13 replies to this topic

[nadim]

Here is my log file after quick scan

Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 5.1.2600 Service Pack 3

3/13/2009 12:15:14 AM
mbam-log-2009-03-13 (00-14-56).txt

Scan type: Quick Scan
Objects scanned: 87894
Time elapsed: 16 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 5
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 11

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\family\Application Data\MalwareRemovalBot (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings (Rogue.MalwareRemovalBot) -> No action taken.

Files Infected:
C:\WINDOWS\SYSTEM32\iehelper.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\iehelper.dll.ren (Trojan.Vundo.H) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\rs.dat (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_01_58 PM_921.log (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_02_03 PM_734.log (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_03_08 PM_703.log (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 10_25_43 PM_390.log (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings\IgnoreList.stg (Rogue.MalwareRemovalBot) -> No action taken.
C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings\ScanResults.pie (Rogue.MalwareRemovalBot) -> No action taken.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\sysguard.exe (Trojan.FakeAlert) -> No action taken.

[AdvancedSetup]

Please update MBAM and select to FIX it, you chose not to fix it.

YOUR VERSION
Malwarebytes' Anti-Malware 1.34
Database version: 1749



CURRENT VERSION
Malwarebytes' Anti-Malware 1.34
Database version: 1842




Update and Scan with Malwarebytes' Anti-Malware

• Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  
• Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
  
  • Update Malwarebytes' Anti-Malware
    
  • Select the Update tab
    
  • Click Update
• When the update is complete, select the Scanner tab
  
• Select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Be sure that everything is checked, and click Remove Selected.
  
• When completed, a log will open in Notepad. please copy and paste the log into your next reply
  • If you accidently close it, the log file is saved here and will be named like this:
    
  • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

[nadim]

I quick scan my computer after the update. It clean up a lot. I can access internet via firefox only. My internet explorer is still not working. After clicking, it try to open it but after few seconds, it do nothing & cursor is back. Same thing when I tried to open my VPN connection.
Let me know what to do after looking at the log file below. Thanks

Malwarebytes' Anti-Malware 1.34
Database version: 1842
Windows 5.1.2600 Service Pack 3

2009-03-14 12:43:33
mbam-log-2009-03-14 (12-43-33).txt

Scan type: Quick Scan
Objects scanned: 92561
Time elapsed: 25 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\authzt.dll (Trojan.Downloader) -> Delete on reboot.

[nadim]

I ran again with current update version.
One more observation, When I own my printer. Computer stop with a blue screen with a message saying that it is shutting off to avoid any damage.
Here is the new log

Malwarebytes' Anti-Malware 1.34
Database version: 1848
Windows 5.1.2600 Service Pack 3

2009-03-14 14:16:13
mbam-log-2009-03-14 (14-16-13).txt

Scan type: Quick Scan
Objects scanned: 92741
Time elapsed: 23 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\authzt.dll (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\family\Local Settings\Temporary Internet Files\Content.IE5\GFYV6AS0\bok[1].gif (Trojan.Downloader) -> Quarantined and deleted successfully.

[AdvancedSetup]

STEP 01
[indent]Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.
Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:
ComboFix.exe
ComboFix.exe
ComboFix.exe


Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Yes to allow ComboFix to continue scanning for malware.
  
• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

[/indent]


STEP 02

Please create a BOOTLOG

• Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  
• Select "Enable Boot Logging" option and press enter.
  
• Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  
• This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
  
  If you're already running inside Windows you can enable it the following way.
  
  
• Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  
• Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  
• After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  
• From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.
  
• Note: Vista users can type in the Search and it will show on the menu, then Right click and choose Run as Adminsitrator
  
• The tab is called BOOT on Vista. Then choose Boot log

STEP 03
[indent]Download DDS and save it to your desktop
http://download.bleepingcomputer.com/sUBs/dds.scr

Disable any script blocker if your Anti-Virus/Anti-Malware has it.
Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr to run the tool.
When done, the DDS.txt will open.
Click Yes at the next prompt for Optional Scan.

When done, DDS will open two (2) logs:

• DDS.txt
  
• Attach.txt

• Save both reports to your desktop
  
• Please include the following logs in your next reply: DDS.txt and Attach.txt

[/indent]

STEP 04
RootRepeal - Rootkit Detector
[indent]

• Please download the following tool: RootRepeal - Rootkit Detector
  
• Direct download link is here: RootRepeal.rar
  
• If you don't already have a program to open a .RAR compressed file you can download a trial version from here: WinRAR
  
• Extract the program file to a new folder such as C:\RootRepeal
  
• Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button
  
• Select ALL of the checkboxes and then click OK and it will start scanning your system.
  
• If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
  
• When done, click on Save Report
  
• Save it to the same location where you ran it from, such as C:\RootRepeal
  
• Save it as your_name_rootrepeal.txt - where your_name is your forum name
  
• This makes it more easy to track who the log belongs to.
  
• Then open that log and select all and copy/paste it back on your next reply please.
  
• Quit the RootRepeal program.

[/indent]

[nadim]

I have a problem running combfix file.

Combfix run until I saw the message writing log file & do not run any program. After that I got an error something like fail to open ----- & then I saw cursor blinking. I left it there for few hours & nothing happened. I finally restart it after 4 or 5 hours. It did start & I can see my desktop. I checked my c drive & was not able to find combfix.txt file. What should I do now??
It also gave me the message of succesful installation of recovery console.

thanks for the help
nadim

[AdvancedSetup]

Please try to run steps 2, 3, and 4 and also run this as well.

Download and install: Autoruns for Windows v9.39 from Microsoft.

When you first run it it will generate an extensive listing and the word "Ready" will appear in the bottom left of the sofware GUI.
At this point goto Options and place a check(tick) against Verify Code Signatures and Hide Microsoft & Windows Entries
Next press the F5 key on your keyboard or hit the refresh button.

Once the Ready status by software is gained then goto File and select "Export as" and save output file as Autoruns.txt

Can you please then copy and paste the contents of that text file into your next reply along with the other logs as well, for analysis.

[nadim]

I will put the ntblog.txt later as it was too big to upload.

Regarding, step 4, It was crashing when I was clicking on all the option. Also it was given me a message regarding kernal file not file in C:/windows. I ran the scan with only file, driver & processors click

Attached Files

•  nadim_rootrepeal.txt   18.56K   23 downloads
•  Attach.txt   13.71K   15 downloads
•  DDS.txt   16.7K   16 downloads

[nadim]

Attached please find Autoruns.txt

Attached Files

•  AutoRuns.txt   11.74K   22 downloads

[nadim]

I tried to attached ntblog.txt file but it is too big to attached or copy. File size is 5088KB.
Let me know how to send it.
thanks
nadim

[nadim]

Did you went thru with these txt files? Is there any viruses on my machine?
thanks for the help
nadim

[AdvancedSetup]

Really sorry for the delay. I had some business to attend to.

If you still need assistance please let me know, otherwise I'll soon close your post.

Thanks

[AdvancedSetup]

Checking back.... do you need help? Will close the post soon.

[AdvancedSetup]

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.