TROJAN VUNDO/ TROJAN DOWNLOADER.SUURCH

[idots r us i know]

Hi

 

Have ran Terminator Spyware remover and when i try to delete the critical objects i get this message:

 

SYSTEM RESTORE POINT

hard file remover disabled

 

REMOVE TROJAN

deletion failed

c:\windows\system32\jkkhatkb.dll

 

REMOVE TROJAN DOWNLOADER.SUURCH

deletion failed

c:\documents+settings\chris\local settings\temp\csrssc.exe

 

It says i should remove them myself but im not sure what to do!!

Any help would be great ty.

[Guest Wolfeymole]

Run the tools listed below and get to us.

 

 

 

• Malware is software designed to infiltrate or damage a computer system without the owner's informed consent.
  It is a combination of the words malicious and software.
  The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.
  

 

• Required Cleanup Steps
  
  1. Disable the Spybot Search & Destroy TEA TIMER if you use it and if it is enabled
     
  2. Run a Temporary file and cache cleaner (ATF)
     
  3. Run 2 Anti-Malware scanners (Listed Below)
     
  4. Run an Online Anti-Virus / Anti-Malware Scanner (Listed Below)
     
  5. Clear out old System Restore points
     
  6. If continued Malware type activity is present you may be asked to post a TrendMicro™ HijackThis™ Log file, do not do so unless requested.
     

The reason to run multiple scanners is to ensure that no single scanner is missing something.

The time it takes will vary depending on your system and your internet connection speed.

Typically the SUPERAntiSpyware and Malwarebytes scanners will take between 10 to 90 minutes.

The ESET online scan should take between 1 to 3 hours.

In most cases, these scans will suffice to clean and disinfect your computer.

Heavily infected systems or slower PCs can take much longer to scan and clean.

 

For best results print the following instructions and bookmark this Web page

To keep this guide printer-friendly, use your cursor to highlight the contents below.

From your browser select File - Print and in the printer dialog box under "Print range"

click the

Selection

choice to print out these instructions for removal of malware.

 

 

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/printer-selection.gif

 

____________________________________________

STEP 1

• Disable Spybot Search & Destroys' TEA TIMER: (if installed, if not go to Step 2)
  
  
  1. Run Spybot-S&D in Advanced Mode.
     
     
  2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
     
     
  3. On the left hand side, Click on Tools
     
     
  4. Then click on the Resident Icon in the List
     
     
  5. Uncheck "Resident TeaTimer" and OK any prompts.
     
     
  6. Restart your computer.
     
     

__________________________________________________

STEP 2

• Follow these instructions carefully.
  
  
• Download ATF-Cleaner from
  Snapfiles.com
  to remove un-needed temporary files from your computer that may contain malware.
  
  
• You can also download it from
  Majorgeeks.com
  
  
• When you run ATF-Cleaner, check the items as shown below for Main.
  
  
• For FireFox, be sure to click on the FireFox tab on top and check the items as shown below for FireFox
  
  
• NOTE:
  If you don't have FireFox or Opera installed then they will be grayed out and can be ignored
  
  
• Then click on "Empty Selected".
  
  

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/atf-cleaner01.gif

.

http://i306.photobucket.com/albums/nn266/FPCH/Malware%20Guide/atf-cleaner02.gif

__________________________________________________

STEP 3

• Install and run the free version (not the Professional version) of SUPERAntiSpyware from
  SUPERAntiSpyware.com
  
  
  • Accept any prompts to allow SUPERAntiSpyware to install the latest rules and infection definition files.
    
    
  • You do not have to send them your e-mail address, just click next.
    
    
  • You can leave the automated check for updates on.
    
    
  • You can uncheck "Send a diagnostic report to research center" if you don't want to send the information.
    
    
  • DO NOT
    allow SUPERAntiSpyware to protect your Home Page settings.
    
    
  • On the
    Top Left
    select the
    Scan your computer
    button.
    
    
  • Make sure there is a CHECK MARK on all
    Fixed Drives
    .
    
    
  • Click "Perform a Complete Scan". Click "Next" to Repair issues found and reboot the computer when prompted to do so.
    
    

__________________________________________________

STEP 4

• Install and run
  Malwarebytes' Anti-Malware
  from
  Malwarebytes - (direct download)
  
  
  • Accept all defaults for the installer
    
    
  • Allow the program to update the definitions
    
    
  • Click on the
    Quick Scan
    and click Next.
    
    
  • If any items are found allow it to clean them and then Reboot your computer.
    
    

__________________________________________________

STEP 5

• Run an online scan with ESET from
  Free Virus Scan: Use ESET's Online Antivirus Scanner
  
  
  • You
    must
    use Internet Explorer for this online scan. FireFox, Opera, etc will not work for this scan.
    
    
  • If your computer is running Window's Vista, then you
    must first
    start Internet Explorer as an Administrator. To do so, right-click on the
    Internet Explorer
    icon in the Start Menu and select "
    Run as administrator
    " from the popup context menu.
    
    
   
  • Accept the terms and click "Start".
    
    
  • Once the scanner is ready, check "Remove found threats" AND "Scan unwanted applications".
    
    
  • Click "Start" to begin the scan.
    
    
  • When completed restart your computer
    
    

__________________________________________________

Make sure your internet firewall security is enabled, and then please return to Extreme Tech Support - Free PC Help and tell us how the computer seems to be operating.

At that time, you will receive instructions to assist you in removing malicious programs from your Add/Remove program list if warranted.

 

If required this is the download link for TrendMicro™ HijackThis™

Unless instructed to by the Technician helping you then do not download this tool.

 

Once you and the Technician agree that your system appears to be clean then you should delete all your System Restore points and recreate a new one.

Please follow the instructions here

How to turn off and turn on System Restore in Windows XP

How to turn off and turn on System Restore in Windows Vista

[idots r us i know]

Hi

 

Im on my laptop, its my main pc thats having trouble.

 

I tried starting in safe mode with networking but i cant access the internet.

 

can i get on the net in safe mode?? because in normal mode, after 3 attempts i managed to download ATF cleaner and it worked but when i tried to download superanti spyware it stopped halfway thru. So restarted pc and when i tried to redownload, it came with a message saying its not part of system 32 or something like that. Now when i start pc, it say active desktop recovery and it wont let me access the internet at all.

[Seth]

Instead of Safe Mode, choose Last Known Good Configuration.

 

Then download Super and Malwarebytes from the lappy and transfer them to a USB stick or burn them to a cd.

 

Install them on the desktop and attempt to update them. If you can't, don't worry about and just run the full scans with each. Following that you should be able to update them and run the scans again.

[idots r us i know]

thanks

 

Hi seth

 

I have tried this previously and it wont let me go to last known good config.

 

Also can do nothing with restore points, its like it knows what im trying to do and blocks all attempts to get rid of this thing gggrrrr lol. Will try to burn cd off lappy when i get some disks thanks. have managed to download malware and its scanning now!! will let u know what happens.

[idots r us i know]

Hi seth

 

Its complete, found more THs and when i tried to remove it said REGEDIT is disabled malware will enable.

 

It finished and said some could not be removed, have just re started pc and wait to see what happens, gonna try and do the next step and scan for viruses with ESETs

[Seth]

Ok, get the Super and Malwarebytes scan done, then don't forget to update them and run them again (that is if they couldn't update).

 

Don't worry about the desktop problems, as once the system is clean, we can use Super to repair those types of issues.

[idots r us i know]

Hi

 

Have run and scanned with ESET and everything comes back clean!!

 

Now i have managed to do everything except SUPERanti spyware, the reason is everytime i try to download it, 6.33mb to download but everytime it gets to 5.31mb it just stops!! any ideas???

thanks seth

[Seth]

You're welcome.

 

Try one of these downloaders:

 

SUPERAntiSpyware FREE Edition Installer

 

SUPERAntiSpyware Professional Installer

 

If SUPERAntiSpyware is already installed but simply will not run, please download and run the following program to launch SUPERAntiSpyware:

 

RUNSAS.EXE

[idots r us i know]

Hi seth

 

Ive tried those links but same thing, 5.33mb and it stops downloading, i then have to reconnect to the internet!!

 

Not sure if this has any affect but all the link boxes and icons dont show properly, they have a little box with red,green and blue shapes in them!!

 

Also when i scroll down a page it does it very very slowly!!

[Seth]

Let's have a look at what's running on your PC (BTW-Can you get online now, and are you using IE6 or 7?)

 

Please download the latest version of HijackThis from Trend Micro and click on Download Hijack This Installer and save it to your desktop.

• Doubleclick HJTInstall.exe to install HijackThis.
  
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
  
• Click on Install.
  
• It will create a HijackThis icon on the desktop.
  
• Once installed, it will launch Hijackthis.
  
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in Notepad. Include this log by copying and pasting in your next reply.
  

Notes:

Do not use the AnalyseThis button, its findings are dangerous if misinterpreted.

Do not have Hijackthis fix anything yet. Most of what it finds will be harmless, or required for your computer to run like it should.

[Guest Wolfeymole]

That SAS executable don't work on my end Seth mate.

[idots r us i know]

yes im on the pc now as we speak, will download that hijack and let u know when im ready, thanks again seth, your help is really appreciated

[Seth]

That SAS executable don't work on my end Seth mate.

 

What one in particular? As it may not work if sas is installed.

[Guest Wolfeymole]

I don't have SAS installed as I run NOD32.

 

I talk of the immediate .exe file.

[idots r us i know]

WoW

im running ie7

Here it is:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:44:14 PM, on 11/15/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe

C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe

C:\Program Files\Spyware Terminator\sp_rsser.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Panda Software\Panda Antivirus 2007\apvxdwin.exe

c:\program files\panda software\panda antivirus 2007\WebProxy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\RTHDCPL.EXE

C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE

C:\WINDOWS\system32\NILaunch.exe

C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\PROGRA~1\INTERN~2\KBOSDCtl.EXE

C:\PROGRA~1\INTERN~2\KCodeMsg.EXE

C:\Program Files\PKR\pkrpal.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\lotus\organize\easyclip.exe

C:\lotus\smartctr\smartctr.exe

C:\lotus\smartctr\suitest.exe

C:\Program Files\Common Files\Teleca Shared\Generic.exe

C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [MediaKey] C:\PROGRA~1\INTERN~2\MEDIAKEY.EXE

O4 - HKLM\..\Run: [Net-It Launcher] C:\WINDOWS\system32\NILaunch.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [pkr pal] "C:\Program Files\PKR\pkrpal.exe" -osboot

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [EPSON Stylus DX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\WINDOWS\TEMP\E_SA8.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exe

O4 - Global Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exe

O4 - Global Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exe

O4 - Global Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exe

O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: 32Red Poker - {437F7F6F-FFCC-47e1-8A4B-C992493CF6C3} - C:\Microgaming\Poker\32RedMPP\MPPoker.exe

O9 - Extra button: Purple Lounge Poker - {701FD202-200A-4bd1-9380-BC8A722B43A5} - C:\Microgaming\Poker\PurpleloungeMPP\MPPoker.exe

O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe

O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe

O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe

O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe

O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Microgaming\Poker\ladbrokesMPP\MPPoker.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\chris\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)

O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\chris\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (HKCU)

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashpoker.ladbrokes.com/ladbrokes/FlashAX.cab

O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

O20 - AppInit_DLLs: dzcwvy.dll

O20 - Winlogon Notify: jkkHATKb - jkkHATKb.dll (file missing)

O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe

O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

O24 - Desktop Component 0: (no name) - http://www.niceic.org.uk/portal_css/niceicdefault/header_niceic.gif

O24 - Desktop Component 1: (no name) - http://www.kitchenplanneronline.com/images/kitchen-planner-online.gif

O24 - Desktop Component 2: (no name) - http://www.beama.org.uk/images/topImage.jpg

O24 - Desktop Component 3: (no name) - http://www.eca.co.uk/_includes/_fluid/styles/themes/grayMatters/graphics/backgrounds/vertical3.jpg

--

End of file - 8957 bytes

[Seth]

I don't have SAS installed as I run NOD32.

 

I talk of the immediate .exe file.

 

Oh I see.

 

I shouldn't have posted that .exe as sas already needs to be installed for it to run.

 

Thanks.

[Guest Wolfeymole]

No problem Seth and I'll let you concentrate on the HJT, most of which looks like my daughters machine which had 4500 instances of malware on it.

[Seth]

Nothing in the log of any real significance, although I bet you got the infection from one of the poker sites.

 

Try resetting IE7 on the desktop computer, then attempt to download sas. Also try getting it from Free Software Downloads and Reviews - Download.com

 

1.Open Internet Explorer 7.

2.Click Tools, and then click Internet Options.

3.Click the Advanced tab.

4.Under Reset Internet Explorer Settings, click Reset.

 

Have you been trying to download sas from both computers? You should be able to get it using one of them.

 

When you do get it to run, go into its prefernces>scan logs, and please post the log.

[Guest Wolfeymole]

Nothing of any significance?

 

UNINSTALL ALL THAT POKER CRAP IMMEDIATELY if you want your machine to be well again.

 

Then run SAS and Malwarebytes as listed in our recommended security products.

[Seth]

Nothing of any significance?

 

UNINSTALL ALL THAT POKER CRAP IMMEDIATELY if you want your machine to be well again.

 

Then run SAS and Malwarebytes as listed in our recommended security products.

 

Problem is, most poker sites are ok. It's a matter of trying to find out which are.

 

Mcafee's Site Advisor might be of assistance, but the log technically doesn't show any malware.

[idots r us i know]

Thanks seth

 

I feel like a pro now lol i actually reset ie7 about 10 mins ago to see if it would help, still no joy!!

 

I will try that link to download SUPER

 

Earlier today i deleted a few things that looked of no signifigence in 'my computer' not sure if that has had an effect as to why its scrolling slowly and doesnt show web pages properly.. what do you think???

 

Will have a hunt around and try to get SUPER downloaded and do as you suggested thankyou.

[Guest Wolfeymole]

Please do as I advise Idiot.

[Seth]

Do whatever you need to do to run SAS, and again, I need to see its log.

 

So you were able to update and run MalwareBytes?

[idots r us i know]

I did update malware and ran it and that worked fine, have done as instructed by wolfey!!

gonna restart computer now