wvUlllMf (aka as Virtumonde) hidng out in Winlogon

Discussion in 'Malware Help (A Specialist Will Reply)' started by terradale, Aug 24, 2008.

  1. terradale

    terradale Private E-2

    Thank you in advance for any advice regarding my toshiba laptop malady. I've performed all the 'READ & RUN ME FIRST' and attached the logs. Albeit, according to Spybot's -> Advance Mode -> Tools -> System Startup - I've got a wvUllMF . dll hiding out in a possibly fabricated WinLogon sequence.

    Background: On Wednesday night, Aug 6 I started experience problems with my browsers, ie redirects, porno ads, and anti-malaware download popups on PC startup. I use both IE6 and Firefox 1.5.

    I already had Spybot on my computer and ran it almost daily faithfully. It identified 3 Virtumonde trojans, altho it wasn't able to get rid of them. Ended up downloading Malwarebytes and ccleaner. That seemed to have reduce the Virtumonde infections down to the remaining one previousily mentioned. Please note they were idenfied in these programs as wvUlllf.

    I also was running Norton Internet Security 2008. It has since been removed aided by the Norton removal tool. And replaced with Avast. Altho, I haven't been able to figure out or manually remove its quartanine file.

    Prior to Norton, I had Trend Micro 2005 and it should have been removed also. Altho, i can see remnants of both in the log files.

    Also as of today, I uninstalled Spybot & Malwarebytes and then reinstalled them for the 'READ & RUN ME FIRST' procedure. Altho, through the Spybot run - the re-install automatically included the 'teatimer', even tho on download and intital update I specifically requested it not be downloaded. I caught that and turned if off after the Spybot run, and prior to the Malwarebytes, Combofix and MGTools run.

    Please help me get rid of this wvUlllMf and any other nasties it may have downloaded. It's like the mothership and calling in reinforcements when it can. Just when I think I'm clean - all the sudden I'm re-infected again.

    (And apologies for the lengthy background - just thought I'd better clarify where, when and how I got to this stage.)
     

    Attached Files:

    terradale, Aug 24, 2008
    #1
  2. terradale

    terradale Private E-2

    Here's the malwarebytes log...
     

    Attached Files:

    terradale, Aug 24, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I'm only seeing two things to do:

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now use windows explorer to find and delete:
    C:\WINDOWS\Tasks\Norton Internet Security
    C:\DOCUME~1\admin\LOCALS~1\Temp\winvsnet.exe

    Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\%username%\Local Settings\Temp

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.

    Be sure to tell us how things are running.
     
    TimW, Aug 25, 2008
    #3
  4. terradale

    terradale Private E-2

    Thanks Tim!!!
    I'm at work right now and we'll run these fixes on my laptop tonight when I get home.
     
    terradale, Aug 25, 2008
    #4
  5. terradale

    terradale Private E-2

    Hi Tim,
    Apologies for not getting back with you sooner Unfortunately I wasn't able to run the instructions until this Saturday morning. Attached is today's MGlogs.zip.

    Two things:
    - I was not able to find the winvsnet.exe to delete. I looked for it in the directory indicated - not there. Then I ran a windows search - not there. Then I checked the directory and searched for it in safe mode - not there.
    - I checked Spybot's 'system startup' (in the tools section) again after running the MGtools and unfortunately the wvUllMF . dll is still hanging out in there. If you would like I can 'export' the system startup information in Spybot as a .txt file and attach that for you? I'll refrain for now - until I hear from you.

    Oh here's a few other strange things:
    - I got a chance to run Spybot a few times this week (usually when I'm walking the dog in the morning) and each time there was nothing to delete. Very odd - usually it finds a zedo, or some other markeing cookies to delete.
    - I ran Malwarebytes Anti-Malware once this week and the first run indicated an infection, but for some reason before I could perform a 'delete' action, the program shut down on me. When I ran it again, there was nothing found to delete.

    Have a great weekend.
    Hope to hear from you when you get a chance. I am able to hang out on the internet without a problem (ever since I updated java), albeit I'm not doing any thing that would require entering passwords of any sort. (Altho, I do need to sooner or later.)
     

    Attached Files:

    terradale, Aug 30, 2008
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It came out of hidding.....

    Please Disable Spybot's TeaTimer

    * Run Spybot and click Mode
    * Select Advanced Mode.
    * Then click Tools and select Resident.
    * Now in the right window pane, uncheck TeaTimer.
    * Also while this is open, in the left column now select IE Tweaks
    * and then in the right pane make sure all the Miscellaneous locks are unchecked.
    * Now quit Spybot!

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file.
     
    Last edited: Aug 30, 2008
    TimW, Aug 30, 2008
    #6
  7. terradale

    terradale Private E-2

    Hi Tim,
    Me again... I performed the instructions and today's MGlogs is attached.

    I did reboot after completing the instructions and unfortunately the wvUllmf . dll is still showing in the Spybot 'System Startup' report.

    If you would like I can export that to a report and attach it. Again, I'll refrain from attaching it until I hear back from you.

    Thanks for all you help and staying with me.
     

    Attached Files:

    terradale, Sep 6, 2008
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It is not in your logs......did you look in your start folder to see if the remnant is there?

    You could attach the spybot log.
     
    TimW, Sep 6, 2008
    #8
  9. terradale

    terradale Private E-2

    Thanks Tim.

    I attached the spybot system startup report. wvUlllMF is the very last entry.

    Please note that when I first uncovered this thing, Aug 6, one of first things I did was check the add/remove programs and noticed all of my spyware (spybot, Norton, adaware and remove programs I had forgotten about when I the Vundo virus in 2005) had been touched and it was in the one day in the FUTURE -Aug 7! I went through and removed all these and then reloaded them. Spybot & Norton continued to find the Vundo and Virtumonde infections. And I was still having problems with redirects and unwanted porno and spyware ads. I downloaded the latest java and that seem to have fix the redirects and ads. Altho, this wvUlllMF . dll won't go away. So I found you all, removed Norton completely (replaced with AVAST a few days later) and downloaded all your tools and ran them in both normal and safe mode. Spybot, Malwarebytes and SUPERAntiSpyware all indicated they found a Vundo or Virtumonde and fix it. Altho Spybot 'System Startup' report continues to report this damn :) .dll.

    And finally to answer your question - yes I've check the startup in both MSCONFIG and CCLeaner and can't find it there. Also in the beginning I ran a system search and found the wvUlllMF . dll and deleted it manually. But it keeps appearing in the 'System Startup' report in the WINlogon sequence. I uncheck it and two second later the entire Winlogo sequence is rechecked. At one point I unchecked everything in startup and it (the WINlogon sequence) rechecks itself.

    And finally, finally :) I noticed in the last two weeks that Spybot & Malwarebytes never finds any cookies nor infections. Which leads me to think these programs are malfunctioning. I've uninstalled and reloaded Spybot and Malwarebytes and its innards (for lack of a better word) many times hoping to get a fresh run to no avail.

    Its almost like - once this thing gets touched by one remove program it hides and regenerates itself somewhere else.

    Apologies for the history report. But, I need to get this off my computer, I haven't used any of my banking (even changed banks) nor buying programs once I realized it was there and I've got a whole lot of donating to do - to good folks like yourself !!!
     

    Attached Files:

    terradale, Sep 6, 2008
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Strange as it is a zero size item...go to Bitscan link: agree to the license and then select Scan. DO NOT CHANGE THE OPTIONS TO SHOW ALL FILES SCANNED. That will make your logs huge and we don't need to see clean files. Once Bitdefender completes the scan:

    Click-on the Detected Problems tab. Then select Click here to export the scan report

    When the window comes up to save the report, change the Save as type: box to Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click save. This will save a file named bdscan.txt in whatever folder you are currently in when you save the file (take notice of where you are at so you can find it later). This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.
     
    TimW, Sep 6, 2008
    #10
  11. terradale

    terradale Private E-2

    Here's the report from Bitscan. My system almost crashed when it deleted the Vundo . Fhh. There's a trojan . crypt . o that it wasn't able to delete tho.

    Thought I'd also mention that wvUlllMf is still appearing in the spybot 'system startup' report. I unchecked everything in the startup, clicked out of the spybot tools and then went back to it and again the Winlogon sequence was rechecked, as well as a 2nd 'C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe' appeared that also checked itself.

    Look forward to hearing about the latest.
     

    Attached Files:

    Last edited: Sep 7, 2008
    terradale, Sep 7, 2008
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Interesting ...since it was not in any of your previous logs......and I can find no reference to the wvUlllMF.dll

    Disable TeaTImer again if it is not already...then download The Avenger by Swandog469, and save it to your Desktop.

    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.
     
    TimW, Sep 7, 2008
    #12
  13. terradale

    terradale Private E-2

    Apologies for the delay in getting back to you. Attached is the avenger log and the latest mglogs.zip file. Please note that the spybot's -> tools -> system startup still reports that wvUlllMf . dll is still hanging out in winlogon after running the avenger instructions.
     

