System Volume Information infected with Trojan/Virus

[melka]

I have been fighting with this for 2 weeks. Kaspersky detected Trojan-ClickerWin32.Cycler.ajnt in the System Volume Information folder in the restore file, wants to delete on re-boot but fails. Malwarebytes see a Trojan.unruy in the same files, same location and also fails to clean on re-boot. SVI is a protected folder which I cannot access. Computer is a Dell running XP service pk 2. I was unable to post from the infected computer, just hung. I have tried turning off system restore, safe mode, re-installing XP, Microsoft's kb831829 modifying virus software to remove virus from system restore, Spybot, removing registry entries, and still no luck. Need some help if possible please. Thank-you

Log file from

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4286

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

09/07/2010 6:28:49 PM

mbam-log-2010-07-09 (18-28-49).txt

Scan type: Quick scan

Objects scanned: 5682

Time elapsed: 25 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

C:\System Volume Information\_restore{d5fffa500b1b}\svchost.exe (Trojan.Unruy) -> Failed to unload process.

C:\System Volume Information\_restore{d5fffa500b1b}\smss.exe (Trojan.Unruy) -> Failed to unload process.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Fiore Calarco at 19:20:23.65 on 09/07/2010

Internet Explorer: 6.0.2900.2180

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.115 [GMT -4:00]

AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FW: Norton Internet Worm Protection *enabled* {1AADEB1F-B11B-42FD-B43A-21E7A73362D8}

FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Nikon\NkView5\NkvMon.exe

C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Canon\CAL\CALMAIN.exe

Executable.exe 4

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe

C:\Documents and Settings\Fiore Calarco\Local Settings\Temporary Internet Files\Content.IE5\P3QQX2HS\dds[2].pif

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.dell.com

uWindow Title = Microsoft Internet Explorer provided by Bell Business ISP

uSearch Bar = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5555

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

uURLSearchHooks: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2010\ievkbd.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll

BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {577EBCA9-8ED3-45FC-A514-55B3817D4BCF} - No File

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

uRun: [bitTorrent DNA] "c:\program files\dna\btdna.exe"

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

mRun: [soundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [blackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background

mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"

mRun: [ToolBoxFX] "c:\program files\hp\toolboxfx\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on

mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

mRun: [avp] "c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe"

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

dRun: [hsf87efjhdsf87f3jfsdi7fhsujfd] c:\windows\temp\CMD.exe

dRun: [hsfg9w8gujsokgahi8gysgnsdgefshyjy] c:\windows\temp\CMD.exe

dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10e.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkvmon~1.lnk - c:\program files\nikon\nkview5\NkvMon.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony corporation\picture package\picture package menu\SonyTray.exe

IE: Add to Anti-Banner - c:\program files\kaspersky lab\kaspersky internet security 2010\ie_banner_deny.htm

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {62789780-B744-11D0-986B-00609731A21D} - hxxp://apps104.ottawa.ca/emap/mgaxctrl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {EFD1E13D-1CB3-4545-B754-CA410FE7734F} - hxxp://costco.pnimedia.com/upload/activex/v3_0_0_2/PhotoCenter_ActiveX_Control.cab

Notify: igfxcui - igfxdev.dll

Notify: klogon - c:\windows\system32\klogon.dll

AppInit_DLLs: c:\progra~1\kasper~1\kasper~1\mzvkbd3.dll,c:\progra~1\kasper~1\kasper~1\kloehk.dll

============= SERVICES / DRIVERS ===============

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-14 36880]

R0 sonypvl3;sonypvl3;c:\windows\system32\drivers\sonypvl3.sys [2006-2-5 18110]

R1 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2009-9-1 128016]

R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2010-6-25 315408]

R1 sonypvf3;sonypvf3;c:\windows\system32\drivers\sonypvf3.sys [2006-2-5 619390]

R1 sonypvt3;sonypvt3;c:\windows\system32\drivers\sonypvt3.sys [2006-2-5 423454]

R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2010\avp.exe [2009-10-20 340456]

R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2009-9-14 32272]

R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-10-2 19472]

S0 cruswlsh;cruswlsh; [x]

S1 sonypvd3;Sony DVD Handycam;c:\windows\system32\drivers\sonypvd3.sys [2006-2-5 64964]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-14 133104]

S2 lanmanworkstationCiSvc;Workstation lanmanworkstationCiSvc;c:\windows\system32\acelpdect.exe srv --> c:\windows\system32\ACELPDECt.exe srv [?]

