Trojan.Vundo and others

Discussion in 'Malware Help (A Specialist Will Reply)' started by Ampherion, Mar 1, 2008.

  1. Ampherion

    Ampherion Private E-2

    I got Trojan.Vundo (and some system-defender adware crap) from another user who put a thumbdrive on my pc so they could print their college work.

    I have cleaned most of it up using spybot, adaware, and Malwarebytes' Anti-spyware. Unfortunately Symantec Antivirus 10 was useless and didn't even detect it.

    So Malwarebytes' removed most of the stuff, but one thing keeps appearing and won't be removed:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader)

    Is this a trojan? How can I get rid of it? Here is my hijack log:
     

    Attached Files:

    Ampherion, Mar 1, 2008
    #1
  2. Ampherion

    Ampherion Private E-2

    After reading other forums here about the Vundo annoyance, I found that vundofix by atribune is much more useful that fixvundo from symantec. In fact, I have found that symantec seems just to be mediocre on most of their software. They fixvundo app told me I was not infected, while vundofix found 4 instances on my machine. I told it to fix them, then ran Malwarebytes' anti-malware which removed 2 more. I hope I'm clean now.

    Here is my hijackthis log output, does anyone see anything bad left?

    Edit by chaslang: Inline HJT log removed. READ & RUN ME sticky not followed.
     
    Last edited by a moderator: Mar 4, 2008
    Ampherion, Mar 1, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    No you are not clean yet!


    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    READ & RUN ME FIRST. Malware Removal Guide
     
    chaslang, Mar 4, 2008
    #3
  4. Ampherion

    Ampherion Private E-2

    Log files from superAntispyware, combofix, MGtools. There was no detected problem with spybot.

    Sorry about pasting the hijackthis results previously. I did get a few odd situations with combofix. ThreatFire didn't like some of what it was doing, but I told it to allow the activity anyway. There were two additional vundo related items found by SAS.

    Anything else I must do to be completely clean?
     

    Attached Files:

    Ampherion, Mar 4, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are the below 3 temp files that are wasting over 3 Gigabyte of diskspace something you saved? If not, delete them now and then empty your Recycle bin.
    Code:
    2008-03-02 11:47 . 2008-03-02 11:48 1,072,157,184 --a------ C:\107.tmp
2008-03-01 23:57 . 2008-03-01 23:59 1,072,157,184 --a------ C:\DE.tmp
2008-03-01 23:32 . 2008-03-01 23:33 1,072,157,184 --a------ C:\40.tmp

    Uninstall the below old versions of software as requested in the READ ME:
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3

    Now we need to use ComboFix to remove some malware.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
 
Driver::
ulvmumpwyajp
nwvpqcjtrhdf
kxpvrfqcgbgr

DirLook::
C:\Program Files\GIGABYTE
 
File::
C:\WINDOWS\system32\drivers\ulvmumpwyajp.sys
C:\WINDOWS\system32\drivers\nwvpqcjtrhdf.sys
C:\WINDOWS\system32\drivers\kxpvrfqcgbgr.sys
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\Administrator\Local Settings\Temp

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Mar 6, 2008
    #5
  6. Ampherion

    Ampherion Private E-2

    I have followed the detail above. The only thing that hasnt completed is the installation of the new java. That will happen later today.

    Thank you very much for your assistance with this!
     

    Attached Files:

    Ampherion, Mar 6, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. You forgot to tell me how things are working. You logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the /U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    9. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    10. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Mar 8, 2008
    #7
  8. Ampherion

    Ampherion Private E-2

    I appreciate your help on this. Things appear to be working without any issue. I have a few other machines to clean up (vundo came from my kids machines), but they are so inundated, I think I will just wipe them and start from scratch. I'll follow the recommendations for spyware/malware avoidance when I get them built.

    It's odd I have just ran spybot, adaware and spywareblaster forever and never had any trouble. I guess being connected to the Internet today is much more dangerous than it was only a few years back.

    You guys don't recommend threatfire? I'm just trying to figure out what tools to use. I have (all free additions):

    AVG Anti-virus
    SuperAntiSpyware
    Threatfire
    Spybot
    Adaware
    Malwarebyte's Anti-Malware
    spywareblaster
    Windows XP SP2 firewall
    OpenBSD with PF on the perimeter

    From the instructions, it seems like I have more than I need. I used to run a-squared, but it expired for some reason, so I uninstalled it. I think I may try the comodo firewall.

    What should I get rid of. I want to go with a free solution if I can.


    Thanks again for the assistance!
     
    Ampherion, Mar 8, 2008
    #8
  9. Ampherion

    Ampherion Private E-2

    After looking around more with the tools I have (for preventing spyware infection) I have noticed some things that are popping up still. It appears that the protection is catching them, but I'm not sure I am really clean. Here are some examples:

    The Comodo Firewall Defender+ service has this files pending:

    c:\windows\9129837.exe
    c:\windows\system32\drivers\runtime2.sys
    c:\windows\system32\drivers\runtime.sys
    c:\windows\system32\drivers\lkw53.sys
    c:\windows\system32\rpcc.exe

    A-squared has also found a few items as well. I am going to scan through all my files with avg, malwarebytes and see what the result is.
     
    Ampherion, Mar 8, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Do you see these file using Windows Explorer? If so what file dates do you see on them. If you do not see them, make sure you still have hidden and system file viewing per the READ ME enabled and check again. Otherwise get a new log from MGtools. If you already deleted it it per my instructions you will have to download and run again. A new version was just uploaded recently too so make sure you use it.
     
    chaslang, Mar 8, 2008
    #10
  11. Ampherion

    Ampherion Private E-2

    Comodo has these files in quarantine:

    C:\Documents and Settings\presence\Local Settings\Temp\xvfe30xn.dll
    C:\Documents and Settings\presence\Local Settings\Temp\27zs8qfi.dll

    The others are pending. I think Comodo sequesters the file until your decide they are safe. They aren't appearing in the spot they were in the filesystem.

