HELP...I-Worm/Luder.A

[u_j2carreiro]

No matter what, I've used the "How To remove Begin2Search"/CoolWebSearch and other Nasties" thread....But I am still getting a pop up with my AVG anti virus that says "Virus Identified I-Worm/Luder.A" and the "I-Worm/Generic" for practically 50 files or more. It just keeps displaying. I cant get rid of this worm and I have run almost every scanner possible...here is my log..Can someone please help me get rid of this worm?

Also, I ran Hijackthis in safe mode and got rid of all the file missing lines and URL SearchHook missing and EVERY single line reappeared once I went to normal boot mode..why is it coming back even though I "Fixed" them??Is it b/c of the worm? And on top of that...it seems like no .exe work...their all infected

Thanks,
Josh

 

[howard_hopkinso]

Before deciding whether your computer needs cleaning or reformatting, I need to ask you some questions.

Do you use your computer for any of the following. Online banking/Business purposes/storing sensitive or very personal information?

If the answer to any of those questions is yes, then you should immediately disconnect your computer from the net and do a complete format and reinstall.

This is because you computer is infected with backdoor trojans. These will have sent your info to a third party who may use that info for their own purposes. If you use online banking, then your should contact your bank and arrange to have your password changed immediately. You should also, change any other passwords you use as these may have also been compromised.

Even if we cleaned the infections, it wouldn`t help to recover the info that may have been gleaned from your system.

If you only use your computer for music/games etc, then cleaning it of infections, is possibly a better option to a reformat.

Please let me know what you want to do in your next post.

See these two links before you decide what you want to do.

http://www.dslreports.com/faq/10063
http://www.dslreports.com/faq/10451


Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

no online banking, i am a web developer so the only real vital stuff i have is about 3 websites in dreamweaver that already have direct connections to the server since i have the password saved. Also, i have a couple of SQL back-end databases that also have direct connections. The passwords are all encrypted though so would it be better to just clean out the computer or reformat.

 

[howard_hopkinso]

In that case, let`s try and clean your system.

I must warn you, that this may involve a lengthy process of instructions/posts etc.

First, do the following.

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.


Post fresh HJT and AVG Antispyware logs as attachments into this thread, only after doing the above.


Regards Howard


This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

Okay I've seen to cleaned out all the Worm/Luder.A so thats gone according to AVG pop-ups...I'm only having one threat popup at startup which is a "adir.dll" as a "l-Worm/Generic.AJK" how can I get rid of this last one?...

Also here is my two reports for hijack this and the avg. Should I go back over the hijackthis in safe mode and now "Fix" every file missing and other neccesary changes or do I do that in normal mode?? I greatly appreciate the help so far, you've kept me from reformatting so getting rid of that last generic worm and guiding me through hijackthis to clean would be great..Oh yeh, I'm getting a syspools.exe error saying it could not open it up when opening up windows, any suggestions

Thanks again,
Josh

 

[howard_hopkinso]

I`m afraid I have some bad news for you.

While researching your HJT results, the infections on your system are so bad, that the general view of malware experts are of the opinion you should reformat and reinstall from scratch.

See HERE, for confirmation.

Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

Hey howard, i dont doubt you or anything but i ran every item and nothing is showing up anymore and my comp. runs like it used to before and everything seems fine. If i was to just leave it as is, whats my biggest issues you think i'll run into??

Second, if i do reformat, if i was to just burn a bunch of files on DVD like my photoshop, web page code, and flash code, docs, etc...will these files be corrupted because i can easily transfer my important data on a DVD ISO then reinstall it back into the computer once its formatted but i'm afraid that these files may also be corrupted and then just transfer any hidden viruses or malware..what do you advise??

Josh

 

[howard_hopkinso]

First, I advise you to post a fresh HJT log so I can check to see if the infections are still there. I`m pretty sure they will be, as I can`t find any information for anything that will successfully get rid of them.

If they are, then you should backup your important data and reformat.

Once you`ve completed the reformat and reinstall, post another fresh HJT log so I can check to see if your system is clean.

I hate having to advise someone to reformat, but in your case, it really is the best option.

Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

Okay here is the new one...maybe if you advise me on fixing the neccessary changes to the HJT log, we can do so but here it is.

Josh

 

[howard_hopkinso]

Just as I thought, the infections are still there.

You need to format and reinstall from scratch. Sorry, but that`s the way it`s got to be I`m afraid. There`s nothing I can do to help you get rid of those infections. Believe me, I would if I could.

Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

okay howard thanks, i'm hoping that the files i'm backing up on DVD wont be infected so once i reformat, i'll post a hjt log to see if its still there...

Josh

 

[howard_hopkinso]

Ok mate, no problem.

Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

okay all reformatted...i just ran the hijackthis log and seems to be fine except one thing..

O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - D:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

whats up with that?? I really hope i dont have to reformat again..everything runs great now..

Actually i just read up and its for my ATI graphics card for video streaming apparently..

 

[howard_hopkinso]

Your HJT log is clean as a whistle.

That 023 service is absolutely fine and the file missing part is caused by a small bug in HJT. The file isn`t actually missing.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

[*]Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re enable system restore here:
Managing Windows Millennium System Restore
or
Windows XP System Restore Guide
re-enable system restore with instructions from tutorial above.

[*]Re hide your system files. To do so, please follow the steps below:

1. Double-click My Computer.
2. Click the Tools menu, and then click Folder Options.
3. Click the View tab.
4. Put a check by "Hide file extensions for known file types."
5. Under the "Hidden files" folder, select "Do not show hidden files and folders."
6. Check "Hide protected operating system files."
7. Click Apply, and then click OK.

[*]Make your Internet Explorer more secure - This can be done by following these simple instructions:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Change the Initialise and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub-frames across different domains to Prompt
   • When all these settings have been made, click on the OK button.
   • If it prompts you as to whether or not you want to save the settings, press the Yes button.
5. Next press the Apply button and then the OK to exit the Internet Properties page.

[*]Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
Computer Safety On line - Anti-Virus
I recommend AVG Anti-Virus (Free Edition)!

[*]Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below:
Computer Safety On line - Software Firewalls
I recommend ZoneAlarm (Free Edition)!

[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

[*]Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software. A tutorial on installing & using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

[*]Install Ad-Aware - Install and download Ad-Aware. You should also scan your computer with the program on a regular basis just as you would an anti virus software in conjunction with Spybot. A tutorial on installing & using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

[*]Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
Computer Safety on line - Anti-Malware

[*]Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
[/list]
Follow this list and your potential for being infected again will reduce dramatically.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of u_j2carreiro only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[u_j2carreiro]

thanks howard for everything...