Yet another win32:tratBHO{Trj}

Maxx_original · 2008-02-11T12:14:03.000Z

at least these items are strange

O2 - BHO: (no name) - {31FB794C-2E47-4CB1-BA77-5346D843F0B7} - C:\Program Files\Windows Media Player\hokevC:\WINDOWS\System32\ecw8\renamd83122.exe.dll (file missing)
O2 - BHO: (no name) - {A051B1FF-8D7E-418B-AABE-4FF82F4280A2} - C:\WINDOWS\System32\ssqrsrs.dll
O4 - HKLM..\Run: [runner1] C:\WINDOWS\mrofinu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx
O20 - Winlogon Notify: ssqrsrs - C:\WINDOWS\SYSTEM32\ssqrsrs.dll

anybody to confirm?

system · 2008-02-11T13:11:03.000Z

If it’s any help the symptoms are that Avast pops up exactly every 60 mins with the virus warning. Each time it’s a dll file in my system32 folder. I either move it to the vault or delete it. Seems to make no difference as exactly 60 mins later it seems another dll file has been generated with the virus. I have a feeling it’s connected with some dll files in my system32 folder as follows:

rqrsrpn.dll, rqronmj.dll and ssqrsrs.dll

I only suspect these as they have a date and time about the time I started getting the virus warnings. I was tempted to just delete or rename them but I wasn’t sure this was the best thing to do. I have scanned it with Avast but it didn’t show anything.

I’m also not sure about the following one either …

C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe

John

oldman960 · 2008-02-11T13:38:52.000Z

Hi

Run combofix first then HJT. Post both logs.

You can attach them by using the additional options button on the reply page.

system · 2008-02-11T15:02:02.000Z

Thanks Oldman.

Logs attached.

After running Combofix and rebooting Spybot popped up saying it had detected some registry changes. I assume this was down to Combofix so I allowed them. Hope that was right.

John

system · 2008-02-11T16:55:11.000Z

Just to add that Avast has stopped popping up with virus warnings every hour so that’s looking promising.

oldman960 · 2008-02-11T17:03:00.000Z

It looks like some, but not all has been removed. If you can live with it til this afternoon, I’ll be home then and we can get the rest.

system · 2008-02-11T17:54:25.000Z

Hi !

I still cant remove the virus…

Please e-mail to bskude@yahoo.com with tips on how to remove it. I am currently using avast home version 4.7 and this software cannot remove the virus

Thank you in advance !

/Bjorn Skude

system · 2008-02-11T18:09:37.000Z

bskude -

Please start your own post on your problem as Nodge is being helped in this thread. You will get better help if you do. Welcome to the forums.

system · 2008-02-11T18:23:50.000Z

Oldman. many thanks for your help so far. Not sure if I did right or not but I ran another virus scan with Avast and it did pick up some more viruses which I moved to the chest. Not sure how I post a log from Avast so I did a screen grab of the results and I’m attaching that.

Thanks

John

oldman960 · 2008-02-12T05:53:02.000Z

Sorry for the delay.

the avast detections where infected system restore oint. The restore point shouldn’t be a problem unless you use them. We’ll clean then put in a bit.

Open Spybot and make sure teatimer is disabled, we will re-enable afterwards. To do so do the following

Click mode
click Advanced mode
if you get a warning answer “yes”
click tools
click resident
uncheck resident “teatimer” and SDHelper if installed
click allow change
reboot
Download and Unzip to your Desktop: http://www.techsupportforum.com/sectools/ResetTeaTimer.zip
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

reboot

Please submit these files for analysis

To submit a file to virustotal, please click on this link

www.virustotal.com

copy and paste the following into the upload a file box (one at a time if more than one file is listed)

C:\WINDOWS\b116old.exe
C:\WINDOWS\b122old.exe
C:\os350142.bin

scroll down a bit and click “send file”, wait for the results and post then in your next reply.

Open HJT, run a system scan only, check mark these lines if present

O2 - BHO: (no name) - {31FB794C-2E47-4CB1-BA77-5346D843F0B7} - C:\Program Files\Windows Media Player\hokevC:\WINDOWS\System32\ecw8\renamd83122.exe.dll (file missing)
O4 - HKLM..\Run: [runner1] C:\WINDOWS\mrofinu1000106.exe 61A847B5BBF72813329B385772FF01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKCU..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\nores.mht!http://adxrnet.net/code/chm/xpre.chm::/xpreload.ocx

Close all other browsers/windows, click fix, close HJT.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

File:: C:\Temp\gwLsx9101.exe C:\Program Files\Dot1XCfg\Dot1XCfg.exe
Folder::
C:\WINDOWS\system32\ecw8
C:\Program Files\Dot1XCfg
C:\WINDOWS\system32\pie2
C:\WINDOWS\system32\nGpxx01
C:\Temp\gTiis19
C:\Temp\cXzz9

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.

system · 2008-02-13T11:13:11.000Z

Thanks for your help with all this Oldman.

