new thrills..

Viruses and worms
1

Hi everyone, I have a new (or mutated) kind of malicious software in my pc.
i was having this popup from avast(free) about my svchost.exe.
When scanning the software finds file “bpdjkqnchbfoh.sys” in my windows/system32 folder.
I try to take it to the chest(via avast), it says “unauthorized action” or sth like this.
i delete it(the “bpdjkqnchbfoh.sys”), it comes back. i rename it, the same.
Google it, again null.

Oh, the block popup said sth about “91.212.127.147/spm/s_get_hst.php?ver=530”(tried to take me there)

Should i try “cleaning” my svchost.exe?

Additional fyi: I probably got this from a divx program a friend of mine downloaded yesterday night(from a watch-***-online website)

Thank you!

the contents of the bpdjkqnchbfoh.sys file look like encrypted c++.

2

Try this

Malwarebytes Anti-Malware 1.46 http://filehippo.com/download_malwarebytes_anti_malware/
always run update before you scan so you have the latest database
click on the remove selected button to quarantine anything found
you may post the scan log here

3

heh, it’s in greek, anyway, full-scan…
first log (full-scan, found 4 infected files, cleaned 3 on site, 1 for reboot-clean):

Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org

Έκδοση βάσης δεδομένων: 4880

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

19/10/2010 4:29:44 μμ
mbam-log-2010-10-19 (16-29-44).txt

Τύπος σάρωσης: Πλήρης σάρωση (C:|)
Αντικείμενα που σαρώθηκαν: 270155
Χρόνος που έχει διανυθεί: 1 ώρα(ες), 48 λεπτό(ά), 15 δευτερόλεπτο(α)

Μολυσμένες διεργασίες στη μνήμη: 0
Μολυσμένα στοιχεία στη μνήμη: 0
Μολυσμένα κλειδιά στο μητρώο: 0
Μολυσμένες τιμές στο μητρώο: 0
Μολυσμένα αντικείμενα δεδομένων στο μητρώο: 0
Μολυσμένοι φάκελοι: 0
Μολυσμένα αρχεία: 4

Μολυσμένες διεργασίες στη μνήμη:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα στοιχεία στη μνήμη:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα κλειδιά στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένες τιμές στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα αντικείμενα δεδομένων στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένοι φάκελοι:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα αρχεία:
C:\Users\Κώστας\AppData\Local\Temp\320C.tmp (Rootkit.TDSS) → Quarantined and deleted successfully.
C:\Users\Κώστας\AppData\Local\Temp\67DB.tmp (Rootkit.TDSS) → Quarantined and deleted successfully.
C:\Users\Κώστας\AppData\Local\Temp\DC9C.tmp.exe (Rootkit.TDSS) → Quarantined and deleted successfully.
C:\Windows\system32\Drivers\str.sys (Rootkit.Agent) → Delete on reboot.

4

second log (after restart), the 1 file not boot-cleaned:

Malwarebytes’ Anti-Malware 1.46
www.malwarebytes.org

Έκδοση βάσης δεδομένων: 4880

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

19/10/2010 5:28:24 μμ
mbam-log-2010-10-19 (17-28-24).txt

Τύπος σάρωσης: Γρήγορη σάρωση
Αντικείμενα που σαρώθηκαν: 141179
Χρόνος που έχει διανυθεί: 10 λεπτό(ά), 53 δευτερόλεπτο(α)

Μολυσμένες διεργασίες στη μνήμη: 0
Μολυσμένα στοιχεία στη μνήμη: 0
Μολυσμένα κλειδιά στο μητρώο: 0
Μολυσμένες τιμές στο μητρώο: 0
Μολυσμένα αντικείμενα δεδομένων στο μητρώο: 0
Μολυσμένοι φάκελοι: 0
Μολυσμένα αρχεία: 1

Μολυσμένες διεργασίες στη μνήμη:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα στοιχεία στη μνήμη:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα κλειδιά στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένες τιμές στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα αντικείμενα δεδομένων στο μητρώο:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένοι φάκελοι:
(Δεν εντοπίστηκαν επιβλαβή αντικείμενα)

Μολυσμένα αρχεία:
C:\Windows\system32\Drivers\str.sys (Rootkit.Agent) → Delete on reboot.

Also today avast caught the bpdjkqnchbfoh.sys file(thx?)
Although the initial popup abbout the url/svchost.exe remains.

Thanks for your time!

5
Although the initial popup abbout the url/svchost.exe remains.
Try running these

Kaspersky TDSS killer http://support.kaspersky.com/downloads/utils/tdsskiller.exe
Norman Malware Cleaner http://www.norman.com/support/support_tools/58732/en-us

report back

6

Hi again!
i tried the kasperki guy first.
first scan found a rootkit to be reboot-deleted plus the “bpdjkqnchbfoh.sys”(wich had a “skip” prefixed action).
Rebooted, rescanned, found the latter plus two other.
Rebooted to kill em… and then, a blue screen (plus memories…)! info about the crash dump: STOP: 0x0000008E (0xc0000005, 0x8699345E, 0x9A933987, 0x00000000).

Rebooted in safe mode. kasperski found nothing. Tried the norman guy but canceled it(i was leaving) and got another blue screen.

As of then, none of the two softw finds the malware mentioned before, only a new one.
However I don’t think I’m clean, because i have some “color errors” like too much grey in windows bars etc. plus most web pages won’t show up properly(like i have a wrong page formatting or something), eg.i can’t see the logo on youtube (i can see the video).

