Jump to content


Photo

Arrgh Virus Keeps Returning


  • Please log in to reply
1 reply to this topic

#1 ChrisCool

ChrisCool

    New Member

  • Members
  • Pip
  • 5 posts

Posted 19 April 2010 - 08:28 PM

This virus keeps coming back.

I believe it was transferred via a USB memry stick, but I've fixed that problem.

I can usuually tell if it's back because there's a rundull32 entry in the startup listing.

The logfile is shown below:

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4008

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

4/19/2010 8:52:53 PM
mbam-log-2010-04-19 (20-52-53).txt

Scan type: Quick scan
Objects scanned: 114537
Time elapsed: 7 minute(s), 22 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 16
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 11

Memory Processes Infected:
C:\WINDOWS\system32\w.exe (Trojan.Sopiclick) -> Unloaded process successfully.
C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsvc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peresvc (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\buildw (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\firstinstallflag (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ulrn (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\update (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\exec (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mbt (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udpe (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mpe (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\w.exe (Trojan.Sopiclick) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc5.bin (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc6.bin (Trojan.Agent) -> Quarantined and deleted successfully.
C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc7.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opear.exe (Trojan.Sopiclick) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSWINSCK.OCX (Worm.Nyxem) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\4818644.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6M80MB9M\w[1].bin (Trojan.Sopiclick) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

#2 mountaintree16

mountaintree16

    bird lover

  • Honorary Members
  • PipPipPipPipPipPip
  • 7,759 posts
  • Gender:Not Telling
  • Location:USA
  • Interests:Hiking, music, birds, bird watching, walking, reading, animals, computer security, poetry...

Posted 19 April 2010 - 08:32 PM

Hello ChrisCool and welcome to the forums here at Malwarebytes.org :)

Please re-post your post here:
http://forums.malwar...php?showforum=7

And someone will be along to assist you as soon as possible. Please note that it could take 48 hours or more during busy periods to get a response, so please be patient and do not reply to your post asking for help unless its been longer than 48 hours and you haven't gotten a reply yet. Replying to your own post makes it appear as though you are already getting help and that can make it take longer for you to get help.

Thank you :)

Our character is what we do when we think no one is looking.

-H. Jackson Brown Jr.

 

It's not what we do once in a while that shapes our lives.
It's what we do consistently.

Tony Robbins





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users