Kavo/Hacktool/Trojan.Arbinder and more

[wchou]

Well - I got infected and am trying to get my laptop better.

Symptoms: I kept getting odd popups of Kavo trying to install so I ran a Symantec Antivirus full scan. That identified a number of infections (including Hacktool) and my system locked up while Symantec said it was trying to clean them. Then Symantec stopped working so I tried to uninstall it so I could download a trial version of another AV program. That failed, so I did a manual uninstall of Symantec. Now whenever I right click on a folder or file it brings up windows installer trying to install a componenent of Symantec Antivirus.

I then found this site and followed the instructions posted in the malware removal thread.

1. Panda AntiRootkit was clean.
2. I attached Hijack this log, combofix log and AVG AntiSpyware log.

Thanks in advance for any help you can provide...

 

[Bobbye]

I don't do the hijack logs- someone will be here to take you through.

But I did look at the log and can tell you right up front that you have WAY too many programs and apps on Startup! If they start on boot, then they will be running in the background. It will affect your performance.

Processes like:
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe

don't need to start on boot and can be called on to start when you need them. You have quite a few others that should be taken off the startup menu. After the malware is handled, let me know if you'd like help knowing what you do and do not need on startup..

 

[wchou]

Thank you. I will take you up on that once I get my laptop clean again...

 

[howard_hopkinso]

Hello and welcome to Techspot.

First, you need to run this Symantec/Norton removal tool.

Then, you need to rename HJT as per these instructions.

Finally, post fresh HJT and Combofix logs.

Regards Howard :wave: :wave:

This thread is for the use of wchou only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[wchou]

OK - I ran the Norton Removal tool. It ran and required a reboot, but the right click problem is still there. It still tried to kick off the Microsoft Installer for Symantec Antivirus.

I decided to be brave and look through the registry for keys with the value "Symantec Antivirus". I found some keys and using some educated guesses I deleted two keys. The deletion of those two keys stopped the installation problem so that is now resolved. Maybe the tool didn't work because this was a Corporate Version of the AntiVirus sofware?

Anyhow - I also renamed HiJackThis per the instructions, re-ran it along with ComboFix and both logs are attached.

Thanks...

 

[howard_hopkinso]

Your HJT log is clean.

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

File::
C:\WINDOWS\rr.dat
C:\AgzNew09i.exe
C:\WINDOWS\uninst.exe
C:\WINDOWS\system32\drivers\lvuvc.hs
F:\ntdelect.com
Folder::
C:\Program Files\Common Files\Symantec Shared
C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\PROGRA~1\SYMANT~1
C:\Program Files\WildTangent
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vptray]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Symantec AntiVirus"=-
"SPBBCSvc"=-
"SNDSrvc"=-
"SavRoam"=-
"DefWatch"=-
"ccSetMgr"=-
"ccEvtMgr"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afa4a2c2-836c-11dc-9b27-00038a000015}]

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Regards Howard :wave: :wave:

This thread is for the use of wchou only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[wchou]

How long should I allow combofix to run? I tried it twice this morning and it locked up both times. The first time I let it run for 30 minutes and I turned off the laptop to reboot. That time I did have some windows open and I did click in the ComboFix window so I assumed maybe I caused the lockup.

The second time I was very careful. I did not open any windows. I did not click in the ComboFix window.

I was very careful to drag the text file into combo box and then all I did was type "1" and "Enter". I then left the laptop alone to ensure I did not cause a permanent desktop disable per warning.

That ran for 90 minutes until I turned off the PC again.

Hi again.

I am posting another HiJackThis log because I had some startup items disabled using "msconfig" on the previous run. I used "msconfig" to return to normal startup and reran HiJackThis.

I am not sure if this was necessary but figured more info was better.

Thanks...

 

[howard_hopkinso]

Ok, we`re going to have to tackle this a different way.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

WildTangent
BioPlugin
viewpoint

Close control panel.

1. Please download The Avenger by Swandog46 from HERE. Save it to your Desktop and extract it.

2. Download the attached avengerscript.txt and save it to your desktop

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by double clicking on its icon on your desktop.

Under "Script file to execute" choose "Load script from file".
Now click on the folder icon which will open a new window titled "open Script File"
navigate to the file you have just downloaded, click on it and press open
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please attach the content of c:\avenger.txt into your reply, as well as a fresh HJT and Combofix log.

Regards Howard

This thread is for the use of wchou only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[wchou]

OK - I tried to run the script and I kept getting errors related to the registry keys, so I took those out and manually deleted them myself after avenger was done.

I also saw BioPlugin was included in the script file for deletion. I deleted those two lines from the script file because that is a legitimate program I need.

Attached are the 3 files. I hope my manual kluges did not mess this process up.

Thank you.

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

WildTangent
Apps
CDA

Close control panel.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

GameDrvr.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [WildTangent CDA] "C:\Program Files\WildTangent\Apps\CDA\GameDrvr.exe" /startup "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0500.dll"

O16 - DPF: {840C0CD0-7644-4B60-86FD-CB19A5400A21} (FuntownAx Control) - https://member.funtown.com.tw/MemberCenter/RegisterAccount/FuntownAx.cab


Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\Program Files\WildTangent<Delete the entire folder.

Reboot into normal mode and rehide your protected OS files.

Post fresh HJT and Combofix logs and let me know if you`re still having problems.

Regards Howard

This thread is for the use of wchou only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[wchou]

Thank you for your help Howard. You sure are busy here

I have no more symptoms to report.

How would one go about learning what things to look for while reviewing the hijackthis and combofix logs?

 

[howard_hopkinso]

That all looks good. You can now get rid of all the tools etc we used during clean up.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

Go HERE, download and install the latest version of Java.

Once it`s installed, go to add remove programmes in your control panel and uninstall all previous versions of Java, except version 6 update 3. Close Control panel.

As regards learning to analyse the various log files, it takes a lot of work and practice to understand it all properly.

However, if you really would like to learn, then I recommend you join the Malware Removal University. You`ll recieve help from qualified teachers.

Please be aware that this is very time consuming and not for the faint hearted.


If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of wchou only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.