Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I have a case of the VUNDO


  • Please log in to reply
17 replies to this topic

#1 shempdevil

shempdevil

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 01 March 2010 - 04:56 PM

I am pretty sure I have the VUNDO malware.
I get redirected to solicitation sites all of the time.
I have tried to get rid of it by:
Running CCleaner in SafeMode
Running Spybot in SafeMode
Running Advanced System Care in SafeMode
Running HJT and getting rid of all suspicious registry lines
Deleting unknown lines from my Startup Menu
Deleting known VUNDO-related files from my C: Drive

It is still with me.

I want to run Combofix but need some guidance.
I already have it on my desktop and I'm ready to go.

Thanks in advance for your assistance.

Matthew

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 02 March 2010 - 11:05 AM

Please note the message text in blue at the top of this forum.

No one should be using ComboFix unless specifically instructed to do so by a Malware Removal Expert who can interpret the logs. It is a powerful tool intended by its creator to be "used under the guidance and supervision of an expert. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again. Please read the pinned topic ComboFix usage, Questions, Help? - Look here.

Further, ComboFix logs are not permitted outside the Virus, Trojan, Spyware, and Malware Removal Logs forum and then only when requested by a Malware Response Team member. However, the Malware Response Team members are all volunteers who contribute to helping members as time permits but currently there is a backup and you may have to wait for assistance. Referrals are made to the that forum if we cannot assist you in this forum.

Please download Malwarebytes Anti-Malware (v1.44) and save it to your desktop.Download Link 1
Download Link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 02 March 2010 - 05:21 PM

I would love to run another malware program.
The problem is that whenever I try to download and install one it doesn't work.
I download it to my desktop and when I click the icon, it says "The item "mbam.exe" that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly."

I have tried other spyware removal programs with the same results.
This is what has led me to believe that I need the combofix cure.

I hope I am wrong.

#4 Sashacat

Sashacat

  • Members
  • 372 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 02 March 2010 - 05:35 PM

Hello :thumbsup:

The guide that quietman7 referred you to has information that will help you:
How to use Malwarebytes' Anti-Malware to scan and remove malware from your computer
Posted by Grinler on February 16, 2010

http://www.bleepingcomputer.com/virus-remo...alware-tutorial

(See the "Troubleshoot" section.)
If we don't change the direction we are going,
We are likely to end up where we are headed.

#5 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 02 March 2010 - 05:54 PM

I just tried renaming the file all of the names that were suggested.
I then tried RKill and tried renaming that.
No luck

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 02 March 2010 - 06:07 PM

I then tried RKill and tried renaming that.

There was no need for that.

There are several links for Rkill with different extensions or already, renamed listed below the Troubleshooting section.rkill.com
rkill.scr
rkill.pif
rkill.exe
Renamed versions:
iExplore.exe
uSeRiNiT.exe
WiNlOgOn.exe
You may have to make repeated attempts to use Rkill several times before it will run as some malware variants try to block it.

If you get an alert that Rkill is infected, ignore it. The alert is a fake warning given by the rogue software which attempts to terminate tools that try to remove it. If you see such a warning, leave the warning on the screen and then run Rkill again. By not closing the warning, this sometimes allows you to bypass the malware's attempt to protect itself so that Rkill can perform its routine.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 03 March 2010 - 04:11 PM

Tried all of the RKill programs twice.
All it ever "killed" were the following:
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\shempdevil\Local Settings\Temporary Internet Files\Content.IE5\8WN0BUI9\WiNlOgOn[1].exe

Still can't run the Malware program

Still gives me the same error message:
"The item "mbam.exe" that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly."

Anything else I can try?

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 03 March 2010 - 04:29 PM

Please download the TDSS Rootkit Removing Tool (TDSSKiller.zip) and save it to your Desktop. <-Important!!!
Be sure to print out and follow the instructions provided on that same page for performing a scan.
  • Extract (unzip) the file to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop. (click here if you're not sure how to do this. Vista users refer to these instructions.)
  • Go to Posted Image > Run..., , then type or copy and paste everything in the code box below into the Open dialogue box:

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v
  • Click OK.
  • If malicious services or files have been detected, the utility will prompt to reboot the computer in order to complete the disinfection procedure. Please reboot when prompted.
  • A log file named TDSSKiller.txt should have been created and saved to the root directory (usually C:\TDSSKiller.txt).
  • Copy and paste the contents of that report in your next reply.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 03 March 2010 - 04:35 PM

16:35:16:421 3832 TDSS rootkit removing tool 2.2.7.1 Feb 27 2010 13:29:25
16:35:16:421 3832 ================================================================================
16:35:16:421 3832 SystemInfo:

16:35:16:421 3832 OS Version: 5.1.2600 ServicePack: 3.0
16:35:16:421 3832 Product type: Workstation
16:35:16:421 3832 ComputerName: D93ZFT91
16:35:16:421 3832 UserName: shempdevil
16:35:16:421 3832 Windows directory: C:\WINDOWS
16:35:16:421 3832 Processor architecture: Intel x86
16:35:16:421 3832 Number of processors: 1
16:35:16:421 3832 Page size: 0x1000
16:35:16:437 3832 Boot type: Normal boot
16:35:16:437 3832 ================================================================================
16:35:16:437 3832 UnloadDriverW: NtUnloadDriver error 2
16:35:16:437 3832 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
16:35:16:453 3832 Initialize success
16:35:16:453 3832
16:35:16:453 3832 Scanning Services ...
16:35:16:453 3832 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
16:35:16:453 3832 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
16:35:16:453 3832 wfopen_ex: Trying to KLMD file open
16:35:16:453 3832 wfopen_ex: File opened ok (Flags 2)
16:35:16:453 3832 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
16:35:16:453 3832 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
16:35:16:453 3832 wfopen_ex: Trying to KLMD file open
16:35:16:453 3832 wfopen_ex: File opened ok (Flags 2)
16:35:16:875 3832 GetAdvancedServicesInfo: Raw services enum returned 323 services
16:35:16:875 3832 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
16:35:16:875 3832 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
16:35:16:875 3832
16:35:16:875 3832 Scanning Kernel memory ...
16:35:16:875 3832 Devices to scan: 5
16:35:16:875 3832
16:35:16:875 3832 Driver Name: Disk
16:35:16:875 3832 IRP_MJ_CREATE : F763DBB0
16:35:16:875 3832 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
16:35:16:875 3832 IRP_MJ_CLOSE : F763DBB0
16:35:16:875 3832 IRP_MJ_READ : F7637D1F
16:35:16:875 3832 IRP_MJ_WRITE : F7637D1F
16:35:16:875 3832 IRP_MJ_QUERY_INFORMATION : 804FA87E
16:35:16:875 3832 IRP_MJ_SET_INFORMATION : 804FA87E
16:35:16:875 3832 IRP_MJ_QUERY_EA : 804FA87E
16:35:16:875 3832 IRP_MJ_SET_EA : 804FA87E
16:35:16:875 3832 IRP_MJ_FLUSH_BUFFERS : F76382E2
16:35:16:875 3832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
16:35:16:875 3832 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
16:35:16:875 3832 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
16:35:16:875 3832 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
16:35:16:875 3832 IRP_MJ_DEVICE_CONTROL : F76383BB
16:35:16:875 3832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
16:35:16:875 3832 IRP_MJ_SHUTDOWN : F76382E2
16:35:16:875 3832 IRP_MJ_LOCK_CONTROL : 804FA87E
16:35:16:875 3832 IRP_MJ_CLEANUP : 804FA87E
16:35:16:875 3832 IRP_MJ_CREATE_MAILSLOT : 804FA87E
16:35:16:875 3832 IRP_MJ_QUERY_SECURITY : 804FA87E
16:35:16:875 3832 IRP_MJ_SET_SECURITY : 804FA87E
16:35:16:875 3832 IRP_MJ_POWER : F7639C82
16:35:16:875 3832 IRP_MJ_SYSTEM_CONTROL : F763E99E
16:35:16:875 3832 IRP_MJ_DEVICE_CHANGE : 804FA87E
16:35:16:875 3832 IRP_MJ_QUERY_QUOTA : 804FA87E
16:35:16:875 3832 IRP_MJ_SET_QUOTA : 804FA87E
16:35:16:875 3832 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
16:35:16:875 3832 sion
16:35:16:890 3832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
16:35:16:890 3832
16:35:16:890 3832 Driver Name: Disk
16:35:16:890 3832 IRP_MJ_CREATE : F763DBB0
16:35:16:890 3832 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
16:35:16:890 3832 IRP_MJ_CLOSE : F763DBB0
16:35:16:890 3832 IRP_MJ_READ : F7637D1F
16:35:16:890 3832 IRP_MJ_WRITE : F7637D1F
16:35:16:890 3832 IRP_MJ_QUERY_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_EA : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_EA : 804FA87E
16:35:16:890 3832 IRP_MJ_FLUSH_BUFFERS : F76382E2
16:35:16:890 3832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_DEVICE_CONTROL : F76383BB
16:35:16:890 3832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
16:35:16:890 3832 IRP_MJ_SHUTDOWN : F76382E2
16:35:16:890 3832 IRP_MJ_LOCK_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_CLEANUP : 804FA87E
