Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

3 Malware Infections in 3 days: Where do I begin?


  • Please log in to reply
5 replies to this topic

#1 Baylynx

Baylynx

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 27 July 2010 - 12:22 AM

I've been reading until my head is spinning.

How to remove AntiMalware 2009 (Uninstall Instructions)Posted by Grinler on September 19, 2008 @ 08:53 AM This is the closest I could find to my Antimalware-Doctor infection, but it was posted two years ago. No doubt the newer version of the malware has changed... so are there any changes to the recommended uninstall?

I was first infected with Win32:Oliga &/or Vitro, then followed by Antimalware Dr. and lastly Win32:Delf-HWS.

AVG free alerted me, but didn't prevent the Oliga/Vitro infection. While surfing for info on these, I entered a website where I was infected with Antimalware-Doctor. That was a scary experience as I could not prevent or stop the scan or exit the site. The last one... Delf-HWS is the most annoying as it continuously creates new .exe files that are intercepted by Avast! (sounding an audible alert) during the quarantine process. No sooner is one file disposed of... than another one is created.

Seems to me that Avast! is better at locating the bad files and locking them up than AVG. However, the constant beeping alert drives me crazy. I shut down my Dimension 4100 running XP-SP2 fearing that I would continue to be attacked. I have only started it in Safe Mode since. I have a laptop & downloaded various anti-virus programs to a cd, as well as a thumb drive. Is it possible to run these from the external devices with PC in safe mode? MBAM is among the ones I downloaded and I notice you recommend it.

With the barrage of infections/attacks... I am terrified of doing a regular boot on the PC. But if that's what I have to do... I guess I'll have to bite the bullet. However, since I'm dealing with several infections, it would be nice if someone would suggest where I should begin and a logical workflow. :thumbsup:

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:00 PM

Posted 27 July 2010 - 10:01 AM

I'm afraid I have very bad news.

Win32:Vitro is the name (used by avast) for the Win32:Virut family of malware.

Virut is a polymorphic file infector with IRCBot functionality which infects .exe, .scr files, downloads more malicious files to your system, and opens a back door that compromises your computer. See Threat aliases for Win32.Virtob.Gen.12.

With this particular infection, the safest solution and only sure way to remove it effectively is to reformat and reinstall the OS.

According to this Norman White Paper Assessment of W32/Virut, some variants can infect the HOSTS file and block access to security related web sites. Other variants of virut can even penetrate and infect .exe files within compressed files (.zip, .cab, rar). The Virux and Win32/Virut.17408 variants are an even more complex file infectors which can embed an iframe into the body of web-related files and infect script files (.php, .asp, .htm, .html, .xml). When Virut creates infected files, it also creates non-functional files that are corrupted beyond repair and in some instances can disable Windows File Protection. In many cases the infected files cannot be disinfected properly by your anti-virus. When disinfection is attempted, the files become corrupted and the system may become irreparable. The longer virut remains on a computer, the more critical system files will become infected and corrupt so the degree of infection can vary.

The virus disables Windows File Protection by injecting code into the "winlogon.exe" process that patches system code in memory.

CA Virus detail of W32/Virut

The virus has a number of bugs in its code, and as a result it may misinfect a proportion of executable files....some W32/Virut.h infections are corrupted beyond repair.

McAfee Risk Assessment and Overview of W32/Virut

There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus...Due to the damaged caused to files by virut it's possible to find repaired but corrupted files. They became corrupted by the incorrect writing of the viral code during the process of infection. undetected, corrupted files (possibly still containing part of the viral code) can also be found. this is caused by incorrectly written and non-function viral code present in these files.

AVG Overview of W32/VirutVirut is commonly spread via a flash drive (usb, pen, thumb, jump) infection using RUNDLL32.EXE and other malicious files. It is often contracted and spread by visiting remote, crack and keygen sites. These type of sites are infested with a smörgåsbord of malware and a major source of system infection.

...warez and crack web pages are being used by cybercriminals as download sites for malware related to VIRUT and VIRUX. Searches for serial numbers, cracks, and even antivirus products like Trend Micro yield malcodes that come in the form of executables or self-extracting files...quick links in these sites also lead to malicious files. Ads and banners are also infection vectors...

Keygen and Crack Sites Distribute VIRUX and FakeAV

However, the CA Security Advisor Research Blog have found MySpace user pages carrying the malicious Virut URL. Either way you can end up with a computer system so badly damaged that recovery is not possible and it cannot be repaired. When that happens there is nothing you can do besides reformatting and reinstalling the OS.

