Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

prunnet.exe stays in registry


  • Please log in to reply
14 replies to this topic

#1 virusbegone

virusbegone

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 10 February 2009 - 02:28 PM

Hi,

I want to start by commending the people at bleeping computer for the excellent "service" they provide to the community.

My computer has been infected (off youtube!) and I have removed all kinds of malware from it. However, I have been infected with prunnet and no matter how many times I remove the registry entry either using regedit or malwarebytes, it keeps popping back in. This trojan manifests itself in turning on my computer when I have set it to sleep. I am trying to get rid of it completely one last time before i go around reformatting my computer.

Any information/advice is very welcome.

I've read some of the forum topics here and generated DDS and ComboFix logs but am not posting them as that is what people have been asked not to do.

thanks.

Edited by virusbegone, 10 February 2009 - 02:38 PM.


BC AdBot (Login to Remove)

 


#2 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 10 February 2009 - 03:25 PM

Ok we can still try a few things here first.
From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining
.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode
.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#3 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 11 February 2009 - 05:01 PM

Thank you for your suggestions.

I installed SuperAntispyware (SAS) and ATF-Clearner and then rebooting into safe mode, ran ATF-Cleaner first and SAS later. SAS returned "no malicious spyware found" message. On checking registry I could not find prunnet.exe. Also scanning with Malwarebytes did not find prunnet (it always did so in the past). Prunnet is also gone from spybot teatimes startup list.

My guess is ATF-Cleaner did the trick.

However I do get Symantec Antivirus auto-protect turned off warning a few minutes after logging in.

I also have a few more questions.

1) SAS is now installed on my computer which also has symantec. From my understanding having two such things on is not a good idea. Is that correct? What is your suggestion (keeping in mind the warning i get)?

2) Turning on tea-timer, led to a bunch of messages from teatimer. One was obviously related to SAS and I allowed the change. But dissallowed screensaver.exe. I have one more about DisableCMD and I expect more later. Does this have any thing to do with ATF-Cleaner? How should this be addressed?

3) since I have Symantec installed, I have turned of Windows firewall. Is that correct?


Thanks in advance for your time. I hope ATF-clearner might have done the trick. It is just a "memory remover". I wonder why that would have worked.

best and thanks.

#4 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 11 February 2009 - 06:42 PM

After turning on tea-timer, I realized that the registry item had come back on (does that mean some tea-timer applications are infected?).

So I rebooted into safe mode and ran cleaner and SuperAntiSpyware again. This time this is what I got.



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/11/2009 at 06:32 PM

Application Version : 4.25.1012

Core Rules Database Version : 3752
Trace Rules Database Version: 1718

Scan type : Complete Scan
Total Scan Time : 01:23:34

Memory items scanned : 207
Memory threats detected : 0
Registry items scanned : 4386
Registry threats detected : 1
File items scanned : 44677
File threats detected : 0

Adware.Prun
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#prunnet [ "C:\WINDOWS\system32\prunnet.exe" ]

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 11 February 2009 - 08:41 PM

We usually ask to turn off SpyBot or disable teatimer when we know it is installed. It interferes many times in a few different ways with several Malware tools. I knew SA should get . http://www.superantispyware.com/definition/prunnet/
So chalk it up to interference. How is the machine running now?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 12 February 2009 - 08:02 PM

The "Symantec Auto-protect is turned off" warning still shows up and prunnet.exe still exists in registry.

Should the quarantined item in SA be removed?

thanks.

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 12 February 2009 - 08:11 PM

Yes delete the quarantine. is Reatimer turned off also?
Run SUPER again.

RERUN MBAM

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select FULL scan and scan.
After scan click Remove Selected, Post new scan log and Rebootinto normal mode.

Edited by boopme, 12 February 2009 - 08:13 PM.

How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 13 February 2009 - 09:38 AM

I removed the item quarantined by SAS. Further scans by SAS and MBAM show a clean computer.

This is with Teatimer turned off. clearly Teatimer is compromised. So I am going to uninstll spybot and then reinstall the latest and keep teatimer off.

Symantec Anti-Virus Auto protect turned off warning still flashes on the screen. So I wonder how to take care of this. (I hae updated Symantec).

Since these different anti spyware and anti virus programs interfere with each other and since I installed one or two for the current cleanup, I want to check if the following setup is considered useful.

1) keep windows firewall turned off
2) keep symantec corporate edition which seems to come with windows turned off
2) keep spybot with teatimer turned off.
3) keep symantec anti-virus provided I figure out why Auto-protect turned off warning keeps flashing.

keep SAS and MBAM for scanning purposes only.

Thanks a lot for your help and time.

#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 13 February 2009 - 12:28 PM

1) keep windows firewall turned off
What other firewall is running? We need one.

2) keep symantec corporate edition which seems to come with windows turned off.
If this is not paid and you are not going to use it ,I would uninstall it .

2) keep spybot with teatimer turned off.
Same as above. You have better detection rates with MBam and SAS and they will be only on demand scanners in the free versions. The teatimer was the only active protection in Spybot.
3) keep symantec anti-virus provided I figure out why Auto-protect turned off warning keeps flashing.
Again is this Paid version? If not i wold suggest an alternative,if needed. A uninstall and reinstall usually fixes that issue.

keep SAS and MBAM for scanning purposes only.
Yes update at keast weekly and prior to scanning.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 13 February 2009 - 05:27 PM

1) keep windows firewall turned off
What other firewall is running? We need one.

2) keep symantec corporate edition which seems to come with windows turned off.
If this is not paid and you are not going to use it ,I would uninstall it .

2) keep spybot with teatimer turned off.
Same as above. You have better detection rates with MBam and SAS and they will be only on demand scanners in the free versions. The teatimer was the only active protection in Spybot.
3) keep symantec anti-virus provided I figure out why Auto-protect turned off warning keeps flashing.
Again is this Paid version? If not i wold suggest an alternative,if needed. A uninstall and reinstall usually fixes that issue.

keep SAS and MBAM for scanning purposes only.
Yes update at keast weekly and prior to scanning.


I have no other firewall running. I turned it off because I was under the impression that one should either have firewall running or an anti-virus software but not both. If that impression is mistaken, I'll turn firewall back on.

symantec corporate edition is not paid for. I'll uninstall it. However, the Symantec Anti-Virus is subscription and I'll keep it. I understand that the warnings are not significant and can be easily taken care of by uninstalling and reinstalling.

thanks.

#11 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 13 February 2009 - 06:13 PM

Ok yes ,rule of thumb = 1 AV active,1 software firewall (eg the windows wall) and several anti spy like MBam,SAS Spybot etc..
Was this an XP pc? consider installing SpywareBlaster from our list here.... http://www.bleepingcomputer.com/forums/topic3616.html
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#12 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 14 February 2009 - 01:18 AM

Thanks for all your help and info. My computer is now free of malware.

Best wishes.

#13 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 14 February 2009 - 09:39 AM

Excellent,you're welcome. Please finish with this.
Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#14 virusbegone

virusbegone
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:08:33 AM

Posted 14 February 2009 - 11:01 PM

great! done with the new restore point.

Thanks for all the help.

Edited by virusbegone, 14 February 2009 - 11:01 PM.


#15 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 72,740 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:33 AM

Posted 14 February 2009 - 11:09 PM

You're welcome , please take a moment to read quietman7's excellent prevention tips in post 17 here
Click>>Tips to protect yourself against malware and reduce the potential for re-infection:

Hey you turned on the firewall correct!!
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users