16:35:16:890 3832 IRP_MJ_CREATE_MAILSLOT : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_SECURITY : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_SECURITY : 804FA87E
16:35:16:890 3832 IRP_MJ_POWER : F7639C82
16:35:16:890 3832 IRP_MJ_SYSTEM_CONTROL : F763E99E
16:35:16:890 3832 IRP_MJ_DEVICE_CHANGE : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_QUOTA : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_QUOTA : 804FA87E
16:35:16:890 3832 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
16:35:16:890 3832 sion
16:35:16:890 3832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
16:35:16:890 3832
16:35:16:890 3832 Driver Name: Disk
16:35:16:890 3832 IRP_MJ_CREATE : F763DBB0
16:35:16:890 3832 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
16:35:16:890 3832 IRP_MJ_CLOSE : F763DBB0
16:35:16:890 3832 IRP_MJ_READ : F7637D1F
16:35:16:890 3832 IRP_MJ_WRITE : F7637D1F
16:35:16:890 3832 IRP_MJ_QUERY_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_EA : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_EA : 804FA87E
16:35:16:890 3832 IRP_MJ_FLUSH_BUFFERS : F76382E2
16:35:16:890 3832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
16:35:16:890 3832 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_DEVICE_CONTROL : F76383BB
16:35:16:890 3832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
16:35:16:890 3832 IRP_MJ_SHUTDOWN : F76382E2
16:35:16:890 3832 IRP_MJ_LOCK_CONTROL : 804FA87E
16:35:16:890 3832 IRP_MJ_CLEANUP : 804FA87E
16:35:16:890 3832 IRP_MJ_CREATE_MAILSLOT : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_SECURITY : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_SECURITY : 804FA87E
16:35:16:890 3832 IRP_MJ_POWER : F7639C82
16:35:16:890 3832 IRP_MJ_SYSTEM_CONTROL : F763E99E
16:35:16:890 3832 IRP_MJ_DEVICE_CHANGE : 804FA87E
16:35:16:890 3832 IRP_MJ_QUERY_QUOTA : 804FA87E
16:35:16:890 3832 IRP_MJ_SET_QUOTA : 804FA87E
16:35:16:890 3832 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
16:35:16:890 3832 sion
16:35:16:906 3832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
16:35:16:906 3832
16:35:16:906 3832 Driver Name: Disk
16:35:16:906 3832 IRP_MJ_CREATE : F763DBB0
16:35:16:906 3832 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
16:35:16:906 3832 IRP_MJ_CLOSE : F763DBB0
16:35:16:906 3832 IRP_MJ_READ : F7637D1F
16:35:16:906 3832 IRP_MJ_WRITE : F7637D1F
16:35:16:906 3832 IRP_MJ_QUERY_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_EA : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_EA : 804FA87E
16:35:16:906 3832 IRP_MJ_FLUSH_BUFFERS : F76382E2
16:35:16:906 3832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_DEVICE_CONTROL : F76383BB
16:35:16:906 3832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F763BF28
16:35:16:906 3832 IRP_MJ_SHUTDOWN : F76382E2
16:35:16:906 3832 IRP_MJ_LOCK_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_CLEANUP : 804FA87E
16:35:16:906 3832 IRP_MJ_CREATE_MAILSLOT : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_SECURITY : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_SECURITY : 804FA87E
16:35:16:906 3832 IRP_MJ_POWER : F7639C82
16:35:16:906 3832 IRP_MJ_SYSTEM_CONTROL : F763E99E
16:35:16:906 3832 IRP_MJ_DEVICE_CHANGE : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_QUOTA : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_QUOTA : 804FA87E
16:35:16:906 3832 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code
16:35:16:906 3832 sion
16:35:16:906 3832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
16:35:16:906 3832
16:35:16:906 3832 Driver Name: atapi
16:35:16:906 3832 IRP_MJ_CREATE : F74CA6F2
16:35:16:906 3832 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E
16:35:16:906 3832 IRP_MJ_CLOSE : F74CA6F2
16:35:16:906 3832 IRP_MJ_READ : 804FA87E
16:35:16:906 3832 IRP_MJ_WRITE : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_EA : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_EA : 804FA87E
16:35:16:906 3832 IRP_MJ_FLUSH_BUFFERS : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E
16:35:16:906 3832 IRP_MJ_DIRECTORY_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_DEVICE_CONTROL : F74CA712
16:35:16:906 3832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F74C6852
16:35:16:906 3832 IRP_MJ_SHUTDOWN : 804FA87E
16:35:16:906 3832 IRP_MJ_LOCK_CONTROL : 804FA87E
16:35:16:906 3832 IRP_MJ_CLEANUP : 804FA87E
16:35:16:906 3832 IRP_MJ_CREATE_MAILSLOT : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_SECURITY : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_SECURITY : 804FA87E
16:35:16:906 3832 IRP_MJ_POWER : F74CA73C
16:35:16:906 3832 IRP_MJ_SYSTEM_CONTROL : F74D1336
16:35:16:906 3832 IRP_MJ_DEVICE_CHANGE : 804FA87E
16:35:16:906 3832 IRP_MJ_QUERY_QUOTA : 804FA87E
16:35:16:906 3832 IRP_MJ_SET_QUOTA : 804FA87E
16:35:16:906 3832 siohd: 0
16:35:16:921 3832 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
16:35:16:921 3832
16:35:16:921 3832 Completed
16:35:16:921 3832
16:35:16:921 3832 Results:
16:35:16:921 3832 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
16:35:16:921 3832 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
16:35:16:921 3832 File objects infected / cured / cured on reboot: 0 / 0 / 0
16:35:16:921 3832
16:35:16:921 3832 KLMD(ARK) unloaded successfully