S3 HP1319EWS;HP1319EWS;c:\windows\system32\drivers\HP1319EWS.SYS [2008-7-26 10752]

S3 HP1319FX;HP1319FX;c:\windows\system32\drivers\HP1319FAX.SYS [2008-7-26 11264]

S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2010-4-23 50704]

S3 PID_0920;Logitech QuickCam Express(PID_0920);c:\windows\system32\drivers\LV532AV.SYS [2005-10-30 152576]

=============== Created Last 30 ================

2010-07-09 22:33:15 0 ----a-w- c:\documents and settings\fiore calarco\defogger_reenable

2010-07-09 22:28:56 54016 ----a-w- c:\windows\system32\drivers\wurkwri.sys

2010-06-25 04:41:36 97549 ----a-w- c:\windows\system32\drivers\klick.dat

2010-06-25 04:41:36 113933 ----a-w- c:\windows\system32\drivers\klin.dat

2010-06-25 04:38:57 0 d-----w- c:\program files\Kaspersky Lab

2010-06-25 04:38:57 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab

2010-06-25 04:35:50 0 d-----w- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files

2010-06-25 00:49:21 24576 -c--a-w- c:\windows\system32\dllcache\userinit.exe

2010-06-25 00:49:21 24576 ----a-w- c:\windows\system32\userinit.exe

2010-06-24 21:45:17 24576 ----a-w- c:\windows\system32\stu2.exe

2010-06-23 01:32:10 0 d-----w- c:\program files\Spybot - Search & Destroy

2010-06-23 01:32:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2010-06-22 01:41:04 0 d-----w- c:\docume~1\fiorec~1\applic~1\Malwarebytes

2010-06-22 01:40:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-06-22 01:40:39 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-06-22 01:40:38 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-06-22 01:40:37 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-06-21 02:55:43 0 d-----w- c:\windows\pss

2010-06-20 15:19:47 135168 ----a-w- c:\windows\system32\igfxres.dll

2010-06-20 15:05:07 488 ---ha-r- c:\windows\system32\logonui.exe.manifest

2010-06-20 15:04:55 749 ---ha-r- c:\windows\WindowsShell.Manifest

2010-06-20 15:04:55 749 ---ha-r- c:\windows\system32\wuaucpl.cpl.manifest

2010-06-20 15:04:55 749 ---ha-r- c:\windows\system32\sapi.cpl.manifest

2010-06-20 15:04:55 749 ---ha-r- c:\windows\system32\ncpa.cpl.manifest

2010-06-20 14:00:52 13753 ----a-r- c:\windows\SETE5.tmp

2010-06-20 14:00:48 1086058 ----a-r- c:\windows\SETD9.tmp

2010-06-20 14:00:46 1042903 ----a-r- c:\windows\SETD6.tmp

2010-06-20 13:58:29 534855680 ----a-w- c:\windows\MEMORY.DMP

2010-06-20 13:47:03 0 ----a-w- c:\windows\SET15F.tmp

2010-06-15 19:09:51 0 d-----w- c:\windows\dell

==================== Find3M ====================

2010-06-25 04:26:07 89526560 --sha-w- c:\windows\system32\drivers\fidbox.dat

2010-06-25 04:26:07 1200092 --sha-w- c:\windows\system32\drivers\fidbox.idx

2010-06-25 04:26:07 1165088 --sha-w- c:\windows\system32\drivers\fidbox2.dat

2010-06-25 04:26:07 110228 --sha-w- c:\windows\system32\drivers\fidbox2.idx

2010-06-20 14:52:42 23444 ----a-w- c:\windows\system32\emptyregdb.dat

2010-06-02 23:47:37 50728 ----a-w- c:\docume~1\fiorec~1\applic~1\GDIPFONTCACHEV1.DAT

2010-04-23 10:21:58 281104 ----a-w- c:\windows\system32\wpcap.dll

2010-04-23 10:21:58 100880 ----a-w- c:\windows\system32\Packet.dll

2010-04-22 00:10:49 75 ----a-w- c:\documents and settings\fiore calarco\jagex_runescape_preferences2.dat

2010-04-22 00:10:49 41 ----a-w- c:\documents and settings\fiore calarco\jagex_runescape_preferences.dat

2010-04-22 00:00:12 0 ----a-w- c:\documents and settings\fiore calarco\jagex__preferences3.dat

2007-10-28 19:52:58 744 ----a-w- c:\program files\INSTALL.LOG

============= FINISH: 19:22:34.06 ===============

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{d5fffa500b1b}\svchost.exe (Trojan.Unruy) -> Delete on reboot.

C:\System Volume Information\_restore{d5fffa500b1b}\smss.exe (Trojan.Unruy) -> Delete on reboot.

Log file DDS

Attach.zip

ark.zip

[kahdah]

Hello melka

Welcome to Malwarebytes.

=====================

One or more of the identified infections is a backdoor trojan or rootkit.

This type of infection has the capabilities to allows hacker to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identity Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

If you still want to clean it please do the following

===================

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[melka]

Hi Kahdah

Not sure if the protocol is to write at the top or bottom.

Thank you for your reply. Both the virus and Malwarebytes said the infection was in smss.exe and svchost.exe. Am I correct in thinking that is I reformatted and do a new install I would be safe in backing up the data and pictures and then re-installing them once I have the system back up and running?

Thanks Melka

[kahdah]

Hi those are not the legitimate files for your operating system those are malware files.

But yes if you format the drive then reinstall Windows it will be gone.

You are fine to backup your docs and such.

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!