Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

[attn Mods] Trojan.vundo.dvs - Tried Everything

Options
ThePacifist
ThePacifist
in Malware talk

Hi,


Recently BD started popping up with "Trojan.Vundo.DVS quarantined" messages every 10 seconds.


- Tried scanning with BD could not find anything.


- Tried Vundofix. It found a file infected as "C:\windows\system32\ddcCRIaw.dll". But It could not delete it even after repeated trials.


- Tried Avenger to delete this file. Avenger deleted this file on first go. Still BD popups did not stop.


- Saw on this forum that some user tried StopZilla. I tried the same and Stopzilla deleted virtumonde along with 11 other spywares.


- Restarted. Popups still dont cease.


- Retried deleting C:\windows\system32\ddcCRIaw.dll, but this time avenger could not find it.


HijackThis log looks innocuous. Pasted below


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 2:28:57 AM, on 4/15/2008


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\spoolsv.exe


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\system32\igfxtray.exe


C:\WINDOWS\system32\hkcmd.exe


C:\WINDOWS\system32\igfxpers.exe


C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe


C:\Program Files\SiteAdvisor\6253\SiteAdv.exe


C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe


C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


C:\Program Files\QuickTime\qttask.exe


C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


C:\WINDOWS\system32\ctfmon.exe


C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe


C:\Program Files\Windows Desktop Search\WindowsSearch.exe


C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe


C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe


C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\STOPzilla!\STOPzilla.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe


C:\Program Files\SiteAdvisor\6253\SAService.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\VMware\VMware Workstation\vmware-authd.exe


C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe


C:\WINDOWS\system32\vmnat.exe


C:\WINDOWS\system32\SearchIndexer.exe


C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe


C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe


C:\WINDOWS\system32\vmnetdhcp.exe


C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe


C:\Program Files\Mozilla Firefox\firefox.exe


C:\Program Files\BitDefender\BitDefender 2008\seccenter.exe


C:\WINDOWS\system32\DllHost.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =


O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll


O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll


O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll


O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll


O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe


O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe


O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe


O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe


O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"


O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe


O4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler


O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe


O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe


O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe


O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe


O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000


O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll


O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll


O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/...ash/swflash.cab


O17 - HKLM\System\CCS\Services\Tcpip\..\{FD2B6A70-867E-462F-94D4-9C4B6FCAF5C3}: NameServer = 202.56.215.6,202.56.214.54


O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe


O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe


O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe


O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe


O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe


O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe


O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe


O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe


O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe


O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe


O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe


O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe


O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe


O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe


--


End of file - 8188 bytes


Please dont tell me to do anything in safe mode. I cannot login in safe mode. My keyboard is a wireless Logitech keyboard. It does detect the "F8" sometimes but still does not detect up arrow/down arrow movements. Tried botting through the numerous barebones boot cd (MSDOS6.22, UBCD etc) I have but keyboard just wont work!!


I have seen Bit Defender forums and other forums as well. Plz help.


ThePacifist

Comments

  • ThePacifist
    ThePacifist
    Options

    Oh...


    and also tried downloading ComboFix. Curiously, the moment the download completed, it came up with error that it cant copy since either the file is write protected or the disk is full. I can guarantee that the disk is not full. I also tried different sources but to no avail.

  • Unknown
    Unknown
    Options

    I cannot find any clearly infected processes,but dllhost looks very suspicious.


    Plase send a autoruns log,because it has more details than hijackthis.


    Also if you could tell me what file does bitdefender find as infected.


    And also if you have windows with the latest updates.

  • ThePacifist
    ThePacifist
    Options
    I cannot find any clearly infected processes,but dllhost looks very suspicious.


    Plase send a autoruns log,because it has more details than hijackthis.


    Also if you could tell me what file does bitdefender find as infected.


    And also if you have windows with the latest updates.


    I dont suspect dllhost because, and Im not an expert at this but, if you see hijackthis logs of other users, it seems the dll file created/infected does not have a standard name. I believe the code obfuscates the name by generating it randomly everytime. Probably this is one of the way it thinks would make it's detection difficult.


    The file that bitdefender found as infected was "C:\windows\system32\hkQq####.ini" and "C:\windows\system32\hkQq####.ini2" (I cannot remmeber the #### part. let me know if its important and I'll tell you).


    I have windows update service enabled on my machine, so Im guessing the latest patches are in there.


    Could you let me know where I can get a clean copy of autoruns.

  • ThePacifist
    ThePacifist
    Options

    http://www.neuber.com/taskmanager/process/dllhost.exe.html


    Going through the link above, can we be reasonably sure that dllhost is indeed a valid process. Looks valid because there is no "misspelling" in this (usually infected files just change/insert/delete one character from a valid filename so that it doesnt look obvious). , and also the path is c:\windows\system32\.

  • AndreiASM
    AndreiASM
    edited April 2008
    Options

    One way to get ride of the infected files is by following this advices. It`s a little bit difficult, but it`ll help you get ride of all the infected files.

  • TheNit
    TheNit
    Options

    I was infected with Vundo and it turned off AutoUpdate. Tried everything. Spybot found it and said that it had eliminated it. I was able to restart AutoUpdate but it came back. VUNDOFIX didn't work, didn't find anything. I managed to find a program from Malwarebytes' called Anti-Malware that solved the problem (so far). It's free (at least for trial basis) and unlike Spyware Doctor, will fix the problem without having to purchase the license. Do the "quick scan" initially (took about 15 minutes). What a relief!

  • rootkit
    rootkit ✭✭✭
    Options

    Malwarebytes' Anti-Malware does the job too ;)

All Time Leaders

Categories

Defenders of the month