Vundo.H Trojan HELP....Please....

[gracefulmoonie]

I have this nasty vundo.h virus that has been on my computer for several days detected when I did a malware scan.

please help me. I have done that scan like a million times and it keeps coming back after i reboot the computer.

Here are my Malwarebytes and HJ This logs. THANKS IN ADVANCE.

I also have tried to delete the file and registry keys manually, but FAILED.

Malwarebytes' Anti-Malware 1.36

Database version: 2147

Windows 5.1.2600 Service Pack 3

5/18/2009 5:18:58 AM

mbam-log-2009-05-18 (05-18-58).txt

Scan type: Quick Scan

Objects scanned: 76672

Time elapsed: 3 minute(s), 13 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 3

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a618ebdc-d5fb-4db1-a299-e6c0ef8216aa} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qiuwzsco (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{a618ebdc-d5fb-4db1-a299-e6c0ef8216aa} (Trojan.Vundo.H) -> Delete on reboot.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\hbdwssy.dll (Trojan.Vundo.H) -> Delete on reboot.

HJ This LOG-----------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:20:55 AM, on 5/18/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\AIM6\aim6.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\AIM6\aolsoftware.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE

C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: (no name) - {A618EBDC-D5FB-4DB1-A299-E6C0EF8216AA} - c:\windows\system32\hbdwssy.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

O20 - Winlogon Notify: qiuwzsco - C:\WINDOWS\SYSTEM32\hbdwssy.dll

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 3589 bytes

[miekiemoes]

Hi,

* Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

[gracefulmoonie]

miekiemoes,

Thanks so much for helping me.

Here is the Combofix log:

ComboFix 09-05-17.07 - tomtom 05/18/2009 10:25.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1594 [GMT -5:00]

Running from: c:\documents and settings\tomtom\Desktop\ComboFix.exe

AV: Norton 360 *On-access scanning disabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}

FW: Norton 360 *disabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\tomtom\Application Data\IUpd721

c:\documents and settings\tomtom\Application Data\IUpd721\Logs\scns.log

c:\documents and settings\tomtom\nah_log.dat

c:\temp\1cb

c:\temp\1cb\syscheck.log

c:\temp\PRE45

c:\temp\PRE45\pG8.log

c:\temp\tn3

c:\windows\system32\AX5

c:\windows\system32\db

c:\windows\system32\drivers\glakfblm.sys

c:\windows\system32\drivers\rlnxnpxk.sys

c:\windows\system32\hbdwssy.dll

c:\windows\system32\svm

c:\windows\system32\sX3i19

c:\windows\system32\u2

c:\windows\system32\vgtdpzf.dll

c:\windows\system32\yfmfrndr.dll

c:\windows\Tasks\At1.job

c:\windows\Tasks\vuufzvrg.job

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_RLNXNPXK

-------\Service_rlnxnpxk

((((((((((((((((((((((((( Files Created from 2009-04-18 to 2009-05-18 )))))))))))))))))))))))))))))))

.

2009-05-18 15:01 . 2009-05-18 15:01 447 ----a-w C:\backup.reg

2009-05-18 08:32 . 2009-05-18 08:32 -------- d-----w C:\VundoFix Backups

2009-05-18 07:29 . 2009-05-18 15:02 -------- d-----w c:\program files\Norton 360

2009-05-18 07:28 . 2009-05-18 08:00 60808 ----a-w c:\windows\system32\S32EVNT1.DLL

2009-05-18 07:28 . 2009-05-18 08:00 124464 ----a-w c:\windows\system32\drivers\SYMEVENT.SYS

2009-05-18 07:27 . 2009-05-18 08:00 -------- d-----w c:\program files\Symantec

2009-05-14 16:46 . 2008-10-16 19:06 208744 ----a-w c:\windows\system32\muweb.dll

2009-05-14 16:06 . 2009-05-14 16:06 -------- d-----w c:\program files\Trend Micro

2009-05-12 08:20 . 2009-05-12 08:20 -------- d-----w c:\documents and settings\tomtom\Application Data\cwqqbopm

2009-05-12 08:20 . 2009-05-12 08:20 -------- d-----w c:\documents and settings\tomtom\Local Settings\Application Data\cwqqbopm

2009-05-11 19:25 . 2009-05-11 19:25 -------- d-----w c:\documents and settings\NetworkService\Application Data\cwqqbopm

2009-05-11 19:25 . 2009-05-11 19:25 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\cwqqbopm

2009-05-06 09:19 . 2009-03-11 03:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe

2009-05-06 09:19 . 2009-05-06 09:19 -------- d-----w c:\windows\system32\KB905474

2009-05-06 09:19 . 2009-03-11 03:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-05-18 15:28 . 2008-11-09 22:11 -------- d-----w c:\program files\Common Files\Symantec Shared

2009-05-18 08:00 . 2009-05-18 07:28 806 ----a-w c:\windows\system32\drivers\SYMEVENT.INF

2009-05-18 08:00 . 2009-05-18 07:28 10635 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT

2009-03-30 04:47 . 2009-03-30 04:38 -------- d-----w c:\program files\Veoh Networks

2009-03-06 14:22 . 2004-08-03 23:56 284160 ----a-w c:\windows\system32\pdh.dll

2009-03-03 00:18 . 2006-03-02 07:28 826368 ----a-w c:\windows\system32\wininet.dll

2009-02-20 18:09 . 2004-08-03 23:56 78336 ----a-w c:\windows\system32\ieencode.dll

2009-02-19 19:03 . 2009-02-19 19:03 579464 ----a-w c:\windows\system32\SymNeti.dll

2009-02-19 19:03 . 2009-02-19 19:03 207240 ----a-w c:\windows\system32\SymRedir.dll

2009-02-19 18:31 . 2009-02-19 18:31 31280 ----a-w c:\windows\system32\drivers\SymIM.sys

2009-02-19 18:31 . 2009-02-19 18:31 41008 ----a-w c:\windows\system32\drivers\symndisv.sys

2009-02-19 18:31 . 2009-02-19 18:31 96560 ----a-w c:\windows\system32\drivers\symfw.sys

2009-02-19 18:31 . 2009-02-19 18:31 38576 ----a-w c:\windows\system32\drivers\symids.sys

2009-02-19 18:31 . 2009-02-19 18:31 37424 ----a-w c:\windows\system32\drivers\symndis.sys

2009-02-19 18:31 . 2009-02-19 18:31 22320 ----a-w c:\windows\system32\drivers\symredrv.sys

2009-02-19 18:31 . 2009-02-19 18:31 184496 ----a-w c:\windows\system32\drivers\symtdi.sys

2009-02-19 18:31 . 2009-02-19 18:31 13616 ----a-w c:\windows\system32\drivers\symdns.sys

.

------- Sigcheck -------

[7] 2004-08-03 23:56 502272 01C3346C241652F43AED8E2149881BFE c:\windows\$NtServicePackUninstall$\winlogon.exe

[7] 2008-04-14 00:12 507904 ED0EF0A136DEC83DF69F04118870003E c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-11-19 09:25 507904 3969440BA384D35317DBBDEEAAE641CE c:\windows\system32\winlogon.exe

[-] 2005-10-23 12:17 295424 C29A5286E64D97385178452D5F307B98 c:\windows\$NtServicePackUninstall$\termsrv.dll

[7] 2008-04-14 00:12 295424 FF3477C03BE7201C294C35F684B3479F c:\windows\ServicePackFiles\i386\termsrv.dll

[-] 2008-11-19 09:25 295424 63999D0ABD8DABFD76A9C07F6E104868 c:\windows\system32\termsrv.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"Aim6"="c:\program files\AIM6\aim6.exe" [2008-06-19 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]

"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2/18/2008 2:37 PM 149352]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/18/2009 3:01 AM 101936]

S1 bthusbb;bthusbb;c:\windows\system32\drivers\bthusbb.sys --> c:\windows\system32\drivers\bthusbb.sys [?]

S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 9:32 PM 23888]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST

*NewlyCreated* - RLNXNPXK

*Deregistered* - rlnxnpxk

Contents of the 'Scheduled Tasks' folder

2009-05-18 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 03:18]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-05-18 10:31

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]

"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]

"ImagePath"="-"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(920)

c:\windows\System32\BCMLogon.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\WLTRYSVC.EXE

c:\windows\system32\BCMWLTRY.EXE

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\WgaTray.exe

c:\program files\AIM6\aolsoftware.exe

.

**************************************************************************

.

Completion time: 2009-05-18 10:33 - machine was rebooted

ComboFix-quarantined-files.txt 2009-05-18 15:33

Pre-Run: 26,628,952,064 bytes free

Post-Run: 26,625,921,024 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

169 --- E O F --- 2009-05-13 08:02

[miekiemoes]

Hi,

This looks OK again. Detection for this latest variant was added to Mbam as well now.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

[miekiemoes]

Due to the lack of feedback, this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.