Vundo!grb removal guidance

[ArtD]

I was severely infected with the vundo!grb trojan horse. Dang, that thing propagated in my machine fast!

I followed the 8 step process. Please see attached logs and advise. Am I clean now?

Note: After I downloaded the current version of java, McAfee warned me about msiexec.exe was attempting to change some registry settings. I blocked to be safe. However, I'm worried that my machine isn't clean.

Thanks for your expert help.

 

[mflynn]

OK update and run MBAM and SAS again Quick Scan, as they may find more. We are after a clean log!

Only after the above is completed and logs posted do the below.

Download ComboFix

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

Install Recovery Console if connected to the Internet!

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.
=========================================

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.

Mike

 

[ArtD]

Thank you, Mike.

Attached are the clean logs.

 

[ArtD]

Attached are the logs from ComboFix, SDFix, and HiJackThis.

ComboFix ran fine. But, SDFix showed some messages in the blue background window something like "can't find specified file", and something about "A" not being a recognized command, then after being 75% complete, it locked up in safe mode with no SDFIx screen and no icons on the desktop. After waiting a long time, I held the power button down. Upon boot up in normal mode, the hard drive was crunching away and eventually calmed down. I tried the SDFix process again and got the same results.

hmmmmmm ... do I need to manually remove SDFix?

Thanks again for your help.

 

[mflynn]

If you had a Norton/Symantec product at one time in the past you need to run the Norton cleanup tools.
----------------------------------------------------------------------------------------------------------------------
Norton is hard to remove fully and properly and can cause non apparent issues and performance issues until properly cleaned.

Norton removal tool (use this to cleanup after a normal uninstall or if it will not uninstall)
http://majorgeeks.com/Norton_Removal...NRT_d4749.html

Then SymRegFix ftp://ftp.symantec.com/public/english_us_canada/tutorials/SymRegFix.exe

To download using Internet Explorer. Click the following link to download the file:

SYMMSICLEANUP.reg ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SYMMSICLEANUP.reg
Save the file to the Windows desktop.

To download using Firefox. Right-click the following link and then click Save Link As to download the file:

SYMMSICLEANUP.reg [ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/SYMMSICLEANUP.reg

then
Use same instructions for IE or FF to get the below.

IE: MSIFIX.bat ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/MSIFIX.bat

FF: MSIFIX.bat ftp://ftp.symantec.com/public/english_us_canada/linked_files/tsgen/MSIFIX.bat

Run all above in order presented.
----------------------------------------------------------------------------------------------------------------------

If you used the Norton cleanup above then...

Run HJT Scan only and select and fix the below entries.
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

Reboot.
----------------------------------------------------------------------------------------------------------------------
A final scan should finish up do the below

DrWeb

Go here Download DrWeb https://www.techspot.com/vb/post724044-3.html

Then....

Boot to Safe Mode only! Not with Networking and run...

DrWeb will fisrt do an Express Scan on its own when it completes then you should do a full scan.

The first Virus it finds select Cure and it will use this as the default automatically for all the rest. What it can't fix will be Quarantined!

This will take a while based on CPU and HD speed and size, but is worth it!

Post the results of all above and the Drweb log!

Mike

 

[ArtD]

Thanks, Guru Mike. I'll run and report back tonight.

OK.

I ran the Norton Removal Tool, then SymRegFix, SYMMSICLEANUP.reg, and MSIFIX.bat

I reran HJT (none of the specified O23 services were indicated, see attached log)

I ran DrWeb, all flagged files seem to be associated with ComboFix and SDFix. At the end, the cure option was not available, I did not move or delete any of the flagged files. See attached log.

I repeated the SDFix procedure again (ran SDFix.exe in normal mode, then runthis.bat in safe mode). I got the same same unusual results: messages like "system cannot find the path specified" and "A is not a recognized internal or external comment". The blue background window disappeared after 75% completion and the system locked up. I had to hold the power button down to restart (in normal mode). The fixtool never ran and no report popped up. Although the hard drive was ticking like a machine gun for a good five minutes. I attempted to attach the SDFix report, however, its the same as the last one because the manage attachments tool says I already uploaded it (even when I change the filename).

What are my next steps? There are so many loose ends that I'd like to clean up.

Thank you for your continued expert help.

 

[mflynn]

It is your Mcafee interfereing.

But I believe we are now clean.

So do the closing below and report back the status. How is computer running now, anything else?

Thread Closing-------------------------------------------------------------------

Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

Remove ComboFix
Start-Run
type
combofix /u
Hit enter or click OK.

Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.

Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

If prompted to Reboot click, Yes.
OTCleanit will delete itself when finished, If not delete it by yourself.

-------------------------------------------------------------------------------------
Run CCleaner http://www.ccleaner.com/download/builds (get SLIM at bottom no Yahoo toolbar)
Run twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner. (When installing uncheck Relevant Knowledge do not install)
-------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
-------------------------------------------------------------------------------------
ERUNT
Add a redundent Reg backup, get and install ERUNT let it add itself to startup and do a backup on install check all boxes.

ERUNT http://www.larshederer.homepage.t-online.de/erunt/
Yes! Even if you use system restore and other backups Registry and Images.
-------------------------------------------------------------------------------------

Every two weeks or so, run MBAM and SAS until clean.

They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

If they find something they can not clean, then get back to us.

Additionally run CCleaner. ATF-Cleaner and KCleaner.
----------------------------------------------------------------------------------------
I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to be used with and to co-exist with other Virus scanners.

Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

It's like looking at it with 2 sets of eyes and from a different angle.

It works like some Firewalls do to learn what is good/bad.

After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

As it queries you about the prompt to help you determine to approve or not you can google it with one click.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

A Disk Scan (chkdsk) and Defrag are in order.

Mike

 

[ArtD]

Mike,
Thank you so much!!! The system is running great now -- there's no evidence of infection. Thanks for the cleanup procedures and the extra preventative tips!
- Art