Also i don’t have all logs from the anti-mal… here is a relevant(and small enough to post…)from tdsskiller

7

and this is a fresh hijackhunter log:

8

Follow this guide form our expert malware remover Essexboy
http://forum.avast.com/index.php?topic=53253.0

To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( OTL.Txt and Extras.Txt.)

9

I ran otl twice. The first time i got an error: cannot create c://users/…/Downloads/bat.cmd

The second time i had no error messages and here’s the logs:

Thx again…

10

Hi - I will need to use a stronger tool I feel as it is hiding from OTL. At least you are not using a 64bit system which makes the job a tad easier

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[*]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[*]Double click on ComboFix.exe & follow the prompts.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

11

Done! However, before combofixing i ran a boot-time scan with avast and it found 3 corrupted files in the folder c:users\κωστας\appdata\locallow\sun\java\deployment\cache\6.0\32\wally\ and files charter.class , powerat.class and services. Those 3 are in avast chest now.
Also some of my visible file security preferences were changed (i could see desktop.ini etc) but i manually changed that and its ok. Also i’m not having the ‘colors issue’ anymore! (so i’m like virus free maybe?)
Thanks guys!

12

Aye some of the tools I use will show system files as part of the cleaning process - we will reset them later. There is one final hidden driver to remove

  1. Please open Notepad
    [*] Click Start , then Run[*]Type notepad .exe in the Run Box.

  2. Now copy/paste the entire content of the codebox below into the Notepad window:

File:: c:\users\AAAA~1\AppData\Local\Temp\AEAHN.exe

Driver::
AEAHN

  1. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

  2. Save the above as CFScript.txt

  3. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

  1. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    [*]Combofix.txt [*]A new OTL log.
13

So I ran the script, ComboFix ran twice (one for update i think),BUT it did not restart on its own, rather the prompt gave me a line that looked like chinese (i’m greek).I “translated” the line and it said sth like “2. was not expected at this time…” and it was still for some time. I closed the prompt and shut down the computer manually/regularly (combofix.txt).

I restarted in safe mode and ran the OTL(wich didn’t have an extras.txt)and afterwards ran CF with the script for a 2nd time(combofix2.txt).

In the desktop, no visible lagging. In games, slower than death.

I also noticed a “ZJFOL” service running…

Thank you essexboy! (as in “swiffer, meredith”)

14

OK I see that, it is only run when the system is up and running so it is not a rootkit, but I am concerned so I will use a different programme to kill it, this one will inform me if there is a rootkit running

  1. Please download The Avenger2 by Swandog46 to your Desktop.
    [*]Right click on the Avenger.zip folder and select “Extract All…”
    [*] Follow the prompts and extract the avenger folder to your desktop
  2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here: Drivers to delete: ZJFOL

Files to delete:
c:\users\AAAA~1\AppData\Local\Temp\ZJFOL.exe



Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

  1. Now, open the avenger folder and start The Avenger program by clicking on its icon.

[*] Right click on the window under Input script here:, and select Paste.
[*] You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
[*] Click on Execute
[*] Answer “Yes” twice when prompted.

  1. The Avenger will automatically do the following:
    [*]It will Restart your computer. ( In cases where the code to execute contains “Drivers to Delete” or “Drivers to Disable”, The Avenger will actually restart your system twice.)
    [*]After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    [*] The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  2. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh OTL log .
15

Damn, I’ m beginning to like this…

16

'Tis a bit more fun from my side ;D

What problems are you experiencing now ?

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Please download Malwarebytes’ Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

[*]Make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
[*]If an update is found, it will download and install the latest version.
[*]Once the program has loaded, select “Perform Quick Scan”, then click Scan.
[*]The scan may take some time to finish,so please be patient.
[*]When the scan is complete, click OK, then Show Results to view the results.
[*]Make sure that everything is checked, and click Remove Selected.
[]When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
[]The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
[*]Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

17

Well, MBAM found nothing and everything seems fine… that was pure surgery! ;D Thank you guys with a joke:
A beef steak walks into a bar and says to the bartender:
-I’ ll have a double scotch, no ice
But the bartender replies:
-Sorry sir, we don’t serve food…

18

Looking at that I am a happy bunny :slight_smile: And so was the joke Ta ;D

I will remove my tools now and give some recommendations, but I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands [resethosts] [purity] [emptytemp] [EMPTYFLASH] [Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done

.
Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.

http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. Beware it is NOT supported for use in 9x or ME and probably will not install in those systems

Upgrading Java:

[*]Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 22.
[*]Click the “Download” button to the right.
[*]Select your Platform and check the box that says: “I agree to the Java SE Runtime Environment 6 License Agreement.”.
[*]Click on Continue.
[*]Click on the link to download Windows Offline Installation (jre-6u22-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager…
[*]Close any programs you may have running - especially your web browser.
[*]Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
[*]Check any item with Java Runtime Environment (JRE or J2SE) in the name.
[*]Click the Remove or Change/Remove button.
[*]Repeat as many times as necessary to remove each Java version.
[*]Reboot your computer once all Java components are removed.
[*]Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u22-windows-i586-p.exe and select “Run as an Administrator.”)

SPRING CLEAN

Download and run Puran Disc Defragmenter

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
[*]SpywareBlaster to help prevent spyware from installing in the first place.

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes. Run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit
[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe :wave: