 Worm.win32.netbooster, infected computer |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.
To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.
  |
 May 24 2008, 07:28 AM
Post
#1
|
|
|
New Member  Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730  |
I noticed that my computer was infected with this "worm" when various virus alert messages began appearing and my display was changed. I immediately ran avg virus software and removed several trojans, etc. I also searched online for suggestions and subsequently ran SmitFraudFix and SuperAntiSpyware software. I THINK that I have removed the virus BUT not the effects of the virus. For example, when I start my computer in normal mode, a VIRUS ALERT! message is displayed next to the time in the bottom right corner. A more serious problem is the START button. When I click this, the submenu that pops has been altered. Some options are now missing -- RUN, Control Panel, CMD, Programs. I cannot access System Restore from the START button but when I access through another route, it SEEMS that all of my previous restore points have been removed (none of the dates are bolded) and the only available previous restore point is the infected point. When I boot up in safe mode, there are two user accounts shown (this could be nornal for all that I know). There is my regular account and there is an account called ADMINISTRATOR. This ADMINISTRATOR account is not visible in normal startup mode. But when I access this account in Safe Mode, then I have access to the normal Start Button features such as Control panel, RUN, Cmd. etc. I would appreciate it if you could help me determine if the virus still exists and how to restore my computer to a pre-virus stage. Perhaps it is as simple as accessing a "hidden" restore point (wishful thinking). Thank you for your time and effort. |
 |
 
|
 May 24 2008, 08:11 AM
Post
#2
|
|
|
a forum member Group: Members Posts: 1,632 Joined: 27-August 07 Member No.: 153,171 |
can you please post the log report from superantispyware for examination?
to retrieve the scan result Open the superantispyware program and return to the statistics /logs section ; locate the most recent log ; left mouse click on it to highlight it and click the ‘view log’ tab The log should appear in maybe note pad ; you need to copy and paste that log for examination |
|
|
|
|
May 24 2008, 03:27 PM
Post
#3
|
|
|
New Member Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730 |
Thanks for responding to my problem. The log file is as follows:
SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 05/24/2008 at 04:24 PM Application Version : 4.1.1046 Core Rules Database Version : 3468 Trace Rules Database Version: 1459 Scan type : Complete Scan Total Scan Time : 00:11:13 Memory items scanned : 383 Memory threats detected : 0 Registry items scanned : 4268 Registry threats detected : 0 File items scanned : 13042 File threats detected : 0 Thanks for looking at this! |
|
|
|
|
May 24 2008, 03:40 PM
Post
#4
|
|
|
a forum member Group: Members Posts: 1,632 Joined: 27-August 07 Member No.: 153,171 |
your superantispyware log is about as short and brief as on my clean comp!!!
try THIS scan too quote Mod Boopmefrom http://www.bleepingcomputer.com/forums/ind...l=malawarebytes 'QUOTE download Malwarebytes Anti-Malware http://www.besttechie.net/tools/mbam-setup.exe and save it to your desktop. Do Run from normal mode. alternate download link 1 http://malwarebytes.gt500.org/mbam-setup.exe alternate download link 2 http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html Make sure you are connected to the Internet. Double-click on Download_mbam-setup.exe to install the application. When the installation begins, follow the prompts and do not make any changes to default settings. When installation has finished, make sure you leave both of these checked: Update Malwarebytes' Anti-Malware Launch Malwarebytes' Anti-Malware Then click Finish. MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. On the Scanner tab: Make sure the "Perform Quick Acan" option is selected. Then click on the Scan button. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient. When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found". Click OK to close the message box and continue with the removal process. Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found. Make sure that everything is checked, and click Remove Selected. When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below) The log is automatically saved and can be viewed by clicking the Logs tab in MBAM. Copy and paste the contents of that report in your next reply and exit MBAM. Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.' my guess is this will come back clean lets see ............. |
|
|
|
|
May 24 2008, 09:06 PM
Post
#5
|
|
|
New Member Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730 |
Hi:
Since I last contacted you, I discovered a backup registry file that I had saved about two months ago. I restored this file and 99% of my problems disappeared. However, I ran the Malwarebytes program and found several items. The log is as follows: Malwarebytes' Anti-Malware 1.12 Database version: 783 Scan type: Full Scan (C:\|) Objects scanned: 72789 Time elapsed: 8 minute(s), 44 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{17DB10E3-1404-4A67-A4C8-E32AE1A264AF}\RP113\A0026982.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{17DB10E3-1404-4A67-A4C8-E32AE1A264AF}\RP113\A0026987.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Patrick\Local Settings\Tempboome20.exe (Trojan.Agent) -> Quarantined and deleted successfully. It seems that there is still remnants of the trojan present. |
|
|
|
|
May 25 2008, 07:55 AM
Post
#6
|
|
 Bleepin' Janitor Group: Global Moderator Posts: 12,516 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
QUOTE It seems that there is still remnants of the trojan present. Those remnants were successfully removed. How is your computer running now? Any more signs of infection?
