networm-1.virus@fp

[dhenning]

I came upon your site yesterday in an attempt to rid my badly infected computer of the networm virus. I also found Vundo SmitFraud PurityScan and several other nasties on the computer. I downloaded Howard's instructions and, I believe, followed them exactly and hopefully the computer is now "cured". I did consider just wiping the drive but I thought in the interest of a learning experience, I would at least attempt this.

Starting from the beginning, I couldn't run the online virus scanner. I ran HJT and I saved the log but only the second log is attached. I sort of got ahead of myself and ran AVG before step 14 but I saved the log and it is attached. But all other steps were competed in order.

Panda Antirootkit came back with nothing detected. I've got my Window's Defender set to run a scan every Monday and to quarantine anything it finds.

I'd prefer you email any questions or comments to my email however, I'll try to remember to come back here and check for further threads on this post. Also let me know if you need the first HJT txt file. I did save it.

Thanks very much for all your help. I think next time I will just wipe the drive.

dlh

 

[howard_hopkinso]

Hello and welcome to Techspot.

All items in your AVG Antispyware log say "No Action Taken" or "Ignored". That`s because you haven`t told AVG Antispyware to quarantine it`s results as per the instructions. See this pictorial guide.

Your system is badly infected and you need to follow any instructions given exactly.

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as fresh HJT, Combofix and AVG Antispyware logs.

Regards Howard :wave: :wave:

This thread is for the use of dhenning only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[dhenning]

Reply

Sorry for the delay. I did as you suggested and have attached the appropriate files except the AVG... just can't seem to get that report but I realized my mistake this time. However, AVG found about 10 tracking cookies and that was it. I had the program delete them. Should I have quarantined them? Which is better? Also there wasn't any file under c:\ that was avenger.txt, so I don't know if I did something wrong or if the file didn't get created. Also, when I ran Avenger, it didn't restart the computer twice only once. Should I try again? HJT, combofix reports are attached.

 

[howard_hopkinso]

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\SYSTEM32\ndigqnco.dll
C:\WINDOWS\SYSTEM32\knnmp.bak1
C:\WINDOWS\SYSTEM32\knnmp.bak2
C:\WINDOWS\svhost.exe
C:\WINDOWS\SYSTEM32\dwdsrngt.exe
Folder::
C:\VundoFix Backups

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"svhost"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"dc2d8f06"=-

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a fresh HJT log.

Regards Howard

This thread is for the use of dhenning only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.