You should disconnect the computer from the Internet and from any networked computers until it is cleaned. If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change all passwords from a clean computer, not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified immediately of the possible security breach. Because your computer was compromised please read:Since virut is not effectively disinfectable, your best option is to perform a full reformat as there is no guarantee this infection can be completely removed. In most instances it may have caused so much damage to your system files that it cannot be completely cleaned or repaired. In many cases the infected files cannot be deleted and anti-malware scanners cannot disinfect them properly. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS. Reinstalling Windows without first wiping the entire hard drive with a repartition and/or format will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system will still be there afterwards. Please read:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Baylynx

Baylynx
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 27 July 2010 - 12:35 PM

I understand that you gave me the worst case scenario. I want to be absolutely certain that I have Win32:Virut before I resort to a reformat & reinstall. I'm not questioning you... in fact I appreciate you getting right to the point.

Some additional information --


1. First Infection: I was only running AVG when I received a brief alert in the form of a bubble or popup alerting me to Win32:Vitru, as that's what I thought I had seen. However, the closest references I could find on the web was Win32:Vitro... so I figured I must have misread it. Unfortunately, I did not have Avast! installed on my machine at the time I got the initial alert.

2. Second Infection: I installed Avast! on my machine after being infected by Antimalware-Doctor. Avast! never reported Win32:Vitro during any scans... only Win32:Oliga.

3. Third Infection: Win32:Delf-HWS[Trj] reported by Avast!


Perhaps I'm in denial... but is there any way to confirm that my machine is infected with Virut before I throw in the towel?

One more thing... What's the best way to back up documents and files on my HD before the inevitable ??? My memorex thumb drive was connected to my PC during all these attacks. What recommendation do you have for checking to see if it is infected? I can check it out on a clean machine and hopefully repair any corrupted data.

Thanks for your advice... even if it's not what I want to hear.

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:00 PM

Posted 27 July 2010 - 01:01 PM

From what you describe it appears you are dealing with multiple infections.

I was only running AVG when I received a brief alert in the form of a bubble or popup alerting me to Win32:Vitru, as that's what I thought I had seen. However, the closest references I could find on the web was Win32:Vitro

As a said Virut and Vitro are the same...different anti-virus vendors use different names.

Specialized tools like ComboFix someimes can confirm the infection. When virut is present ComboFix may not work and provide a warning that virut was detecte but it is an advanced tool that we cannot use in this forum. However, you can get a second opinion by trying online scans to see what they are detecting.Note: Requires Internet Explorer (or FireFox with IE Tab) to work.


If your computer has been infected with malware and you need to back up data, you can back up all your important documents, personal data files, photos to a CD or DVD drive, not a flash drive or external hard drive as they may become compromised in the process. The safest practice is not to backup any executable files (*.exe), screensavers (*.scr), autorun (.ini) or script files (.php, .asp, .htm, .html, .xml ) files because they may be infected by malware. Avoid backing up compressed files (.zip, .cab, .rar) that have executables inside them as some types of malware can penetrate compressed files and infect the .exe files within them. Other types of malware may even disguise itself by hiding a file extension or adding to the existing extension as shown here (click Figure 1 to enlarge) so be sure you look closely at the full file name. If you cannot see the file extension, you may need to reconfigure Windows to show file name extensions. Then make sure you scan the backed up data with your anti-virus prior to to copying it back to your hard drive.

If your CD/DVD drive is unusable, another word of caution if you are considering backing up to an external usb hard drive as your only alternative. External drives are more susceptible to infection and can become compromised in the process of backing up data. I'm not saying you should not try using such devices but I want to make you aware of all your options and associated risks so you can make an informed decision if its worth that risk.Again, do not back up any files with the following file extensions: exe, .scr, .ini, .htm, .html, .php, .asp, .xml, .zip, .rar, .cab as they may be infected.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Baylynx

Baylynx
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 27 July 2010 - 03:15 PM

Thanks Quiteman for your thoughtful replies and all the great references. Despite the trauma... I am reluctantly accepting the fact that my OS is unsalvageable. Rather than spend many more hours reformatting, reinstalling and rebuilding my machine, I'm seriously considering investing in a new Windows 7 machine. However... at the moment, my highest priority is to back up and salvage my data files before they are corrupted and rendered useless. Damage control is my current mission.

I knew this day would one day come. I just wish I had been better prepared. Thanks again for your valuable insights and willingness to share your knowledge. Your advice is much appreciated.

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:01:00 PM

Posted 28 July 2010 - 06:17 AM

I am reluctantly accepting the fact that my OS is unsalvageable.

After backing up and saving your data, you can try disinfection but it will probably require the use of more powerful tools than we recommend in this forum[/b]. Before that can be done you will need you to create and post a DDS log for further investigation.

Please read the pinned topic titled "Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help". If you cannot complete a step, then skip it and continue with the next. In Step 7 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

When you have done that, post your log in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the Malware Response Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the Malware Response Team.

Please be patient. It may take a while to get a response because the Malware Response Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have posted your log and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Response Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Response Team member is already assisting you and not open the thread to respond.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users