Malwarebytes picked this one up on my laptop. It's my 1st "bad" Trojan. Thankfully it has not yet hit my desktop via home network. It got past ZA & AGV free. (I'm now switching to Avira & Comodo). Laptop is running XP SP3 Home Edition, C:\ drive not partitioned.
Once laptop appears to be clean, I need to rerun some of those last progs and post logs just to be certain.
I left System Restore On so that would get cleaned as well. (Hope that was the right thing to do, figured turning if off just left Trojan in there?)
I just re-ran Malwarebytes and it's showing something different now, all entries appears to be in System Restore, results below.
My question is
1) should I go ahead and let Malwarebytes remove these files, or should I do it manually in Safe Mode? (I've read that Malwarebytes migtht not be able to effectively delete due to lack of Adminst permission to access these particular files?)
--------------------------------------------
Malwarebytes' Anti-Malware 1.44
Database version: 3648
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18372
To be sure everything is found and cleaned run these scans in this order...
Print these instructions out.
NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner4.exe
* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.
PHYSICALLY DISCONNECT FROM THE INTERNET
Restart computer in Safe Mode. To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen
* Open SUPERAntiSpyware.
* Under Configuration and Preferences, click the Preferences button.
* Under [b]General and Startup" tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked): - Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* Back on the main screen, under Scan for Harmful Software click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under Complete Scan, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again. - Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program. Post SUPERAntiSpyware log. NOTE: Tracking cookies can be omitted from the log.
RECONNECT TO THE INTERNET
RESTART COMPUTER!
2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop. (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
RESTART COMPUTER!
3. Download gmer.zip: http://www.gmer.net/files.php
Unzip the file, and double click on gmer.exe, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.
I just started your instructions, will follow them to the letter.
Might take till tomorrow to wrap it up, but I'll post back results.
I saw that big line in bold red, am now wondering if I did a bad thing? On this laptop I ran different security software, Ad-Aware, Spywareblaster, AVG, ZA. (And SpyBot which I haven't used in ages.) Laptop is used very little & just for surfing. Tho nothing showed in Ad-Aware or AGV, knew by behavior something was up, so installed these new:
Malwarebytes
CCleaner
SuperAntiSpyware
RootRepeal
MGtools
Combofix
Mbytes was the one that detected Vundo.H
Then this morning, after I had run all the aforementioned software and cleaned 4 new/different entries Mbytes found in System Restore files, I removed AVG & ZA and am now running Avira and Comodo instead. (AVG has evolved into a bloated memory hog.)
Was that a bad thing to do? I'm wondering (and want to learn) the reasoning behind not using other cleaning tools till it's officially declared clean? Is it because the trojan could land in a quarantine file or something, and still be alive and kicking?
Stops a lot of headaches and some AV programs like AVG do require the use of special removal programs.
Plus by not changing things, it makes it much easier to clean he computer and at that time, changing AV programs will go much easier. Plus some nasties will not allow AV and antimalware programs to install! Compounding the problems.
My 5th attempt at replying. This laptop is still acting very squirrelly.
Thanks for the info, Train! Appreciate it.
I ran all tests per fink's instructions. (Sorry, my bad, see now that's a sticky.)
Appreciate the assist deciphering logs, get in over my head with those.
It should be noted that I intentionally installed SpectSoft/Eblaster on this laptop several years ago. So it might show up on logs. Newer programs are now picking it up. SuperAS did detect 2 entries of SpectorSoft, which I ticked off as Allowed, so in essence there was nothing out of the ordinary.
I'm sorry I can't paste logs. Forum software rejects them as too long. Couldn't find a good break point for pasting in multiple posts so I just attached them (Notepad). I hope that's not too much of a pain.
Very grateful for anyone who takes the time to read those logs!
--------------------
Malwarebytes -0-
SuperAntiSpyware -0-
(2 if you count SpectSoft/Eblast but I didn't since that's an intentional install)
---------------------
GMER log attached (Notepad)
One at a time over serveral post works just fine. Plus we do have folks that will not open atttachments.
Your HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:28:06 PM, on 1/31/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal
Thanks Train, you're a gem! And how'd you do that? I tried only posting hijack this and it got rejected as too large. You must have clout.
I just shut down my laptop, it needs to cool off awhile, and it dawned on me then about avoiding opening an attachment. Can't fault anyone for being cautious!
I just looked at the GMER log and it's just loaded with strings of entries mentioning Comodo firewall. After laptop cools a bit I have a log on there from a scan I did with AV and FW turned off. Would it be better to post that one?
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE 1. If Combofix asks you to install Recovery Console, please allow it. NOTE 2. If Combofix asks you to update the program, always do so.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Make sure, you re-enable your security programs, when you're done with Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Nice to meet you in case we haven't crossed paths. (Don't recognize your name, see you've been quite busy here but then I've not been around much lately. )
Yes, it's Comodo firewall only.
I just mainly wanted to pop in and give you guys an update.
I'm still battling the laptop and in the middle of all of it have had my printer go haywire and Avira picked up a trojan on my desktop now! (Pretty sure it's a false positive, it's TR/Drop.agent.blds in F:\\Downloads partition in MGTools folder. Only thing in that folder is mgtools.exe . )
Anyway, I have to get my printer fixed first. Might have to post in hardware then I'll be back to this laptop trojan. When it rains it pours!
Reply With Quote