I’m attaching the various logs.

oldman960 · 2008-02-13T13:42:37.000Z

Just 2 more to get rid of, then we do some clean up.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

Files:: C:\WINDOWS\b116old.exe C:\WINDOWS\b122old.exe

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply

[b]note[\b] when doing the combofix fix

system · 2008-02-13T20:04:44.000Z

OK, done that.

Didn’t know what you meant by “note[\b] when doing the combofix fix”

Here’s the Combofix log attached.

Thanks again,

John

oldman960 · 2008-02-14T03:06:21.000Z

Hi
The part of the post you asked about, it’s part of my copy/pasted canned version of the comboscript fix that didn’t apply in this case. Must have missed it when I removed that part.

Well, it looks like we may have to hammer those two.

Any other problems?

Please download
OTMoveIt2 by OldTimer.

Save it to your desktop.

Please double-click OTMoveIt2.exe to run it.

Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

C:\WINDOWS\b116old.exe
C:\WINDOWS\b122old.exe

Return to OTMoveIt2, right click in the “Paste List of Files/Folders to be Moved” window (under the light blue bar) and choose Paste.

Click the red Moveit! button.

Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

NOTE: If OTMOVEITE reboots, before you can get the ruslts they can be found here
C:_OTMoveIt\MovedFiles**_.log
(where “**_” is the “date_time”)

system · 2008-02-14T11:25:54.000Z

OK. Done that and got this …

C:\WINDOWS\b116old.exe moved successfully.
C:\WINDOWS\b122old.exe moved successfully.

OTMoveIt2 v1.0.20 log created on 02142008_112326

John

oldman960 · 2008-02-14T13:34:49.000Z

That should have been the last of them.

Everything ok now? Let me know.

Here’s a clean up routine to if eveything is good.

Click start button, run, then copy and paste the following line into the box and click ok.

ComboFix /u

Open OTMoveIt, then click the Clean Up button. You may get prompted by your firewall that OTMoveIt wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself.
Make a new clean restore point

To clear existing restore points

1.Click Start, click All Programs, click Accessories, click System Tools, and then click System Restore.

2.Click to add a check mark beside Turn off System Restore on all Drives, and click Apply.

When you are warned that all existing Restore Points will be deleted, click Yes to continue.

All system restore points are deleted.

Now you should manually create a restore point.

1.Click Start, click All Programs, click Accessories, click System Tools, and then click System Restore.

2.Click Create a Restore Point, and then click Next.

3.Name your restore point. (use the date as well as a descriptive term such as “After Restore Point Deletion.”) click create, click close.

Update your java

Open an Internet Explorer (only) window and go to http://java.sun.com/javase/downloads/index.jsp > Scroll down to “Java Runtime Environment (JRE) 6 Update 4…allows end-users to run Java applications”.

Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it’s OK to display the blocked content.

You do not have to install the Java Web Start ActiveX Control

Accept the license agreement > Click on Windows (XP,Vista, .etc) Offline Installation, Multi-language and Save the file jre-6u4-windows-i586-p.exe to your desktop; do not Run it.

When the download is complete, Open Control Panel > Add/Remove Programs:

Uninstall anything that says Sun Java, Java JRE, or similar.

Close Add/Remove Programs.

In Windows Explorer, navigate to C:\Program Files\Java <=this folder, if found. Delete any subfolders it may contain.

Do NOT delete C:\Program Files[b]JavaVM[/b] <=this folder, if found!

Reboot your computer.

Double-click on the saved file to install the update.

Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Download and run this clean up utility. You can use it regularly. When it’s first run, it is in demo mode to show you what it will remove. Review it and then rerun in real mode. It is configurable.

CleanUp

If you are using windows firewall, please note that it doesn’t provide outbound protection. A third party firewall will.

A discussion on free firewalls can be found here.

http://forum.avast.com/index.php?topic=30808.0

Don’t forget to re-enable Teatimer.

Take care abd keep safe.

system · 2008-02-14T15:22:20.000Z

OK. Working through that. About to remove the old Java stuff. I have the attached listed under Add/Remove Programs. Do I remove them all?

Thanks

oldman960 · 2008-02-14T15:31:35.000Z

Yes, they are all old versions.

system · 2008-02-14T15:56:17.000Z

All done

Many thanks for your help Oldman. All seems to be running ok. To be honest all I noticed before was Avast popping up with a virus warning. Just out of interest what were all these nasties doing to my system?

John

oldman960 · 2008-02-19T13:50:16.000Z

Sorry, I didn’t see your reply.

Most of it was vundo, and it was probably getting ready to download more of it’s friends and swamp you in ad popups.

You’re welcome.

Announcements