Tech Support Forum - View Single Post - Infected by vundo.gen.k (trojan) and pop ups abound

alba · 11-08-2008, 10:11 AM

Hi ericgarcb

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

===============================================

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

===============================================

Open notepad and carefully copy/paste all the text in the code box below into it:

Code:


http://www.techsupportforum.com/security-center/hijackthis-log-help/308786-infected-vundo-gen-k-trojan-pop-ups-abound.html#post1792822

Collect::
c:\windows\system32\suwcamwo.dll
c:\windows\system32\gopejlke.dll
c:\windows\system32\loxydo.pif
c:\Program Files\Common Files\elelahyp.reg
c:\windows\system32\tljcdpkpffbgtpt.dll
c:\windows\system32\cont_offersfortoday-remove.exe
c:\windows\system32\mcvowdhmpaic.exe
c:\windows\cvchost.exe
c:\windows\dl.exe
c:\windows\msstasks.exe
c:\windows\mssys.com
c:\windows\mstasks1.exe
c:\windows\mstaskss.exe
c:\windows\msxmidi.exe
c:\windows\reg33.exe
c:\windows\rocky.exe
c:\windows\system\wmscrop.exe
c:\windows\system32\d2kpax.exe
c:\windows\system32\ied.exe
c:\windows\system32\miniport_mp.exe
c:\windows\system32\winproc32.exe
c:\windows\system32\tljcdpkpffbgtpt.dll
c:\windows\system32\U3cSBf33.exe 

File::
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job

Folder::
c:\program files\AntivirusPro2009

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBEF9CDB-E1F7-8D3A-2682-9B6FBD0B9127}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"keocrolkmdtikea"=-

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.
**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.

================================================

Establish an internet connection & perform an online scan with Internet Explorer at
Go here to run an online scannner from ESET.

Note: You will need to use Internet explorer for this scan
Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats and the option Scan unwanted applications are checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic and also let me know how things are now.

=================

Upload this file

c:\program files\Common Files\erib.bin

to http://virusscan.jotti.org and report back what it found.

At the top of the window you should see "File to Upload & scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit".

When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" here.

**If the site is too busy, upload it to http://www.virustotal.com/en/indexf.html

=================

In your next post, please include fresh logs from:

ComboFix.txt
EsetOnlineScanner log.txt
Jotti report

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now

11-08-2008, 10:11 AM	#5 (permalink)
alba Analyst, Security Team Join Date: Feb 2005 Location: Eire Posts: 2,006 OS: Vista, Ubuntu 8.04	Re: Infected by vundo.gen.k (trojan) and pop ups abound Hi ericgarcb Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Open notepad and carefully copy/paste all the text in the code box below into it: Code: http://www.techsupportforum.com/security-center/hijackthis-log-help/308786-infected-vundo-gen-k-trojan-pop-ups-abound.html#post1792822 Collect:: c:\windows\system32\suwcamwo.dll c:\windows\system32\gopejlke.dll c:\windows\system32\loxydo.pif c:\Program Files\Common Files\elelahyp.reg c:\windows\system32\tljcdpkpffbgtpt.dll c:\windows\system32\cont_offersfortoday-remove.exe c:\windows\system32\mcvowdhmpaic.exe c:\windows\cvchost.exe c:\windows\dl.exe c:\windows\msstasks.exe c:\windows\mssys.com c:\windows\mstasks1.exe c:\windows\mstaskss.exe c:\windows\msxmidi.exe c:\windows\reg33.exe c:\windows\rocky.exe c:\windows\system\wmscrop.exe c:\windows\system32\d2kpax.exe c:\windows\system32\ied.exe c:\windows\system32\miniport_mp.exe c:\windows\system32\winproc32.exe c:\windows\system32\tljcdpkpffbgtpt.dll c:\windows\system32\U3cSBf33.exe File:: c:\windows\Tasks\At1.job c:\windows\Tasks\At10.job c:\windows\Tasks\At11.job c:\windows\Tasks\At12.job c:\windows\Tasks\At13.job c:\windows\Tasks\At14.job c:\windows\Tasks\At15.job c:\windows\Tasks\At16.job c:\windows\Tasks\At17.job c:\windows\Tasks\At18.job c:\windows\Tasks\At19.job c:\windows\Tasks\At2.job c:\windows\Tasks\At20.job c:\windows\Tasks\At21.job c:\windows\Tasks\At22.job c:\windows\Tasks\At23.job c:\windows\Tasks\At24.job c:\windows\Tasks\At3.job c:\windows\Tasks\At4.job c:\windows\Tasks\At5.job c:\windows\Tasks\At6.job c:\windows\Tasks\At7.job c:\windows\Tasks\At8.job c:\windows\Tasks\At9.job Folder:: c:\program files\AntivirusPro2009 Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BBEF9CDB-E1F7-8D3A-2682-9B6FBD0B9127}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "keocrolkmdtikea"=- Save this as CFScript.txt Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ================================================ Establish an internet connection & perform an online scan with Internet Explorer at Go here to run an online scannner from ESET. Note: You will need to use Internet explorer for this scan Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Make sure that the option Remove found threats and the option Scan unwanted applications are checked Click Scan Wait for the scan to finish Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt Copy and paste that log as a reply to this topic and also let me know how things are now. ================= Upload this file c:\program files\Common Files\erib.bin to http://virusscan.jotti.org and report back what it found. At the top of the window you should see "File to Upload & scan" and a blank box. Copy and paste the red text from above into the box. Then click "submit". When it is finished, please copy and paste the information listed under "Service" and "Scanner Results" here. If the site is too busy, upload it to http://www.virustotal.com/en/indexf.html ================= In your next post, please include fresh logs from: ComboFix.txt EsetOnlineScanner log.txt Jotti report Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now __________________ Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat** Last edited by alba; 11-08-2008 at 11:07 AM.