Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Vundo infection [Solved]


  • This topic is locked This topic is locked

#31
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Sorry for such a late response to this.

Just to clarify a couple of things here, this isn't my computer... I'm just helping to clean it up. Step one was remove the malware, step two is update to SP3/Java as I know Java has multiple browser exploits, then step 3 is to install Avast (better than nothing).

Results of screen317's Security Check version 0.99.1
Windows XP Service Pack 2
Out of date service pack!!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
WMIC entry does not exist for antivirus; attempting automatic update.
``````````````````````````````
Anti-malware/Other Utilities Check:

Ad-Aware
Spybot - Search & Destroy
HijackThis 2.0.2
CCleaner (remove only)
DH Driver Cleaner Professional Edition
nCleaner second 2.3.4.0
Java™ 6 Update 3
Out of date Java installed!
Adobe Flash Player 10
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Out of date Adobe Reader installed!
``````````````````````````````
Process Check:
objlist.exe by Laurent

Ad-Aware AAWService.exe is disabled!
Ad-Aware AAWTray.exe is disabled!
``````````````````````````````
DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

`````````End of Log```````````

Edited by rklamer, 04 February 2010 - 01:05 PM.

  • 0

Advertisements


#32
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
Can you install an AV please, we'll deal with the updates later

Anti-Virus
Antivirus software is a computer programs designed to identify and eliminate viruses and other malicious software. Only install one anti-virus as more than one may cause conflicts and slow down your system drastically.

Then...

Step1
Clear Cache/Temp Files
Download TFC by OldTimer to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
Step2
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy & Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Step3
Kaspersky WebScanner
Please do an online scan with Kaspersky WebScanner

Kaspersky online scanner uses JAVA technology to perform the scan. If you do not have the latest JAVA version, follow the instructions below under Upgrading Java, to download and install the latest vision.

Upgrading Java
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 18.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u18-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u18-windows-i586-p.exe and select "Run as an Administrator.")
Running Kaspersky WebScanner
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure the following is checked.
    • Spyware, Adware, Diallers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.

  • 0

#33
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Sorry for the late response, once again (I don't have access to this computer all of the time)

Following steps now, will post log when done.
  • 0

#34
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
Thanks :)
  • 0

#35
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Hey, sorry! I let the Kaspersky scan run overnight, but someone shut down the computer by mistake. I'm going to let it run again now that I have access to this computer again. Apologies.
  • 0

#36
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
No probs
  • 0

#37
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Hey again,

Sorry once again... someone turned off the computer last night again. I managed to get it done today, though. Here's the results.

(Will be editing in MBAM scan)


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, February 10, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, February 10, 2010 19:51:01
Records in database: 3469055
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
E:\
F:\

Scan statistics:
Objects scanned: 95956
Threats found: 2
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 02:51:37


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\jkyvpfxo.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.kqi 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\vizzjw.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.kqi 1
C:\Qoobox\Quarantine\C\WINDOWS\upaqasun.dll.vir Infected: Trojan-Downloader.Win32.Mufanom.gie 1

Selected area has been scanned.

Edited by rklamer, 10 February 2010 - 10:13 PM.

  • 0

#38
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
OK, post your MBAM when you're ready

thanks
  • 0

#39
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
It's clear (sorry for the delay on this one as well, had to wait until the computer was not being used anymore)

Malwarebytes' Anti-Malware 1.44
Database version: 3610
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13

2/11/2010 2:41:55 AM
mbam-log-2010-02-11 (02-41-55).txt

Scan type: Quick Scan
Objects scanned: 138237
Time elapsed: 7 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • 0

#40
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
Not a problem :)

We've not quite finished yet, but how does your system seem now?
Are you still experiencing any problems?
  • 0

Advertisements


#41
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
The computer owner, as well as I, is noticing a significant performance increase. I'm not sure what else is left to do, but thanks so much for the help so far! I haven't seen Firefox ask for me to set it as the default browser in awhile, too.

That Print Shop program still doesn't work properly, but we've got a temporary workaround for the work that needs to get done until we can get that working again. It's strange... in the Shortcut properties, the Target field is completely empty, but the shortcut still has the proper icon. I tried looking for the executable for it, but all it does is launch the splash -- I'm guessing there's some sort of command line coding in the Target field of the original shortcut to bring it past that... I just don't know what it is. Would a reinstall at this point be smart?

Thanks!

Edited by rklamer, 11 February 2010 - 01:05 PM.

  • 0

#42
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
A reinstall may well be the quickest way to get the software working again. Some installers have repair capabilities, so you could try running it and seeing if it asks you if you want to repair it

Don't forget, ensure you've got an Antivirus installed


»Next...«
Your logs are clean - you are clear or seem to be. Please advise me if you still have any problems.

We'll move on to the cleanup now. There's quite A bit to do here, just take your time

Updates
Before we begin the actual cleanup, I'll just say a few words on the importance of updates. From time to time, software vendors introduce updates for their products. Sometimes these are to enhance the product, but often they are to repair an exploitable vulnerability. You may like to consider installing Secunia PSI. This is a free application (for home users) that sits in the system tray and alerts you when security updates are available, and where from. Secunia PSI can be downloaded from HERE

Windows Service Pack
A large percentage of Microsoft updates are are issued to deal with vulnerabilities in Windows and its components. Your version of XP is only patched to Service Pack 2. I strongly recommend that you update to SP3 and thereafter keep WIndows updated. SP3 Can be obtained from here

Java Update
Posted Image Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
Follow these steps to uninstall ComboFix and tools used in the removal of malware
  • Click START then RUN
  • Now type ComboFix /Uninstall in the run box and click OK. Note the space between the ComboFix and the /U, it needs to be there.
    Posted Image
OTL Cleanup
A good workman always cleans up after himself so..Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

Preventing re-infection
Now that your system is clear, there are a number of steps you can take to prevent re-infection

It is critical that you have both a firewall and anti virus to protect your system and to keep them updated.

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Winpatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. Help file and tutorial can be found Here
SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
MVPS Hosts File - Blocks known bad sites by adding them to your Hosts file thereby preventing you from accessing them
TFC (Temp File Cleaner)- Cleans an enormous amount of junk held in temporary files and disposes of any malware lurking there.
Anti Spyware Program - We recommend MalwareBytes Anti-Malware and SUPERAntiSpyware

Browsers
Consider using FIREFOX or OPERA, both are free to use and are more secure than IE. If you are using Firefox you can stay more secure by adding NoScript and WOT (Web Of Trust). NoScript stops Java scripts from starting on a web page unless you give permission for them, and WOT has a comprehensive list of ratings for different websites allowing you to easily see if a website that you are about to go to has a bad reputation; in fact it will warn you to check if you are sure that you want to continue to a bad website.


Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • Run Internet Explorer
  • Click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

Edited by azarl, 11 February 2010 - 01:27 PM.

  • 0

#43
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Just got all of this done today. Thank you so much! You've been an amazing help.
  • 0

#44
azarl

azarl

    GeekU Admin

  • Community Leader
  • 25,310 posts
No problem :)
  • 0

#45
rklamer

rklamer

    Member

  • Topic Starter
  • Member
  • PipPip
  • 33 posts
Sorry to bug you again, but I've got one more problem -- Avast picked up something in a full scan today.

C:\WINDOWS\$NtUninstallKB959426_0$\kernel32.dll

High severity
Status: Threat: Win32:Patched-KI [Trj]

Could this just be something left over? Thanks!
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP