CAN RAMNIT SURVIVE A SYSTEM RECOVERY?

spally1976 · April 24, 2011

I am in urgent need of some advice. A couple of weeks ago my computer was infested with hundreds of Ramnit.g viruses and after contacting this forum I was advised that the only option open to me was a reformat of the hard drive and os reinstallation. I used the HP destructive recovery process which does this and thought everything was fine (it did the reformat and reinstallation as it warned me before starting). Today I did a virus scan with Avast and it came back with 527 instances of Ramnit.g. Not knowing if I had reinfected my PC over the last 2 weeks, I today did another destructive system recovery and have only been online to download the free avast virus software. I have just run the scan and again it has found hundreds of this ramnit virus. It seems that ramnit survived 2 destructive system recoverys and I am at a loss on what to do next. I was under the impression and was advised by this forum that a complete system recovery was the only way to be sure that ramnit had gone but here it still is. PLEASE HELP!!.

screen317 · April 27, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

spally1976 · April 27, 2011

Scanned with Malwarebytes which strangely shows no infections but here is the log anyway:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6455

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

27/04/2011 11:23:22

mbam-log-2011-04-27 (11-23-22).txt

Scan type: Quick scan

Objects scanned: 148598

Time elapsed: 5 minute(s), 20 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

spally1976 · April 27, 2011

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Compaq_Administrator at 11:28:58.18 on 27/04/2011

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.958.573 [GMT 1:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\arservice.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\system32\nvsvc32.exe

svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Compaq_Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1UZ85IR\dds[1].scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [nwiz] nwiz.exe /install

mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE

mRun: [PCDrProfiler]

mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run

mRun: [Reminder] "c:\windows\creator\Remind_XP.exe"

mRun: [HP Software Update] c:\program files\hp\hp software update\HPwuSchd2.exe

mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

.

============= SERVICES / DRIVERS ===============

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-4-24 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-4-24 307288]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2011-4-24 19544]

R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2011-4-24 42184]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

.

=============== Created Last 30 ================

.

2011-04-27 10:16:15 -------- d-----w- c:\docume~1\compaq~1\applic~1\Malwarebytes

2011-04-27 10:16:05 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-27 10:16:04 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-04-27 10:16:00 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-04-27 10:15:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-04-27 08:12:08 -------- d-----w- c:\windows\system32\PreInstall

2011-04-25 01:42:12 -------- d-----r- C:\Program Files

2011-04-25 01:40:59 -------- d-----r- c:\documents and settings\all users\Documents

2011-04-25 01:39:07 -------- d-----r- c:\windows\Offline Web Pages

2011-04-25 01:36:15 -------- d-sh--r- c:\windows\system32\dllcache

2011-04-24 19:14:28 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-04-24 19:14:16 40112 ----a-w- c:\windows\avastSS.scr

2011-04-24 19:14:07 -------- d-----w- c:\program files\AVAST Software

2011-04-24 19:14:07 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVAST Software

2011-04-24 19:00:50 -------- d-sh--r- C:\cmdcons

2011-04-24 19:00:48 -------- d-----w- c:\windows\setup.pss

2011-04-24 19:00:29 -------- d-----w- c:\windows\setupupd

2011-04-24 18:55:03 -------- d-----w- c:\windows\system32\SoftwareDistribution

.

==================== Find3M ====================

.

============= FINISH: 11:31:30.71 ===============

screen317 · April 28, 2011

Hi,

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

spally1976 · April 28, 2011

ComboFix 11-04-27.02 - Compaq_Administrator 28/04/2011 10:06:49.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.958.621 [GMT 1:00]

Running from: c:\documents and settings\Compaq_Administrator\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\WINDOWS

c:\documents and settings\Compaq_Administrator\WINDOWS

c:\documents and settings\Default User\WINDOWS

c:\windows\system32\_000003_.tmp.dll

c:\windows\system32\_000005_.tmp.dll

c:\windows\system32\_000006_.tmp.dll

c:\windows\system32\_000007_.tmp.dll

c:\windows\system32\_000013_.tmp.dll

c:\windows\system32\config\systemprofile\WINDOWS

.

((((((((((((((((((((((((( Files Created from 2011-03-28 to 2011-04-28 )))))))))))))))))))))))))))))))

.

2011-04-28 09:01 . 2006-08-21 12:21 16896 ----a-w- c:\windows\system32\SET252.tmp

2011-04-28 09:01 . 2006-08-21 09:14 23040 ----a-w- c:\windows\system32\SET251.tmp

2011-04-28 08:58 . 2011-04-28 08:58 -------- d-----w- c:\windows\ServicePackFiles

2011-04-28 08:54 . 2011-04-28 09:01 -------- d-----w- c:\windows\LastGood

2011-04-27 10:16 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-27 10:16 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-04-27 09:01 . 2009-08-21 09:46 450560 ------w- c:\windows\system32\SET1CA.tmp

2011-04-27 09:00 . 2008-10-15 16:57 332800 ----a-w- c:\windows\system32\SETFF.tmp

2011-04-27 08:52 . 2010-02-12 10:03 293376 ------w- c:\windows\system32\browserchoice.exe

2011-04-25 01:42 . 2011-04-28 08:56 -------- d-----r- C:\Program Files

2011-04-25 01:40 . 2011-04-25 01:45 -------- d-----r- c:\documents and settings\All Users\Documents

2011-04-25 01:36 . 2011-04-28 09:03 -------- d-sh--r- c:\windows\system32\dllcache

2011-04-24 19:26 . 2008-09-04 16:42 1106944 ----a-w- c:\windows\system32\SETE6.tmp

2011-04-24 19:14 . 2011-04-18 17:12 19544 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2011-04-24 19:14 . 2011-04-18 17:17 307288 ----a-w- c:\windows\system32\drivers\aswSP.sys

2011-04-24 19:14 . 2011-04-18 17:16 49240 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2011-04-24 19:14 . 2011-04-18 17:13 25432 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2011-04-24 19:14 . 2011-04-18 17:17 441176 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2011-04-24 19:14 . 2011-04-18 17:16 102488 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2011-04-24 19:14 . 2011-04-18 17:16 96344 ----a-w- c:\windows\system32\drivers\aswmon.sys

2011-04-24 19:14 . 2011-04-18 17:13 30680 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2011-04-24 19:14 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr

2011-04-24 19:14 . 2011-04-18 17:25 199304 ----a-w- c:\windows\system32\aswBoot.exe

2011-04-24 18:57 . 2011-04-28 09:11 -------- d-----w- c:\documents and settings\Compaq_Administrator

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-04 16:48 . 2004-08-10 04:00 456192 ----a-w- c:\windows\system32\encdec.dll

2011-02-04 16:48 . 2004-08-10 04:00 291840 ----a-w- c:\windows\system32\sbe.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-04-18 17:25 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BrowserChoice"="c:\windows\system32\browserchoice.exe" [2010-02-12 293376]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"ftutil2"="ftutil2.dll" [2004-06-07 106496]

"RTHDCPL"="RTHDCPL.EXE" [2006-07-21 16261632]

"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 77312]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-09 7311360]

"nwiz"="nwiz.exe" [2006-05-09 1519616]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]

"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552]

"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-02-17 49152]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]

.

c:\documents and settings\Default User\Start Menu\Programs\Startup\

Pin.lnk - c:\hp\bin\CLOAKER.EXE [2006-9-1 27136]

PinMcLnk.lnk - c:\hp\bin\cloaker.exe [2006-9-1 27136]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

.

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [24/04/2011 20:14 441176]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [24/04/2011 20:14 307288]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [24/04/2011 20:14 19544]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_GB&c=64&bd=PRESARIO&pf=desktop

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

.

- - - - ORPHANS REMOVED - - - -

.

HKLM-Run-PCDrProfiler - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-04-28 10:11

Windows 5.1.2600 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Completion time: 2011-04-28 10:14:01

ComboFix-quarantined-files.txt 2011-04-28 09:13

.

Pre-Run: 142,800,068,608 bytes free

Post-Run: 142,789,033,984 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 63D3C41C99AD7DB99597C773A37983A5

spally1976 · April 28, 2011

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Compaq_Administrator at 10:21:51.46 on 28/04/2011

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.958.558 [GMT 1:00]

.

AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\Program Files\AVAST Software\Avast\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

C:\Program Files\AVAST Software\Avast\avastUI.exe

C:\WINDOWS\arservice.exe

C:\WINDOWS\system32\nvsvc32.exe

svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\HP\KBD\KBD.EXE

c:\windows\system\hpsysdrv.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Compaq_Administrator\Desktop\dds.scr