    Attached Files:

    terradale, Sep 21, 2008
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The problem is with Spybot.....the file does not exist in any of your logs and even avenger reports that it does not exist.
     
    TimW, Sep 21, 2008
    #14
  15. terradale

    terradale Private E-2

    Tim,
    I was thinking that too. Altho, I ended up going in to regedit and did a find on 'wvUlllmf' and found it under Windows NT -> Current Version -> WinLogon -> Notify_Disabled. And there it lies in its own little folder. The right window has this to say:

    ------------------------------------------------
    (Default) REG_SZ (value not set)
    Asynchronous REG_DWORD (0x00000001 (1)
    DllName REG_SZ wvUlllMf.dll
    Impersonate REG_DWORD (0x00000000 (0)
    Logoff REG_SZ f
    Logon REG_SZ o
    ------------------------------------------------

    Also, I checked the other winlogon folders and they all have an 'impersonate' type thing in each folder too - is that normal?

    Any advise you may have would be much appreciated.
     
    terradale, Sep 21, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Try the below.

    Copy the bold text below to notepad. Save it as fixWLND.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Then recheck Spybot to see if the key actually deleted. Do not open Spybot until you have done the above. If this does not delete the registry key it will have to be forcefully deleted using Avenger or ComboFix.
     
    chaslang, Sep 21, 2008
    #16
  17. terradale

    terradale Private E-2

    I think its gone. I'll run some add'l spyware programs in case it renamed itself. But, I can no longer find it in the registry by the name wvUlllMf nor in spybot under the tools -> system startup. The winlogon sequence (for lack of better word) is still checked. But, it looks normal.

    Thanks for hanging in there with me. I'm going to give it a few days before I use any banking type programs. Then you all will get a donation.
     
    terradale, Sep 22, 2008
    #17
  18. terradale

    terradale Private E-2

    ops...forgot to mention - I received a 'success' msg when the regedit4 was ran.
     
    terradale, Sep 22, 2008
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know....now we just need to clean up from all the scans:

    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    If you get a success message, then it is time to do our final steps:


    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.
    2. If we used Pocket Killbox during your cleanup, do the below

      * Run Pocket Killbox and select File, Cleanup, Delete All Backups
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combo-fix folder from combofix.

    4. If we had you run Avenger, you can delete all files related to Avenger now.
    5. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    8. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    9. Go to add/remove programs and uninstall HijackThis.
    10. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    11. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    12. After doing the above, you should work thru the below link:

     
    TimW, Sep 22, 2008
    #19
  20. terradale

    terradale Private E-2

    Sorry peoples - still having problems. I performed all the 'clean up' instructions and after the reboot and just for kicks, I did a windows search on 'wvu*' and guess what I found. wvulllmf hanging out in the following:

    - wininit c:\WINDOWS 1kb Configuration File Date created: 8/10/08 Date modifed 8/17/18. I opened the file and it contains

    =====================================
    '[rename]' then 'c:\tempjunk3647.tmp=C:\WINDOWS\SchedLgU.Txt_tobedeleted
    nul=c:\tempjunk3018.tmp
    c:\tempjunk2553.tmp=C:\WINDOWS\SchedLgU.Txt_tobedeleted'
    ---(about 9 times)---
    then the last line is:
    'c:\tempjunk3018.tmp=C:\WINDOWS\system32\wvUlllMf.dll'
    =====================================

    I looked up wininit and found that it is a legit vista exe. Unforuntately, my system is XP. Could this be WOLLF.16 virus?

    - Then I found wvulllmf surrounded by a whole bunch of startup code in 'CollectedDate_02524 'c:Windows\PCHealth\HelpCtr\DataCol 1072kb XML Doc Date created: 8/25/08 Date modifed 8/25/08'

    Since this started I wondered what PCHealth is and looked it up and some say its a toshiba (which my laptop is) utility others mention trojan W32.Cone worm-

    I didn't open the following but there's also a regLocal and regUsers registration Entries created on 9/21/2008 both approx 23,000kb at 11:39p that was returned during the windows search.

    Other symptoms of still being infected:

    I uninstalled and reloaded spybot (without teatimer) and it still is not identify any problems. Nothng, nada - not even a cookie.

    My Avast! Home Version 4.8 'Resume Provider' is greyed out. I'm new to Avast and not sure if that's the way its supposed to be.

    Do we start over? New thread? Or are these fixes?

    Sorry!!!






    -
     
    terradale, Sep 23, 2008
    #20
  21. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    We start over......
    ComboFix
    SAS
    MWB's
    MGTools

    little bugger needs to die!!!! :)
     
    TimW, Sep 23, 2008
    #21

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds