Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Worm.win32.netbooster


  • Please log in to reply
13 replies to this topic

#1 prb_nearnorth

prb_nearnorth

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 24 May 2008 - 07:28 AM

Hello:
I noticed that my computer was infected with this "worm" when various virus alert messages began appearing and my display was changed. I immediately ran avg virus software and removed several trojans, etc. I also searched online for suggestions and subsequently ran SmitFraudFix and SuperAntiSpyware software. I THINK that I have removed the virus BUT not the effects of the virus.

For example, when I start my computer in normal mode, a VIRUS ALERT! message is displayed next to the time in the bottom right corner. A more serious problem is the START button. When I click this, the submenu that pops has been altered. Some options are now missing -- RUN, Control Panel, CMD, Programs. I cannot access System Restore from the START button but when I access through another route, it SEEMS that all of my previous restore points have been removed (none of the dates are bolded) and the only available previous restore point is the infected point.

When I boot up in safe mode, there are two user accounts shown (this could be nornal for all that I know). There is my regular account and there is an account called ADMINISTRATOR. This ADMINISTRATOR account is not visible in normal startup mode. But when I access this account in Safe Mode, then I have access to the normal Start Button features such as Control panel, RUN, Cmd. etc.

I would appreciate it if you could help me determine if the virus still exists and how to restore my computer to a pre-virus stage. Perhaps it is as simple as accessing a "hidden" restore point (wishful thinking). Thank you for your time and effort.

BC AdBot (Login to Remove)

 


#2 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:07:36 AM

Posted 24 May 2008 - 08:11 AM

can you please post the log report from superantispyware for examination?
to retrieve the scan result

Open the superantispyware program and return to the statistics /logs section ; locate the most recent log ; left mouse click on it to highlight it and click the ‘view log’ tab

The log should appear in maybe note pad ; you need to copy and paste that log for examination

#3 prb_nearnorth

prb_nearnorth
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 24 May 2008 - 03:27 PM

Thanks for responding to my problem. The log file is as follows:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/24/2008 at 04:24 PM

Application Version : 4.1.1046

Core Rules Database Version : 3468
Trace Rules Database Version: 1459

Scan type : Complete Scan
Total Scan Time : 00:11:13

Memory items scanned : 383
Memory threats detected : 0
Registry items scanned : 4268
Registry threats detected : 0
File items scanned : 13042
File threats detected : 0

Thanks for looking at this!

#4 ruby1

ruby1

    a forum member


  • Members
  • 2,375 posts
  • OFFLINE
  •  
  • Local time:07:36 AM

Posted 24 May 2008 - 03:40 PM

your superantispyware log is about as short and brief as on my clean comp!!!

try THIS scan too

quote Mod Boopmefrom

http://www.bleepingcomputer.com/forums/ind...l=malawarebytes

'QUOTE
download Malwarebytes Anti-Malware
http://www.besttechie.net/tools/mbam-setup.exe

and save it to your desktop. Do Run from normal mode.
alternate download link 1 http://malwarebytes.gt500.org/mbam-setup.exe
alternate download link 2 http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
Make sure you are connected to the Internet.
Double-click on Download_mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
Make sure the "Perform Quick Acan" option is selected.
Then click on the Scan button.
If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.'

my guess is this will come back clean

lets see .............

#5 prb_nearnorth

prb_nearnorth
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 24 May 2008 - 09:06 PM

Hi:
Since I last contacted you, I discovered a backup registry file that I had saved about two months ago. I restored this file and 99% of my problems disappeared. However, I ran the Malwarebytes program and found several items. The log is as follows:

Malwarebytes' Anti-Malware 1.12
Database version: 783

Scan type: Full Scan (C:\|)
Objects scanned: 72789
Time elapsed: 8 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{17DB10E3-1404-4A67-A4C8-E32AE1A264AF}\RP113\A0026982.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{17DB10E3-1404-4A67-A4C8-E32AE1A264AF}\RP113\A0026987.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Patrick\Local Settings\Tempboome20.exe (Trojan.Agent) -> Quarantined and deleted successfully.

It seems that there is still remnants of the trojan present.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:36 AM

Posted 25 May 2008 - 07:55 AM

It seems that there is still remnants of the trojan present.

Those remnants were successfully removed. How is your computer running now? Any more signs of infection?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 prb_nearnorth

prb_nearnorth
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 25 May 2008 - 08:56 AM

Nothing else showing up! I think that I got off lucky because I had that backup registry file. My previous registry was a mess! I just had to reinstall several small programs to get everything back to normal. One item that was not "restored" was my restore points for the System Restore. These must have been deleted by the virus. Is it possible to determine if they still exist? Thanks.

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:36 AM

Posted 26 May 2008 - 06:00 AM

Is System Restore turned on and working? System Restore points are located in the System Volume Information (SVI) folder. The SVI folder is protected by permissions that allow only the system to have access and is hidden by default unless you have reconfigured Windows to show it.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 prb_nearnorth

prb_nearnorth
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 26 May 2008 - 08:02 PM

Yes, System Restore is turned on and working. However, it still shows NO previous restore points prior to the infection. Yet when I view the System Volume Information folder, I see about 135 restore points.

Today when I turned on the computer for the first time, my AVG antivirus program found two more trojans, one of these was the same as the infection that I just recovered from. (They were listed as Trojan Horse SHeur.BMEI and Trojan Horse Downloader.Zlob.XIE). I don't know where they came from and I don't know why they were not detected earlier. They were deleted from the computer.

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:36 AM

Posted 26 May 2008 - 09:10 PM

"System Restore Knowledge Base articles & Troubleshooting"
"System Restore: Restoration Failure"
"Troubleshoot System Restore: Restore Point Failures"

After removing malware from your system you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. Then use Disk Cleanup to remove all but the most recently created Restore Point.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 prb_nearnorth

prb_nearnorth
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 28 May 2008 - 04:43 PM

OK, I have done all of that. I think that I was getting reinfection from the System Volume folder, but that is clean now. Thanks for the reading material. Thanks to ruby1 and quietman7 for their comments and suggestions.

#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:36 AM

Posted 29 May 2008 - 06:02 AM

You're welcome.

To protect yourself against malware and reduce the potential for re-infection, be sure to read:
• "Simple and easy ways to keep your computer safe".
• "How did I get infected?, With steps so it does not happen again!".
• "Best Practices - Internet Safety for 2008".
• "Hardening Windows Security - Part 1 & Part 2".
• "IE Recommended Minimal Security Settings".
• "How to Set Security Options in the Firefox Browser".
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#13 mdthomas48

mdthomas48

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:36 AM

Posted 05 July 2008 - 03:40 PM

I have just gotten this virus also. However, I'm having trouble just loading the SmithfraudFix.zip file. When trying to download the zip file I get a popup that says it was identified as spyware or malware and immediated deleted. I'm using NetScape and maybe the security is set to detect it - I don't know. I have AntiVir and have deactivated the "Guard". I also have AdWare 2007, but I don't see anywhere to deactivate it.

Please help....

By the way, I also have many of the symptoms mentioned is this string.

Thanks so much!
Mike

Edited by mdthomas48, 05 July 2008 - 03:52 PM.


#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,744 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:02:36 AM

Posted 06 July 2008 - 07:06 AM

Welcome to BC mdthomas48

If you have an issue or problem you would like to discuss, please start your own topic. Doing that will help to avoid the confusion that often occurs when trying to help two or more members in the same thread with different problems. Even if your problem is similar to the original poster's problem, the solution could be different based on the kind of hardware, software, system requirements, etc. you are using and the presence of other malware. Further, posting for assistance in someone else's topic is not considered proper forum etiquette.

Thanks for your cooperation.

Note: SmitfraudFix is not malware. It is a highly specialized fix tool. However, certain embedded files that are part of legitimate programs or specialized fix tools such as SmitfraudFix may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case. Some common detections include process.exe, restart.exe, and reboot.exe.

These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them. In these cases, the detection is a "False Positive". Either have your anti-virus ignore SmitfraudFix or temporarily disable it until you run the tool.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users