Vundo - DO NOT WANT!!

Discussion in 'Malware Help (A Specialist Will Reply)' started by pavlovscat, May 15, 2008.

  1. pavlovscat

    pavlovscat Private E-2

    I run SpyWareBlaster, SpyBot & SD, and Ad-Aware paid version with Ad-Watch real time scanning. I acquited Smitfraud-C, Virtumonde, Fake Alert, Renos, Spylocked, ZlobDownloader and Vundo.

    I ran SmitFraudFix and VundoFix. Then I followed all the steps in your Malware Removal thread. I still have several entries that refuse to be cleaned. I also re-ran the recommended programs from Safe Mode.

    I have attached my logs. Any help would be greatly appreciated.
     

    Attached Files:

    pavlovscat, May 15, 2008
    #1
  2. pavlovscat

    pavlovscat Private E-2

    Here are the remaining logs. Thanks.
     

    Attached Files:

    pavlovscat, May 15, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you haven't already, please disable the Guest account in User accounts.

    You appear to have no anti-virus installed!!

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\%username%\Local Settings\Temp

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Be sure to tell us how things are running.
     
    TimW, May 15, 2008
    #3
  4. pavlovscat

    pavlovscat Private E-2

    Hey, Tim & thanks for your prompt help.

    The guest account was already disabled. I forgot to mention that I run McAfee VirusScan Enterprise 8.0.0 with auto updates at startup. So I don't have to remember it. ;) Also, I ran C:\MGtools\analyse.exe and fixed the listed files.

    I created the fixME.reg file as instructed with "all files" seclected. When I double click the file, I get get the Are you sure? prompt to which I answered Yes. Then I get the following message:

    Cannot import C:\Documents and Settings\Administrator\Desktop\fixME.reg:
    The specified file is not a registry script.
    You can only import binary registry files from within the registry editor.

    What now?
     
    pavlovscat, May 15, 2008
    #4
  5. pavlovscat

    pavlovscat Private E-2

    Sorry, my mistake. I copied the webpage into Notepad so I could view it offline. I didn't realize that REGEDIT4 went at the head of the document. :eek: So, I fixed that and followed the remaining instructions. The requested logs are attached.

    So far so good. I am not getting the incessant pop-ups I had before. We'll see how things go from here.
     

    Attached Files:

    pavlovscat, May 15, 2008
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Code:
    Users on this computer:
Is Admin? | Username
------------------
   Yes    | Administrator
          | ASPNET
          | Guest 
          | HelpAssistant (Disabled)
   Yes    | stalin
          | SUPPORT_388945a0 (Disabled)
    Apparently it isn't disabled.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\%username%\Local Settings\Temp

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.
     
    TimW, May 16, 2008
    #6
  7. pavlovscat

    pavlovscat Private E-2

    OOPS! Didn't realize our 2 pcs are a network, so I followed the wrong help topic. I guess that's what the router does? I found the section you copied, and this time Guest is definitely disabled.
    I followed all your instructions (again - sorry!) and attached my logs. I hope I got it right this time. Thanks.
     

    Attached Files:

    pavlovscat, May 16, 2008
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I'm sorry...I don't understand what you are saying...are you indicating that you are doing a fix from the wrong computer? Are you having another malware thread working for a second system?

    Please disable all anti-virus (if you have installed one) and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Be sure to tell us how things are running.
     
    TimW, May 16, 2008
    #8
  9. pavlovscat

    pavlovscat Private E-2

    No, the other pc is fine. It is only mine with the problems. I followed the Windows help file for disabling users on single computers, not networked, so I hadn't done the proper things to disable Guest. But, it is done now.

    I have been running my scans through Safe Mode to disable the anti-virus & anti-spyware. Is this wrong? Should I be doing it through Normal Mode?
     
    pavlovscat, May 16, 2008
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Safe mode is fine...but just being in safe mode does not disable the programs.
     
    TimW, May 16, 2008
    #10
  11. pavlovscat

    pavlovscat Private E-2

    Here are the new logs.
     

    Attached Files:

    pavlovscat, May 16, 2008
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Sweet....Your logs look clean.

    If you are not having any other malware problems, it is time to do our final steps:

    1. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    2.
    * Click START then RUN
    * Now type "%userprofile%\Desktop\cf" /u in the runbox and click OK.
    * Note: The space between the cf and the /U, it must be there.
    3. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    4. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    5. If you are running Windows XP or Windows ME, do the below:
    * Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
    * Then reboot and Enable System Restore to create a new clean Restore Point.
    6. After doing the above, you should work thru the below link:
    How to Protect yourself from malware!
     
    TimW, May 17, 2008
    #12
  13. pavlovscat

    pavlovscat Private E-2

    That is such a relief. Thank you very much, you are a jewel. If I wasn't already married...;)

    I am off to do the protection list!
     
    pavlovscat, May 17, 2008
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you weren't already married......oh, nevermind. :-D

    You are most welcome...safe surfing. :)
     
    TimW, May 17, 2008
    #14
  15. pavlovscat

    pavlovscat Private E-2

    I was running Spybot S&D's Teatimer & Lavasoft's Ad-Watch at the same time when I picked up Smitfraud-C & friends and ended up with Vundo. I know now not to do that. What is your opinion of Ad-Aware & Ad-Watch. I have a paid subscription through the end of 2009 for real-time scanning and auto-updates. Should I call it a loss, scrap it & buy one of the ones on your list? Or will this do the job now that Teatimer is disabled?

    I've got everything else on the prevention list done. Thanks for the help.
     
    pavlovscat, May 18, 2008
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If it is paid for....keep it till it expires and then choose one of the freeware programs from Top Freeware Picks.
     
    TimW, May 19, 2008
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds