Can't get rid of Trojan horse(s) - any suggestions?

[Steinar Gregertsen]

Okay, so a few days ago my PC got a Trojan horse infection (please don't ask.... ) and "stuff" keeps popping up,- not very often, but often enough to present a real annoyance.
The Trojans in question are named Generic3.UUB and Collected.11.B, plus an Adware Generic2.DO. The dll names of these files change every time AVG finds them..

I have searched all over the Internet and run every program I've come over (including VundoFix which was supposed to remove this specific threat), tried to track them down and remove them manually, and my last attempt was to follow the instruction in this post at the AVG forum:

* turned off system restore
* ran a disk cleanup
* installed, updated and ran CW Shredder
* installed, updated and ran SpyBot - Search And Destroy
* installed, updated and ran Ad-Aware
* updated and ran AVG 7.5 Internet Security (my default firewall and virus program)

Hoping this had taken care of the problem I rebooted the PC and reactivated system restore.

5 minutes later - kaboooom!! - annoying ads pops up (they pop up in IE7 even if I have Firefox set as my default browser), and AVG catch the Trojan files and place them in the virus vault for the umpteenth time...

What to do now? Is reformatting the only way to rid of this %&&%%"¤"?

Steinar

[Wiz Feinberg]

download and install/update AVG anti-rootkit and AVG anti-spyware, formerly Ewido. Both are available for free at http://free.grisoft.com. Run these progams after disabling System Restore, the reboot into safe mode and run them again, along with AVG anti-virus.

Be sure that AVG anti-virus is fully updated.
Empty all temporary files, everywhere on the hard drive, including the Recycle Bin. A lot of threats hide in those various temp locations.

Run SFC /SCANNOW after all the above are completed. You must have your Windows XP CD in the CD tray when you run this utility. Allow it to replace changed files. Afterward go to Windows Update and download all available updates, in case SFC replaced an updated file.

[Steinar Gregertsen]

Thanks Wiz, I'll go through the procedures later tonight. Just one question,- what's SFC /SCANNOW?

Steinar

[Joe Harwell]

Click on the link below.

UnHackMe

Their complete security suite is pretty good.

The demo is fully functional.

Not free but worth the investment in my opinion.

Worked for me.

[Wiz Feinberg]

Thanks Wiz, I'll go through the procedures later tonight. Just one question,- what's SFC /SCANNOW?

Steinar

Steinar;
SFC is an abbreviation for System File Checker. This command line utility from Microsoft verifies that critical operating system files have not been tampered with or corrupted, and replaces them with known good backups if they are. However, in the process of replacing files it is possible that the replacement will be older than the current version, if the current version is a patch file or hotfix. That's why I recommended running Windows Updates after SFC has completed.

If all the previously mentioned tools fail to remove your adware problems you may have to go to a HijackThis forum for help from a trained professional. This is usually the last resort before Format C, because the process gets very involved and is time consuming. Often, if a person doesn't have a lot of data files that aren't already backed up externally, the fastest repair is a format, reinstall, re-update. Of course, if you have image backups that are made daily, or weekly, you can be back up and running within a half hour, with a minimum of updating to get back to current status.

[Steinar Gregertsen]

I've gone through the full procedure now and it seems to have killed the horses. Anti-Rootkit didn't find anything and all Anti-Spyware found was 20 tracking cookies - only problem I ran into was that Anti-Rootkit wouldn't run in safe mode after the first run and reboot.

Been about half an hour without any pop-ups yet, so everything seems fine (I usually got a rush of pop-ups when logging on after a reboot), but I don't feel entirely safe yet, they'll probably start popping up again as soon as I hit the "submit" button....

Thanks a lot for your assistance, much appreciated!

Steinar

[Steinar Gregertsen]

They're back...........
I knew it was too good to be true when AntiRootkit failed to find anything and all AntiSpyware found were a bunch of "medium risk" tracking cookies...

I will download the UnHackMe software that Joe suggested, and if that doesn't help either I guess there is only one option left...

Steinar

[Steinar Gregertsen]

UnHackMe didn't find anything, but I'll go through the procedures mentioned in the post at AVG's forum one more time (see my first post) - I realized that I forgot to reboot in safe mode and rerun the programs. That should take at least 7-8 hours all in all, it'll be a long night...

I don't have a recent image of this PC, but I'll just burn the most important personal stuff from "My Documents" plus email address list, bookmarks and calendar to CDs, and reinstall all programs if I have to reformat. Hopefully none of my personal stuff is infected...

Steinar

[Steinar Gregertsen]

double...

[Joe Harwell]

Do the messages start with your email on or off?

It's kind of an old exploit and probably not your problem. But make sure Messaging is turned off.
It is a Service.

Control Panel> Admin Tools> Component Services> Services> Messenger

Double click and disable if not already.

Are you running any Instant Messaging programs?

Steiner, download the whole suite from the UnHackMe site and run the security tools. They will fully function in the demo version.

It's worth a try before you reformat/reinstall.

[Steinar Gregertsen]

Thanks Joe - I don't run any messaging programs, don't want them so I deactivated them long ago. The pop-ups usually start when I open Firefox, but they open in IE.. Doesn't seem to have anything to do with my email program (Thunderbird).

I'll give the full UnHackMe suite a run if the advice from the AVG forum doesn't help,- that'll probably keep me busy until 3-4 this morning since I can't start after I'm finished teaching for the evening. If it gets me nowhere I'll run the UnHackMe suite tomorrow..

This stuff was hidden in a .rar file including a keygenerator for a CD burning program. I stopped running cracked programs several years ago, but for some reason I went and got the keygen when this demo expired.
So I brought this on myself and guess I got what I deserved for being cheap - point taken and lesson learned...

Steinar

[Joe Harwell]

I hope that I didn't confuse you concerning Windows Messenging Service and instant messaging programs.
Not the same. So if the malicious code is exploiting the Messenging Service, turning it off will not help.

Also, I missed some critical info you supplied in your original post that reminded me of something that I need to check. What you have described, I believe, is some sort of polymorphic device that was embedded in the .rar file which is used to fly under normal AV scans of compressed files. They are usually well crafted which makes them so nasty. Not your normal kiddie scriptors probably.

But like Dracula, you must invite him in.

Confession is good for the soul.
Your penance: Treat us with one of your outstanding performances !

[Steinar Gregertsen]

One of several things that happened when I opened the rar file was that the black DOS (?) window opened for a few seconds and some stuff was written in a frenetic tempo - as if it went straight for the heart of my system. Does that give you any clue?

Your penance: Treat us with one of your outstanding performances!

I've never written an angry punk tune before, but this may be the excuse I need to do one.....

Steinar

[Joe Harwell]

Was probably just a call to the dos box to echo the decompression of the files. Was there an installation wizard launched after the decompression?

I guess you could say that would be a constructive, creative use of computer-generated frustration. I personally prefer something a little more soul soothing a la Jimmy Day.

[Steinar Gregertsen]

Was there an installation wizard launched after the decompression?

I don't remember, there was so much happening. But I did my best to shut down everything that popped up as fast as I could. You can say I was struck by more than a touch of panic.....

It's been 'quiet' here for several hours now, the pop-ups and warnings I've seen today all came when I turned on my PC and launched Firefox.

Steinar

[Joe Harwell]

While you're cleaning house, I'd run a SmitFraud fix, too. Link below.

SmitfraudFix

[Wiz Feinberg]

Steinar;
Are you protected by a hardware router/firewall? If not, what software firewall is protecting your computer from unsolicited incoming tranmissions?

If you need a software firewall, ZoneAlarm from Checkpoint is excellent and comes in either free or paid versions.

The reason I mentioned this has to do with what Joe told you, concerning the "Messenger Service." This is not the same thing as Windows (Live) Messenger, or MSN Messenger, or any IM program. This is a popup notice service that is capable of reacting to remote input on UDP ports 1026 through 1031. Originally created to allow SysAdmins to send notices about server reboots to company employees at workstations, the Messenger Service is now mostly used by spammers to send Messenger Blasts to millions of un-firewalled computers at the same time.

To disable this totally useless service go to Start > Run and type or copy/paste this into the input field:

Services.msc

When the Services Management Console opens look through the list for "Messenger" and double click on it. If you opened the correct service you will see this in the description field:

Transmits net send and Alerter service messages between clients and servers. This service is not related to Windows Messenger. If this service is stopped, Alerter messages will not be transmitted. If this service is disabled, any services that explicitly depend on it will fail to start.

Click the STOP button, then change the "Startup Type" to Disabled, then click Apply, then OK. to close the management console.

You will no longer receive any popup alerts from spammers using the Messenger Service.

Any firewall should block incoming traffic on the ports used to blast Messenger spam.

[Steinar Gregertsen]

Thanks for the instructions, I'll deal with that asap.
The firewall/AV I use is AVG 7.5 Internet Security (full version, not the free).

Steinar

PS - checked the Messenger Service, it was already disabled.

[Wiz Feinberg]

Steinar;
You might want to read my information about running your daily browsing/email account as a Limited User, instead of Computer Administrator, and how this protects you against viruses and spyware. The details are found in these articles I wrote: Windows 2000 and XP User Privileges Explained, and Limited User Privileges Protect PCs From Adware, Rootkits, Spyware and Viruses.

[Joe Harwell]

The Trojans in question are named Generic3.UUB and Collected.11.B, plus an Adware Generic2.DO. The dll names of these files change every time AVG finds them..
Steinar

Another question:

Is the .dll actually be renamed or just finding more .dll's associated with the trojans?

[Wiz Feinberg]

Joe. Are you thinking SmitFraud.c?

[Steinar Gregertsen]

Wiz - thanks again! I'll read them as soon as I get the chance.

Joe - here are some examples, this is what I currently have in AVG's Virus Vault:

1 - Virus name:
Trojan horse Generic3.UUB
File name:
brjcwoyk.dll

2 - Virus name:
Trojan horse Generic3.UUB
File name:
ixpbmbkc.dll

3 - Virus name:
Trojan horse Collected.11.B
File name:
bkvmcriv.dll

4 - Virus name:
Adware Generic2.DO
File name:
dwbkjump.dll

The names registered under "Virus name" remains the same every time they're caught by AVG, the .dll file names changes.every time.
The paths to all these are also the same -
Documents And Settings\Steinar\Local Settings\Temp

Don't know if this helps or not, but that's all I know so far...

Steinar

[Wiz Feinberg]

Steinar;
Visit this web page, read the instructions there, download SmitFraudFix, by Siri. Follow the instructions, then reboot into Safe Mode and run the utility as per instructions.

Let me know the results.

[Joe Harwell]

To Steinar: that helps a lot. It appears it is just finding multiple .dll's associated with the trojan.

Where ever the executable on this thing is,
it generates a random filename each time and places it in that temp directory.
Even tho you delete the temp, you haven't deleted the source. So...you have an infinite loop.

That's good because things should be able to be fixed.

Wiz is bringing it up to the next level with the port monitoring and your firewall which I had some questions about myself but this has been a pretty heavy exchange of info.

To Wiz: Correct. The fix will look at some other issues besides the SmitFraud if I understand it correctly that could be rootkit oriented. In particular, the dos scan on reboot looks especially good.

[Joe Harwell]

I think you are close to cleaning this up, Steinar.

If the SmitFraud fix does not work, go here:

http://forums.spybot.info/

Read the FAQ and start a thread with your issues.
Some one will reply and give you some instructions.
Follow the instructions.

I think posting a HiJackThis log to the spybot forum will be the quickest way
to locate the malicious executable/s and to clean up your registry.

They've got the tools to analyze the log.

Basically, what Wiz said at the beginning is what they'll have you do again.