Malware, Trojan Alureon and others...

Re: Malware, Trojan Alureon and others...27th April 2009, 9:18 pm

========== FILES ==========
c:\windows\system32\zaruwawi.exe moved successfully.
File/Folder c:\program files\uTorrent not found.
c:\docume~1\christ~1\applic~1\uTorrent moved successfully.
c:\windows\system32\drivers\szinbuuq.sys moved successfully.
C:\Documents and Settings\ChristinaB\Desktop\dds.scr moved successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\\"Notification Packages"|hex(7):73,63,65,63,6c,69,00,00 /E : value set successfully!

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04272009_171807

Re: Malware, Trojan Alureon and others...27th April 2009, 9:21 pm

Hello.
The malware is gone now, but we need to talk.

The file I put in the script for OTMoveIt to move was created at exactly the same time as this folder:

c:\program files\Windows Live Safety CenterRebootActions

It was created: 2009-04-24 21:57

Did you download something via uTorrent/another P2P program and ran it? that folder name is a little suspicious, and even more suspicious why that sys file can't be found via a Google search, so it was probably malware.

That folder is probably malware too, but I need to know.

Re: Malware, Trojan Alureon and others...27th April 2009, 9:29 pm

I did not download anything using p2p program at that time. But that is exactly the time all the pop ups started on my computer. I thought one of them was Windows trying to tell me that I have viruses, and said to Run something called Spyware2009. I unfortunately did, and found out later that I shouldn't have. Maybe its that?

Re: Malware, Trojan Alureon and others...27th April 2009, 9:30 pm

I think you did download something malicious, because this folder was created just 4mins BEFORE that weird folder got on your machine.

C:\My Downloads

Lets run one more OTMoveIt script.

Save it to your desktop.
Please double-click OTMoveIt3.exe to run it.
Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:files
C:\My Downloads
c:\program files\Windows Live Safety CenterRebootActions
Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

Re: Malware, Trojan Alureon and others...27th April 2009, 9:34 pm

========== FILES ==========
C:\My Downloads moved successfully.
c:\program files\Windows Live Safety CenterRebootActions moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04272009_173353

Re: Malware, Trojan Alureon and others...27th April 2009, 9:36 pm

Hello.
Did you install Avira like I asked?

It's important you run an AV, there is some very dangerous malware on the internet. You need to keep Avira upto date.

We can remove OTMoveIt now.

Please double-click OTMoveIt3.exe to run it again.
Press the green CleanUp! button.
Press Yes cleanup process prompt, do the same for the reboot prompt.

How is the machine running now?

Re: Malware, Trojan Alureon and others...27th April 2009, 9:46 pm

Hi,
Yes, I did download Avira.
My computer does run much faster, and no more pop ups. Wink

Thanks for your help!

I did have one other concern. I'm going to assume that I got all this mess on 4-24 around 21:30ish. I had some very personal information in one particular folder (tax forms for this year that I never got around to deleting), and I was wondering with the types of viruses that I had, could they have gotten that information? If so, I guess I should probably go out and change some account numbers? Sad tearing

Thx.

Re: Malware, Trojan Alureon and others...27th April 2009, 10:03 pm

If you feel safer changing them, then do so.

Re: Malware, Trojan Alureon and others...27th April 2009, 10:05 pm

Well, i'm doing a google search for homework stuff, and all the sites i click on from google keep taking me to other sites. and the title on all the pages keep saying "Nothing found - Mozilla Firefox" that's probably not good. should I run a scan with Avira?

Re: Malware, Trojan Alureon and others...27th April 2009, 11:14 pm

Hello.
Okay, we'll fix that now. I had another user with the exact problem you had. The rootkit comes with a Google hijacker we can't say in logs.

Please download GooredFix and save it to your Desktop. Double-click GooredFix.exe to run it. Select 1. Find Goored (no fix) by typing 1 and pressing Enter. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt). Note: Do not run Option #2 yet.

Re: Malware, Trojan Alureon and others...27th April 2009, 11:28 pm

Also wanted to let you know that Avira found two viruses so far:

1) TR/Vundo.Gen
2) Recognition pattern of the HTML/Crypted.Gen HTML script virus

GooredFix v1.92 by jpshortstuff
Log created at 19:25 on 27/04/2009 running Option #1 (ChristinaB)
Firefox version 3.0.9 (en-US)

=====Suspect Goored Entries=====

C:\Program Files\Mozilla Firefox\extensions\{DE4AAE25-999B-4A13-9110-72B8384E1427}

C:\Program Files\Mozilla Firefox\extensions\{B6301458-0FE2-40F1-BAC4-67DCEE0CCE51}

C:\Program Files\Mozilla Firefox\extensions\{72838649-3477-48EB-9882-AA6470701B36}

C:\Program Files\Mozilla Firefox\extensions\{1793F2AD-B6D1-4590-B4BA-D1FCBD984122}

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

Re: Malware, Trojan Alureon and others...28th April 2009, 12:20 am

Please double-click GooredFix.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

Re: Malware, Trojan Alureon and others...28th April 2009, 1:53 pm

GooredFix v1.92 by jpshortstuff
Log created at 09:52 on 28/04/2009 running Option #2 (ChristinaB)
Firefox version 3.0.9 (en-US)

=====Goored Deletions=====
C:\Program Files\Mozilla Firefox\extensions\{DE4AAE25-999B-4A13-9110-72B8384E1427}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{B6301458-0FE2-40F1-BAC4-67DCEE0CCE51}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{72838649-3477-48EB-9882-AA6470701B36}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.
C:\Program Files\Mozilla Firefox\extensions\{1793F2AD-B6D1-4590-B4BA-D1FCBD984122}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.0.9\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"jqs@sun.com"="C:\Program Files\Java\jre6\lib\deploy\jqs\ff"

Re: Malware, Trojan Alureon and others...28th April 2009, 1:55 pm

Hello.
The Google redirect/hijacks should stop now.

Click Start >> Run and then copy/paste the following into the box and hit Enter:
"%userprofile%\Desktop\GooredFix.exe" /uninstall
note the space between " /
If any of your security programs query a new Registry/AutoStart value being added please allow the changes.

Re: Malware, Trojan Alureon and others...28th April 2009, 1:57 pm

Ok, all done. How about those other two issues that Avira found? I put them into quarantine, should I just delete them? Thanks.

1) TR/Vundo.Gen
2) Recognition pattern of the HTML/Crypted.Gen HTML script virus

Malware, Trojan Alureon and others...

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:18 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:21 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:29 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:30 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:34 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:36 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 9:46 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 10:03 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 10:05 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 11:14 pm

descriptionRe: Malware, Trojan Alureon and others...27th April 2009, 11:28 pm

descriptionRe: Malware, Trojan Alureon and others...28th April 2009, 12:20 am

descriptionRe: Malware, Trojan Alureon and others...28th April 2009, 1:53 pm

descriptionRe: Malware, Trojan Alureon and others...28th April 2009, 1:55 pm

descriptionRe: Malware, Trojan Alureon and others...28th April 2009, 1:57 pm

descriptionRe: Malware, Trojan Alureon and others...