pocket KillBox

    Extract it to its own folder somewhere that you will be able to locate it later.

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {1557B435-8242-4686-9AA3-9265BF7525A4} - C:\WINDOWS\system32\tirbmodg.dll
    O2 - BHO: (no name) - {4A306CFD-4D2B-4844-8C10-1D66B2CCABC5} - C:\WINDOWS\system32\vtsqq.dll (file missing)
    O20 - Winlogon Notify: xxyaaay - xxyaaay.dll (file missing)
    O23 - Service: Client IP-IPX - Unknown owner - ".exe (file missing)

    After clicking Fix, exit HJT.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now run Pocket Killbox by doubleclicking on killbox.exe
    • select File, Cleanup, Delete All Backups
    • Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
    • Then after it deletes the files click the Exit (Save Settings) button.
    NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

    Select:
    • Delete on Reboot
    • then Click on the All Files button.
    • Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):


    C:\WINDOWS\system32\aexbkuwy.dll
    C:\WINDOWS\system32\cogiexnu.dll
    C:\WINDOWS\system32\dfqdtodx.dll
    C:\WINDOWS\system32\dobsrkcq.dll
    C:\WINDOWS\system32\dvuyxcho.dll
    C:\WINDOWS\system32\esxkgkxe.dll
    C:\WINDOWS\system32\kxfefdbn.dll
    C:\WINDOWS\system32\nklyxcds.dll
    C:\WINDOWS\system32\qrusbcqi.dll
    C:\WINDOWS\system32\rrpwetwj.dll
    C:\WINDOWS\system32\wgihgmwb.dll
    C:\WINDOWS\system32\wwnjuaeb.dll
    C:\WINDOWS\system32\ynwyfwfb.dll
    C:\windows\system32\xxyaaay.dll
    C:\WINDOWS\system32\asnwdtrl.dll
    C:\WINDOWS\system32\awtqn.dll
    C:\WINDOWS\system32\awtqq.dll
    C:\WINDOWS\system32\ddayv.dll
    C:\WINDOWS\system32\ddcyw.dll
    C:\WINDOWS\system32\eejxbyhu.dll
    C:\WINDOWS\system32\gebyv.dll
    C:\WINDOWS\system32\geebc.dll
    C:\WINDOWS\system32\jkkli.dll
    C:\WINDOWS\system32\kwodrqmt.dll
    C:\WINDOWS\system32\mljgg.dll
    C:\WINDOWS\system32\pmkji.dll
    C:\WINDOWS\system32\pmkjj.dll
    C:\WINDOWS\system32\rcqbrjtm.dll
    C:\WINDOWS\system32\rrdsullb.dll
    C:\WINDOWS\system32\ssqrp.dll
    C:\WINDOWS\system32\ssttr.dll
    C:\WINDOWS\system32\tirbmodg.dll
    C:\WINDOWS\system32\vtstt.dll
    C:\WINDOWS\system32\qpqss.tmp
    C:\WINDOWS\system32\cbeeg.ini
    C:\WINDOWS\system32\ijkmp.ini
    C:\WINDOWS\system32\qpqss.ini2
    • Return to Killbox, go to the File menu, and choose Paste from Clipboard.
    • Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt.
    If you receive a PendingFileRenameOperations prompt, just click OK to continue (But if you do get this message, please let me know!)

    If Killbox does not reboot just reboot your PC yourself.

    After reboot locate the below folder and delete if found:
    C:\Program Files\Common Files\{6933E561-0746-3081-1002-05050404003d}

    Now run Ccleaner!

    Now attach the below new logs and tell me how the above steps went.

    1. GetRunKey
    2. ShowNew
    3. HJT


    Make sure you tell me how things are working now!
    Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.
     
    chaslang, Apr 20, 2007
    #5
  6. Bravus

    Bravus Private E-2

    Thanks very much - working through that now. I've opened this thread on an uninfected desktop so I can keep reading it while working on the laptop.

    Yes, the \\\uqistaff\ thing is part of my University's login stuff and is likely OK.

    Old Javas gone, rebooted, new Java installed.

    CounterSpy gone, with its folders

    Viewpoint folders gone

    Rebooted again at this point because the CounterSpy uninstall said it needed it

    By Welcome Screen do you mean the screen requiring me to hit CTRL+ALT+DEL which then allows me to enter my username and password? If so, that still runs: is it possible that the \\\uqistaff\ thing is a substitute that the uni sets up? And that that might be why I couldn't log in in Safe Mode in the earlier steps? Anyway, didn't change anything in relation to these two (possibly related) issues, but I am required to 3 finger salute every time I start up/log in.

    Registry stuff added, HJT and killbox processes completed with no hassle and no unusual messages (order was HJT/registry/killbox as you outlined)

    CCleaner run

    The three new logs are attached to the post below (posted from the laptop where this is from the desktop)

    All is running well at the moment
     
    Bravus, Apr 20, 2007
    #6
  7. Bravus

    Bravus Private E-2

    Here are the logs.

    And the most important bit: thanks so much, you rock!
     

    Attached Files:

    Bravus, Apr 20, 2007
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Don't worry about it! Your school set it up to run this way so we will leave it alone!

    Your logs are clean. If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix you can delete the ComboFix.exe file and associated C:\combofix.txt log that was created.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    5. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    6. If we had you run Avenger, you can delete all files related to Avenger now.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    8. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
    9. If you are running Windows XP or Windows ME, do the below:
      • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Apr 20, 2007
    #8
  9. Bravus

    Bravus Private E-2

    All done, and all looks clean and nice. Thanks again, so much. Having to deal with the results of the evil #^%$&#s who create malware harms my faith in human nature, but you guys more than restore it!
     
    Bravus, Apr 20, 2007
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf Safely!
     
    chaslang, Apr 20, 2007
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds