Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Bube Virus Removed Desktop - Can't Get Kaspersky To Work!

  • Please log in to reply
1 reply to this topic

#1 ashtonian


  • Members
  • 1 posts
  • Local time:10:56 PM

Posted 06 August 2007 - 07:33 AM

My daily AVG scan threw up several instances of the Bube virus and seems to have moved explorer.exe to the virus vault - I'm therefore running on a blue screen and using Task Manager to navigate.

I read the tutorial on removing Bube (http://www.bleepingcomputer.com/forums/topic11662.html) and downloaded the Kaspersky trial version - having removed AVG (I'm now very unhappy with AVG as this is the second computer this week that it's messed up on me by moving infected files without notification!).

I installed Kaspersky and began to update the database. It stalled at 3% of the update and the system froze. After a reboot, it won't let me update at all. (I've also tried the online scanner at Kaspersky, but that's returning a 'corrupt database' error halfway through the database too). As I can't access the control panel via Task Manager (unless there's something I've forgotten), I can't uninstall Kaspersky to begin again.

Meanwhile, I ran a PandaScan and this is the log:

Incident Status Location

Adware:adware/aurora Not disinfected C:\WINNT\abiuninst.htm
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINNT\NIRCMD.EXE
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Administrator\Desktop\ComboFix.exe[nircmd.exe]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@apmebf[2].txt
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@statse.webtrendslive[1].txt
Adware:Adware/MediaTickets Not disinfected C:\Program Files\HJT\BACKUPS\backup-20050521-085200-845
Adware:Adware/MediaTickets Not disinfected C:\Program Files\Kerio\Personal Firewall 4\LOGS\WEB.LOG
Virus:Trj/Downloader.MDW Disinfected C:\QooBox\Quarantine\C\WINNT\SYSTEM32\mc-58-12-0000093.exe.vir

I then ran AdAware and removed all the spyware.

My Hijackthis log now is:

Logfile of HijackThis v1.99.1
Scan saved at 13:16:53, on 06/08/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\My Documents\Recovery items\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.co.uk
O2 - BHO: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O3 - Toolbar: Neopets - {CD292324-974F-4224-D074-CACA427AA030} - C:\PROGRA~1\Neopets\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\YAHOO1\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A174EC1-63F2-4FDF-A9B0-CFBA20BC4965}: NameServer =
O20 - Winlogon Notify: klogon - C:\WINNT\system32\klogon.dll
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Unknown owner - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe (file missing)
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

Any suggestions as to how I can get rid of Kaspersky and start again? (Assuming that that's the only way to get rid of the virus). And how on earth do I get explorer.exe back? I'm running an authentic version of Windows 2000 (it validated ok to download the service pack 4), but I can't find the original Windows disk - grrrr

Edit: finally remembered appwiz and managed after a lot of fiddling to uninstall and reinstall Kaspersky. It's reporting no faults found . but still stuck without Explorer.exe

Edited by ashtonian, 06 August 2007 - 10:11 AM.

BC AdBot (Login to Remove)


#2 Falu


  • Security Colleague
  • 3,001 posts
  • Gender:Male
  • Location:The Netherlands
  • Local time:04:56 PM

Posted 18 August 2007 - 05:40 AM

Hi ashtonian, :flowers:

If you still need help please post a fresh HijackThis log and I'll be happy to look at it for you.

A new version of HijackThis has now been released, so before you repost your log please download and install the new version by following the instructions in Step 9 of the Preparation Guide For Use Before Posting A Hijackthis Log. Note that it is unnecessary to uninstall the old version because the new one will be copied to a different folder.

Thanks for your patience! :thumbsup:

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users