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008  |
|
|
|
|
May 25 2008, 08:56 AM
Post
#7
|
|
|
New Member Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730 |
Nothing else showing up! I think that I got off lucky because I had that backup registry file. My previous registry was a mess! I just had to reinstall several small programs to get everything back to normal. One item that was not "restored" was my restore points for the System Restore. These must have been deleted by the virus. Is it possible to determine if they still exist? Thanks.
|
|
|
|
|
May 26 2008, 06:00 AM
Post
#8
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,516 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
Is System Restore turned on and working? System Restore points are located in the System Volume Information (SVI) folder. The SVI folder is protected by permissions that allow only the system to have access and is hidden by default unless you have reconfigured Windows to show it.
-------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
May 26 2008, 08:02 PM
Post
#9
|
|
|
New Member Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730 |
Yes, System Restore is turned on and working. However, it still shows NO previous restore points prior to the infection. Yet when I view the System Volume Information folder, I see about 135 restore points.
Today when I turned on the computer for the first time, my AVG antivirus program found two more trojans, one of these was the same as the infection that I just recovered from. (They were listed as Trojan Horse SHeur.BMEI and Trojan Horse Downloader.Zlob.XIE). I don't know where they came from and I don't know why they were not detected earlier. They were deleted from the computer. |
|
|
|
|
May 26 2008, 09:10 PM
Post
#10
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,516 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
"System Restore Knowledge Base articles & Troubleshooting"
"System Restore: Restoration Failure" "Troubleshoot System Restore: Restore Point Failures" After removing malware from your system you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. Then use Disk Cleanup to remove all but the most recently created Restore Point. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
May 28 2008, 04:43 PM
Post
#11
|
|
|
New Member Group: Members Posts: 6 Joined: 23-May 08 Member No.: 210,730 |
OK, I have done all of that. I think that I was getting reinfection from the System Volume folder, but that is clean now. Thanks for the reading material. Thanks to ruby1 and quietman7 for their comments and suggestions.
|
|
|
|
|
May 29 2008, 06:02 AM
Post
#12
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,516 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
You're welcome.
To protect yourself against malware and reduce the potential for re-infection, be sure to read: • "Simple and easy ways to keep your computer safe". • "How did I get infected?, With steps so it does not happen again!". • "Best Practices - Internet Safety for 2008". • "Hardening Windows Security - Part 1 & Part 2". • "IE Recommended Minimal Security Settings". • "How to Set Security Options in the Firefox Browser". -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
Jul 5 2008, 03:40 PM
Post
#13
|
|
|
New Member Group: Members Posts: 1 Joined: 5-July 08 Member No.: 220,642 |
I have just gotten this virus also. However, I'm having trouble just loading the SmithfraudFix.zip file. When trying to download the zip file I get a popup that says it was identified as spyware or malware and immediated deleted. I'm using NetScape and maybe the security is set to detect it - I don't know. I have AntiVir and have deactivated the "Guard". I also have AdWare 2007, but I don't see anywhere to deactivate it.
Please help.... By the way, I also have many of the symptoms mentioned is this string. Thanks so much! Mike This post has been edited by mdthomas48: Jul 5 2008, 03:52 PM |
|
|
|
|
Jul 6 2008, 07:06 AM
Post
#14
|
|
|
Bleepin' Janitor Group: Global Moderator Posts: 12,516 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513 |
Welcome to BC mdthomas48
If you have an issue or problem you would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members in the same thread with different problems. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette. Thanks for your cooperation. Note: SmitfraudFix is not malware. It is a highly specialized fix tool. However, certain embedded files that are part of legitimate programs or specialized fix tools such as SmitfraudFix may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Some common detections include process.exe, restart.exe, and reboot.exe. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them. In these cases, the detection is a "False Positive". Either have your anti-virus ignore SmitfraudFix or temporarily disable it until you run the tool. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?"
Microsoft MVP - Windows Security 2007-2008 |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 5th September 2008 - 08:32 AM |
© 2003-2008 All Rights Reserved Bleeping Computer LLC.