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 04 March 2010 - 07:08 AM

Please perform a scan with Kaspersky Online Virus Scanner.
-- Requires free Java Runtime Environment (JRE) to be installed before scanning for malware as ActiveX is no longer being used.
-- This scan will not remove any detected file threats but it will show where they are located so they can be cleaned with other tools.
  • Vista users: need to right-click either the IE or FF Start Menu or Quick Launch Bar icons and select Run As Administrator) from the context menu.
  • Read the "Advantages - Requirements and Limitations" then press the Posted Image... button.
  • You will be prompted to install an application from Kaspersky. Click the Run button. It will start downloading and installing the scanner and virus definitions.
  • When the downloads have finished, you should see 'Database is updated. Ready to scan'. Click on the Posted Image... button.
  • Make sure these boxes are checked. By default, they should be. If not, please check them and click on the Posted Image... button afterwards:
    • Detect malicious programs of the following categories:
      Viruses, Worms, Trojan Horses, Rootkits
      Spyware, Adware, Dialers and other potentially dangerous programs
    • Scan compound files (doesn't apply to the File scan area):
      Archives
      Mail databases
  • Click on My Computer under the Scan section. OK any warnings from your protection programs.
  • The scan will take a while so be patient and do NOT use the computer while the scan is running. Keep all other programs and windows closed.
  • Once the scan is complete (the 'status' will show complete), click on View Scan Report and any infected objects will be shown.
  • Click on Save Report As... and change the Files of type to Text file (.txt)
  • Name the file KAVScan_ddmmyy (day, month, year) before clicking on the Save button and save it to your Desktop.
  • Copy and paste (Ctrl+C) the saved scan results from that file in your next reply.
-- Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 04 March 2010 - 11:06 AM

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, March 4, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, March 04, 2010 05:44:51
Records in database: 3699193
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Objects scanned: 61538
Threats found: 24
Infected objects found: 35
Suspicious objects found: 0
Scan duration: 02:39:44


File name / Threat / Threats count
C:\Documents and Settings\shempdevil\Application Data\SystemProc\lsass.exe/C:\Documents and Settings\shempdevil\Application Data\SystemProc\lsass.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\autoexec.exe Infected: Trojan.Win32.Buzus.dkdh 1
C:\Documents and Settings\shempdevil\Application Data\SystemProc\lsass.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\Program Files\Total PC Defender\Total PC Defender.exe Infected: Trojan.Win32.FraudPack.anqe 1
C:\Qoobox\Quarantine\C\Documents and Settings\shempdevil\nah_wiin.exe.vir Infected: Trojan.Win32.Inject.aeew 1
C:\Qoobox\Quarantine\C\Documents and Settings\shempdevil\Start Menu\Programs\Startup\legupd32.exe.vir Infected: Backdoor.Win32.Bredolab.gu 1
C:\Qoobox\Quarantine\C\WINDOWS\syssvc.exe.vir Infected: Trojan-Dropper.Win32.Agent.bjyd 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\lsp.dll.vir Infected: Trojan-Proxy.Win32.Agent.bwe 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\_sdra64_.exe.zip Infected: Trojan-Spy.Win32.Zbot.wto 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1404\A0106541.exe Infected: Trojan.Win32.FraudPack.akyr 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1404\A0106548.dll Infected: Trojan.Win32.FraudPack.akym 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1404\A0106549.exe Infected: Trojan.Win32.FraudPack.akyo 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1404\A0106558.dll Infected: Trojan.Win32.FraudPack.akym 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1405\A0106560.dll Infected: Trojan.Win32.FraudPack.akym 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1405\A0106568.exe Infected: Trojan.Win32.FraudPack.akyo 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1405\A0106575.exe Infected: Trojan.Win32.FraudPack.akyr 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106808.dll Infected: Trojan.Win32.Agent.cttq 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106809.dll Infected: Trojan.Win32.Agent.cttq 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106810.dll Infected: Trojan-Spy.Win32.Small.cdb 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106811.dll Infected: Trojan.Win32.BHO.yur 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106812.dll Infected: Trojan.Win32.BHO.aclg 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106813.dll Infected: Trojan.Win32.Agent2.cgis 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1411\A0106814.dll Infected: Trojan.Win32.Genome.dyfs 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1427\A0108245.dll Infected: Trojan.Win32.Monder.daib 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1428\A0108282.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1429\A0108329.exe Infected: Trojan.Win32.FraudPack.anqe 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1429\A0108344.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1429\A0108355.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1429\A0108581.exe Infected: Trojan.Win32.Buzus.djcl 1
C:\WINDOWS\system32\browsearch.dll Infected: Trojan.Win32.Genome.ellz 1
C:\WINDOWS\system32\iosocket.dll Infected: Trojan.Win32.BHO.acfg 1
C:\WINDOWS\system32\protect.dll Infected: Trojan.Win32.Crypt.bgi 1
C:\WINDOWS\system32\ptco.dll Infected: Trojan.Win32.BHO.admg 1
C:\WINDOWS\system32\pxcrt.dll Infected: Trojan.Win32.Crypt.bjf 1
C:\WINDOWS\system32\yetugayu.dll Infected: Trojan.Win32.Monder.danm 1

Selected area has been scanned.

#12 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 04 March 2010 - 04:27 PM

Your Kaspersky scan results indicate you already ran ComboFix at some point. When was that done?