    Attached is the MGlogs.zip
     

    Attached Files:

    Ampherion, Mar 8, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    None of your logs are showing any problems. Perhaps these are just new infections that are being blocked.

    I do have a few questions though. What is the below file for?
    Code:
    "C:\WINDOWS\system32\"
keymaker.exe  Mar  8 2008      126976  "keymaker.exe"
    Also what is the below service for?
    And what is in the below new folder?
    Code:
    "C:\"
327882~1      Mar  8 2008              "327882R2FWJFW"
     
    chaslang, Mar 9, 2008
    #12
  13. Ampherion

    Ampherion Private E-2

    I can't say what keymaker.exe is. I can say I didn't put it there, so it must be part of a software package I have installed. I deleted the file.

    O23 - Service: FortiSslvpnDaemon - Fortinet Inc. - C:\WINDOWS\system32\FortiSslvpnDaemon.exe is SSL vpn software used to get access to one of my job sites. This, i know is legit, and shouldn't have any bad things related to it.

    The folder has nothing in it. I checked to make sure nothing odd was hidden in it, but there was nothing. Maybe something that needed a temporary file and didn't clean up? I am playing the Age of Conan beta and some untimely crashes (due to bad code Im sure, it is a beta) have happened.

    I am still seeing some odd things popping up in my documents Local Settings folder...mostly random letter dlls, and I see an autorun.exe has shown up under c:\windows\temp.

    The dlls have names like txhlyz-8.dll, 3hhrstbf.dll, ydq9963l.dll and osnkm8ns.dll. Is this normal?
     
    Ampherion, Mar 9, 2008
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then delete it.

    No this is not normal!

    When do they appear?
    Do they only appear after playing your games?
    What if you reboot your PC and never run any games? Do you still see DLLs appearing?
    Do you have any illegal/pirated/cracked/keygen games or other software installed?
    Did you flush system restore as requested back in message # 7? If not, please flush it now.

    Please run this Running GMER to detect rootkits and attach the requested log.
     
    chaslang, Mar 11, 2008
    #14
  15. Ampherion

    Ampherion Private E-2

    I don't have anything that I know of that is cracked or otherwise pirated. I do run daemon tools to mount an image I made of the bf2 disk so I don't have to leave it in the drive where my 5 year old won't get to it, but thats it. Even then, I don't have a crack or anything like that for it.

    It doesn't appear that this happens when I run games or any software. I ran trillian and comodo and it shows that are new entries in the comodo pending files list. When I look them up in Comodo they all came back unknown. I did submit them to see if comodo can classify them.

    The following files are in my <user>\Local Settings\Temp\ directory (some arent new, I havent cleared them as safe yet):

    4rtr0svz.dll
    4x352c9t.exe
    8znlcqyy.dll
    bkndrkfv.dll
    cctthp5n.dll
    g-nnmqbj.dll
    kvvs8jes.exe
    njejyikw.dll
    \nsg6.tmp\InstallOptions.dll
    \nsg6.tmp\LangDLL.dll
    \nsg6.tmp\services.dll
    ptzndsce.dll
    shdtgdtw.dll
    xdphee72.dll
    zjtj7i-k.dll

    and then some weird crap showing in my recycle bin:
    c:\RECYCLER\S-1-5-21-682003330-1614895754-839522115-1003\Dc1.exe

    I think that Comodo must put files in the "Pending File List" somewhere, because when I look, I don't see these files.

    I am not the soul user for this system, but I don't think of the kids or my gf would do anything odd on this machine, they know I need it for some of my work effort (my notebook runs linux and doesnt have the office tools on it). I know my youngest plays cartoonnetwork.com games and other similar things on the machine but I didn't figure that stuff is too dangerous.

    Here is the log from the rootkit tool (GMER) you asked me to run.
     

    Attached Files:

    Ampherion, Mar 11, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The GMER log is also clean. I'm not sure what is causing these files to show up. Are you sure they are not somehow related to software you are running? Do they only show up after running certain programs? Please try to put the below files into a ZIP file and attach it here:
    4rtr0svz.dll
    4x352c9t.exe
    8znlcqyy.dll
    bkndrkfv.dll
    cctthp5n.dll
    g-nnmqbj.dll
    kvvs8jes.exe
    njejyikw.dll


    Let's also try running a couple of online scanners to see if they reveal anything hiding.

    Run thisUsing BitDefender Online Scan and attach the requested log. Be sure to follow the instructions exactly for creating the log.

    Then run thisRunning HouseCall Online Scan and attach a log.
     
    chaslang, Mar 13, 2008
    #16
  17. Ampherion

    Ampherion Private E-2

    Unfortunately, after running the scan, the files are either moved or removed, so they don't exist after the scans are made. I let the machine run for several days to see if the files show up on their own, and they don't appear to. I did have a few files show up in the Temp directory when updating some of the anti-malware software, so maybe this is the kind of activity that is causing the issue. None the less I have not placed the files in the safe file list for comodo.

    I ran bitdefender online, however I had to cancel it because it was deleting files that I knew were not infected (punkbuster for bf2 and cod4 for one). Housecall states that I am clean as does every other scanner I have. I believe that the system is clean and that just system activity (installing, updating) are causing the files to appear in Temp. I just didn't expect filenames with those kinds of names to be created. I will keep monitoring the system and see what happens. I thank you again for your assistance.
     
    Ampherion, Mar 19, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Make sure that you have completed all of my final instructons from message # 7 now.
     
    chaslang, Mar 19, 2008
    #18

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds