Arrgh Virus Keeps Returning

[ChrisCool]

This virus keeps coming back.

I believe it was transferred via a USB memry stick, but I've fixed that problem.

I can usuually tell if it's back because there's a rundull32 entry in the startup listing.

The logfile is shown below:

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 4008

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/19/2010 8:52:53 PM

mbam-log-2010-04-19 (20-52-53).txt

Scan type: Quick scan

Objects scanned: 114537

Time elapsed: 7 minute(s), 22 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 1

Registry Keys Infected: 3

Registry Values Infected: 16

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 11

Memory Processes Infected:

C:\WINDOWS\system32\w.exe (Trojan.Sopiclick) -> Unloaded process successfully.

C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:

C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsvc (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\peresvc (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYS (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\buildw (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\firstinstallflag (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\guid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\i (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\ulrn (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\update (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\exec (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mbt (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udpe (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mpe (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\w.exe (Trojan.Sopiclick) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\BtwSvc.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\PereSvc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc5.bin (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc6.bin (Trojan.Agent) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-824080227-2606140345-2805738407-1005\Dc7.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\opear.exe (Trojan.Sopiclick) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\MSWINSCK.OCX (Worm.Nyxem) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4818644.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6M80MB9M\w[1].bin (Trojan.Sopiclick) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.

[mountaintree16]

Hello ChrisCool and welcome to the forums here at Malwarebytes.org

Please re-post your post here:

http://forums.malwarebytes.org/index.php?showforum=7

And someone will be along to assist you as soon as possible. Please note that it could take 48 hours or more during busy periods to get a response, so please be patient and do not reply to your post asking for help unless its been longer than 48 hours and you haven't gotten a reply yet. Replying to your own post makes it appear as though you are already getting help and that can make it take longer for you to get help.

Thank you