Not cleanning infection Podnuha TDSS BHO Clicker

Printable View

20.04.2010, 18:52
andrefaro

Not cleanning infection Podnuha TDSS BHO Clicker

My pc got 3 infections (Rootkit.win32.Podnuha.a, Rootkit.win32.TDSS.d, Trojan.win32.BHO.ext, and Clicker.ARB). In fact, the antivirus removed part of them, but it seems something is on unknown files and memory files.
May you help me with that? The problem that is being caused all the time is generic service host for win32 crashes, and when i shutdown pc, explorer.exe do not close or crash during pc usage.

Thank you for now

Andre
21.04.2010, 22:05
Rene-gad

Download and run this tool: [url]http://support.kaspersky.com/faq/?qid=208280684[/url]

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual disinfection
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
StopService('vjosyi');
StopService('spfis');
StopService('rlqcx');
StopService('rbmt');
StopService('qxfvka');
StopService('qilgh');
StopService('lxglx');
StopService('ieflqui');
StopService('drza');
StopService('cxevuy');
StopService('auewjq');
QuarantineFile('C:\WINDOWS\system32\wnbscxyx.dll','');
QuarantineFile('C:\WINDOWS\system32\mnmsrvc.exe','');
QuarantineFile('C:\WINDOWS\system32\drivers\ywjx.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\yldmljnc.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\uuqa.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\rontp.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\qopqa.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\npmiay.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\mvsiu.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\lcyn.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\kyqi.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\ihmhc.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\efpyt.sys','');
QuarantineFile('C:\WINDOWS\system32\drivers\cbkcai.sys','');
QuarantineFile('C:\WINDOWS\system32\Drivers\bcrsvdmi.sys','');
QuarantineFile('C:\DOCUME~1\ANDRFA~1\CONFIG~1\Temp\AMDPCI.sys','');
QuarantineFile('C:\Arquivos de programas\SGPSA\SearchAssistant.dll','');
DeleteService('vjosyi');
DeleteService('spfis');
DeleteService('rlqcx');
DeleteService('rbmt');
DeleteService('qxfvka');
DeleteService('qilgh');
DeleteService('lxglx');
DeleteService('ieflqui');
DeleteService('drza');
DeleteService('cxevuy');
DeleteService('auewjq');
DeleteFile('C:\WINDOWS\system32\drivers\ywjx.sys');
DeleteFile('C:\WINDOWS\system32\drivers\yldmljnc.sys');
DeleteFile('C:\WINDOWS\system32\drivers\uuqa.sys');
DeleteFile('C:\WINDOWS\system32\drivers\rontp.sys');
DeleteFile('C:\WINDOWS\system32\drivers\qopqa.sys');
DeleteFile('C:\WINDOWS\system32\drivers\npmiay.sys');
DeleteFile('C:\WINDOWS\system32\drivers\mvsiu.sys');
DeleteFile('C:\WINDOWS\system32\drivers\lcyn.sys');
DeleteFile('C:\WINDOWS\system32\drivers\kyqi.sys');
DeleteFile('C:\WINDOWS\system32\drivers\ihmhc.sys');
DeleteFile('C:\WINDOWS\system32\drivers\efpyt.sys');
DeleteFile('C:\WINDOWS\system32\drivers\cbkcai.sys');
BC_DeleteSvc('vjosyi');
BC_DeleteSvc('spfis');
BC_DeleteSvc('rlqcx');
BC_DeleteSvc('rbmt');
BC_DeleteSvc('qxfvka');
BC_DeleteSvc('qilgh');
BC_DeleteSvc('lxglx');
BC_DeleteSvc('ieflqui');
BC_DeleteSvc('drza');
BC_DeleteSvc('cxevuy');
BC_DeleteSvc('auewjq');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.[/CODE]

After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual disinfection
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]and upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.

- Repeat a log file of AVPTool.
- Attach a log to your new post..
22.04.2010, 01:48
andrefaro

I have tried several times

I have tried to follow these steps, but It seems the removal tool crashes before the restart.
I am sending you the quarentine file and the system check again.

Thank you very much

Andre
22.04.2010, 10:30
Rene-gad

[COLOR="Red"][B]Disable System Restore[/B][/COLOR]. Why you did not do this???

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual disinfection
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
DelBHO('{050D57B5-E9AD-426D-88A7-0136A62192Ff}');
QuarantineFile('tsk2.tmp','');
DeleteFile('tsk2.tmp');
DeleteFile('C:\WINDOWS\system32\wnbscxyx.dll');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.[/CODE]

After reboot [URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL] in Manual disinfection
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]and upload the C:\quarantine.zip over the link [COLOR="Red"][B]Upload quarantined files[/B][/COLOR] on the top of this page.
- Clean Temp-Maps, Cache of Browsers, Recycler. Use Windows service tool [URL="http://support.microsoft.com/?scid=kb%3Ben-us%3B315246&x=17&y=6"]cleanmgr[/URL] or [URL="http://www.ccleaner.com/"]CCleaner[/URL] or [URL="http://www.clearprog.de/"]ClearProg[/URL]
- Repeat a log file of AVPTool.
- Attach a log to your new post..
22.04.2010, 19:43
andrefaro

New log

I disabled because you asked me to do this! lol

Rene-gad said:

Switch off/Disable:
- Antivirus and and, if you have - Firewall.
- System Restore

No problem about It...

Thank you

Andre
22.04.2010, 21:27
Rene-gad

[QUOTE=andrefaro;626342]I disabled because you asked me to do this![/QUOTE]Guess, where I know, that you didn't, from?
[QUOTE]System Restore: enabled[/QUOTE]it's a quote from your log file.

Make a log of Malwarebytes Antimalware.
22.04.2010, 22:25
andrefaro

Ohhh... I am so sorry.
I did not see that It reactivated.

The problems I am encountering here is that explorer.exe and svchost.exe are crashing. When I try to restart pc, explorer.exe crashes.

If pc is turned on for a long time, both of them find any problem and ask to be closed.

Maybe you can help with this issue.

Thank you again,

Andre
27.04.2010, 23:24
andrefaro

Problem solved

Dear friend,

Thank you very much for you help.

I solved the problem fixing it using combofix, from Find3m.

After this, a scanned all pc and nothing was found on system and files.

Thank you very much again.

Andre
28.04.2010, 23:24
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]3[/B][*]Обработано файлов: [B]75[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\windows\system32\drivers\bcrsvdmi.sys - [B]Trojan.Win32.BHO.ext[/B] ( DrWEB: Trojan.NtRootKit.1652, BitDefender: Rootkit.17589, NOD32: Win32/BHO.EXT trojan, AVAST4: Win32:Agent-PSI [Rtk] )[*] c:\windows\system32\wnbscxyx.dll - [B]Trojan-Downloader.Win32.Agent.dfhk[/B] ( DrWEB: Trojan.Searcher.102, BitDefender: Trojan.Spy.Agent.OEP, AVAST4: Win32:Malware-gen )[/LIST][/LIST]