Please download OTM by OldTimer and save to your Desktop.
  • Double-click on OTM.exe to launch the program. (If using Windows Vista, be sure to Run As Administrator)
  • Copy the file(s)/folder(s) paths listed below - highlight everything in the code box and press CTRL+C or right-click and choose Copy.
:Processes
explorer.exe
C:\autoexec.exe

:Services

:Reg

:Files
C:\autoexec.exe
C:\WINDOWS\system32\browsearch.dll
C:\WINDOWS\system32\iosocket.dll
C:\WINDOWS\system32\protect.dll
C:\WINDOWS\system32\ptco.dll
C:\WINDOWS\system32\pxcrt.dll
C:\WINDOWS\system32\yetugayu.dll
C:\Documents and Settings\shempdevil\Application Data\SystemProc
C:\Program Files\Total PC Defender

:Commands
[emptytemp]
[start explorer]
[reboot]
  • Return to OTM, right-click in the open text box labeled "Paste Instructions for Items to be Moved" (under the yellow bar) and choose Paste.
  • Click the red MoveIt! button.
  • The list will be processed and the results will be displayed in the right-hand pane.
  • Highlight everything in the Results window (under the green bar), press CTRL+C or right-click, choose Copy, right-click again and Paste it in your next reply.
  • Click Exit when done.
  • A log of the results is automatically created and saved to C:\_OTM\MovedFiles \mmddyyyy_hhmmss.log <- the date/time the tool was run.
-- Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. After the reboot, open Notepad, click File > Open, in the File Name box type *.log and press the Enter key. Navigate to the C:\_OTM\MovedFiles folder, open the newest .log file and copy/paste the contents in your next reply. If not asked, reboot anyway.

Caution: Be careful of what you copy and paste with this tool. OTM is a powerful program, designed to move highly persistent files and folders and is intended by the developer to be used under the guidance and supervision of a trained malware removal expert.


Connect to the Internet and double-click on OTM.exe to launch the program again.
  • Click on the green CleanUp! button.
  • When you do this, a text file named cleanup.txt will be downloaded from the Internet.
  • If you get a warning from your firewall or other security programs regarding OTMoveIt attempting to contact the Internet, please allow the connection.
  • After the text file has been downloaded, you will be asked if you want to Begin cleanup process?
  • Select Yes.
-- Note: Doing this will remove any specialized tools (including this one) downloaded and used.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#13 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 04 March 2010 - 05:24 PM

Ran combofix about a year ago...worked great.

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
No active process named C:\autoexec.exe was found!
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\autoexec.exe moved successfully.
LoadLibrary failed for C:\WINDOWS\system32\browsearch.dll
C:\WINDOWS\system32\browsearch.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\iosocket.dll
C:\WINDOWS\system32\iosocket.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\protect.dll
C:\WINDOWS\system32\protect.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\ptco.dll
C:\WINDOWS\system32\ptco.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\pxcrt.dll
C:\WINDOWS\system32\pxcrt.dll moved successfully.
DllUnregisterServer procedure not found in C:\WINDOWS\system32\yetugayu.dll
C:\WINDOWS\system32\yetugayu.dll moved successfully.
C:\Documents and Settings\shempdevil\Application Data\SystemProc folder moved successfully.
C:\Program Files\Total PC Defender folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 51112807 bytes
->Flash cache emptied: 3459 bytes

User: shempdevil
->Temp folder emptied: 109497469 bytes
->Temporary Internet Files folder emptied: 20197859 bytes
->Java cache emptied: 128013 bytes
->Apple Safari cache emptied: 217402 bytes
->Flash cache emptied: 1814 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 166504 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 36878392 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 96665 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 208.00 mb


OTM by OldTimer - Version 3.1.10.0 log created on 03042010_171049

Files moved on Reboot...
C:\Documents and Settings\shempdevil\Local Settings\Temporary Internet Files\Content.IE5\G9XQRCJX\iframe[1].htm moved successfully.
C:\Documents and Settings\shempdevil\Local Settings\Temporary Internet Files\Content.IE5\3VP42L6T\index[1].htm moved successfully.
C:\Documents and Settings\shempdevil\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\WINDOWS\temp\15.tmp moved successfully.
C:\WINDOWS\temp\30.tmp moved successfully.

Registry entries deleted on Reboot...

#14 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 52,047 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:06:48 PM

Posted 04 March 2010 - 06:24 PM

Can you perform a scan with Malwarebytes' Anti-Malware now?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#15 shempdevil

shempdevil
  • Topic Starter

  • Members
  • 23 posts
  • OFFLINE
  •  
  • Local time:07:48 PM

Posted 04 March 2010 - 06:54 PM

No, still won't work.
I uninstalled it, reinstalled it, renamed it a couple of the alternate names given in the troubleshooting section.
Still gives me the same error




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users