BleepingComputer.com: BackDoor.Generic11.ZNE

Hey,

I'm pretty sure I've got a Trojan Horse up to no good on my machine. AVG 8's ResidentShield app repeatedly picks it up - I get the standard "Threat Detected" dialog box - and calls it a BackDoor.Generic11.ZNE. It seems to be repeatedly creating a file in my Windows/System32 folder called hjgruidrtsrfiu.dll, which AVG catches and quarantines, but within seconds it's back. I think it's being created when a number of user-initiated processes begin running: the most recent examples are C:\Windows\System32\taskeng.exe, C:\Windows\System32\RacAgent.exe, and, rather ironically, C:\Program Files\AVG\AVG8\avgcsrvx.exe. But it also appears when running many other processes.

In fact, I observe that opening the Control Panel is particularly good way to bring on a multiple threat detection. Telling AVG to remove the threats actually provokes a further two, always related to the processes C:\Windows\System32\SearchProtocolHost.exe and C:\Windows\System32\SearchFilterHost.exe. In each instance, the infected file is identically-named: hjgruidrtsrfiu.dll.

This traps me in a repeated cycle of okaying AVG's removal of the file, though doing so doesn't seem to lead to any major system instability. Depsite repeated full system scans, AVG doesn't seem to be able to get to the root of the problem, because it keeps popping up again with depressing regularity.

I haven't noticed much system performance degradation as yet, although, Windows informs me that "unauthorised changes" have been made which will prevent me from getting updates, and indeed this is now the case. Also, once I was informed Windows DNS controls are not working properly and had to be shut down. But the next time I started up the problem seemed to have gone away.

I've done a couple of web searches and this particular nasty seems to be a new one on most people. There are only a few other hits that Google returns to the search string "BackDoor.Generic11.ZNE" - one of them is an unanswered post on this very forum, in fact, just yesterday. The others are all on French or German-language forums, which isn't much help to me as I'm one of those awful monoglot Anglophones, but again they're dated very recently.

Any help much appreciated. Fraid I'm new to this business so I am not sure what system information you are likely to need. As a starting point, here's the basics:

Windows Vista HomePremium
Processor: Intel® Core™2 Quad CPU Q6600 @2.4GHz
Memory(RAM): 3.00GB
System Type: 32-bit Operating System


Thanks in advance,

Hi and welcome to BleepingComputer

Let's start with Malwarebytes

The process of cleaning your computer may require temporarily disabliling some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
  
• Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note:
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Note 2:
-- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

I have the same exact issue on my desktop. AVG Resident Shield is detecting multiple threats...

File: System32/hjgruimempuvue.dll Infection: Trojan horse BackDoor.Generic 11.ZNE

I have AVG 8.5, Malewarebytes and Spy Bot. When I first ran my scans, the system became unstable so I disconnected from my router and turned off the Resident Sheild; I ran all three scans in Normal and Safe Mode twice and everything was "clean" after the second run. I then hopefully turned back on the Resident Shield and found that the Infection was still there. I need some major help! Thanks in advance!!!

Sorry~

You must start a new topic if you are going to do this. Moderators are trying to help others. In the meantime, please be patient and they will reach you. Don't hijack other people's topics.

my apologies! I'm new to the site and didn't realize the rules... I thought it was an open forum and in no way was trying to "hyjack" someones post. I have opened my own thread. Thanks.