ebubaraxonug.dll

Printable View

26.07.2010, 02:48
anneR

ebubaraxonug.dll

hi there

my kasparsky internet security 2010 has now a number of critical high risk files in quarantaine
system (windows 7) seems now compromised
and, since 24/7 every time at start up this appears:

bubaraxonug.dll - HEUR: trojan.win.32.generic
[INDENT]RunDll redcirclewhitecross wee window:
"There was a problem starting
C:\Users\Anneruth\AppData\Local\ebubaraxonug.dll
The specific module could not be found[/INDENT]attached one file I managed to create via kasparsky virus removal tool

tried running tool in normal mode
does not finish, even after 6 hours running

don't know how to start laptop here in safe mode
have downloaded the other tools
but am not sure now whether there is any point in me running them
as I feel totally intimidate by your 'before you post' guidelines

have already spent 12 hours trying to do the above

apart from feeliing overwhelmed with the many tools you ask me to run, I don't know what you mean with unload antivirus (uninstall? >:() and then my Internet explorer is not working anyway, and firefox is compromised ( links in google search do not work) and evrything is endlessly slow loading, specially i n startup, with system running mysteriously at 100% CPU

with my former anti virus software on another PC when I had a problem all I needed to do was go into chat and a technician cleared my PC via remote control

to do these processes is beyond me and the little time and little skill I have;

however, my work right now is dependent on this laptop, so, please help me...

anneR

ps:tried to post, some russian message coming up
what's the point of this for me :(

[size="1"][color="#666686"][B][I]Добавлено через 18 минут[/I][/B][/color][/size]

can also not find where to find the quarantined files to send you

nor how to convert the text logs from quarantine into zip files for yu to accept them

pps:
found a way to convert long log txt to doc to zip!
hope ths helps
still don't know where to locate quarantined files
26.07.2010, 06:12
olejah

[QUOTE='anneR;676419']tried running tool in normal mode
does not finish, even after 6 hours running[/QUOTE] What tool have you used? Neither [URL="http://devbuilds.kaspersky-labs.com/devbuilds/AVZ/avz4.zip"]AVZ[/URL] nor [URL="http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/setup_9.0.0.722_26.07.2010_03-31.exe"]Kaspersky Virus Removal Tool[/URL] can finish running in normal mode, right? Or you tried only one of those two?
26.07.2010, 14:08
anneR

So far tried only Kasparsky anti virus tool.

AVZ still unzipping - takes ages..
need to work here and all is held up!

would like to know whether to close the little window

[QUOTE]RunDll redcirclewhitecross window:
"There was a problem starting
C:\Users\Anneruth\AppData\Local\ebubaraxonug.dll
The specific module could not be found[/QUOTE]

[COLOR="Red"][B]please advise[/B][/COLOR]

causes something of the trojan/worm to get executed?= Should I close it or leave it open?
a ebubaraxonug file is in Kasparsky's quarantaine, along with numerous others..

5 minutes later:
AVZ is scanning now in normal mode; auto removal mode is selected;
lots of red scripts coming up in log file window...

Just see that it tells me to update data base
[B][COLOR="Red"]I have no idea how to do this :-(
please instruct[/COLOR][/B]
26.07.2010, 14:33
olejah

C:\Users\Anneruth\AppData\Local\ebubaraxonug.dll - I guess it is part of some malware. So, let's make it clear, is there any way to make at least one log or maybe scan your PC by any of the instruments described [URL="http://virusinfo.info/showthread.php?t=9184"]here?[/URL]

[size="1"][color="#666686"][B][I]Добавлено через 14 минут[/I][/B][/color][/size]

[QUOTE='anneR;676614']I have no idea how to do this :-(
please instruct[/QUOTE] - AVZ - Файл => Обновление баз => Пуск.
26.07.2010, 15:46
anneR

files /logs

I had attached my kasparsky main log (from my K. Internet Security) already with my first post after I managed to get it into zip via coonvert to doc - can you not see it?
please - why are your last line instructions in russian? No good for me as you know :-(

had also attached the report the extra Kasparsky virus removal tool did, but I can't see it anymore here - what happened? It still shows on my uploaded file window?

I am just trying it again to upload it again
26.07.2010, 16:06
anneR

AVZ log partly

just tried to make a zip file out of the start of the AVZ scan (running right now still), ut God knows why I can findout again how to make it into ziip file!

here a few entries from beginning and middle

do they help?

colour seems to have been lost (some came in red for the hijackfiles) and symbols gone into smileys!

I am having leave with the laptop into town, so I might have to pause scan. Hope I can pause and don't have start again when I get back!

[QUOTE]
 Attention !!! Database was last updated 08/07/2010 it is necessary to update the database (via File - Database update)
AVZ Antiviral Toolkit log; AVZ version is 4.34
Scanning started at 26/07/2010 11:11:31
Database loaded: signatures - 275419, NN profile(s) - 2, malware removal microprograms - 56, signature database released 08.07.2010 09:40
Heuristic microprograms loaded: 383
PVS microprograms loaded: 9
Digital signatures of system files loaded: 213048
Heuristic analyzer mode: Medium heuristics mode
Malware removal mode: enabled
Windows version is: 6.1.7600, ; AVZ is run with administrator rights
System Restore: enabled
1. Searching for Rootkits and other software intercepting API functions
1.1 Searching for user-mode API hooks
Analysis: kernel32.dll, export table found in section .text
Analysis: ntdll.dll, export table found in section .text
Analysis: user32.dll, export table found in section .text
Function user32.dll:DefDlgProcA (1657) intercepted, method - ProcAddressHijack.GetProcAddress ->76C65F5A->776B8944
Function user32.dll:DefDlgProcW (1658) intercepted, method - ProcAddressHijack.GetProcAddress ->76C65F75->776A3F54
Function user32.dll:DefWindowProcA (1664) intercepted, method - ProcAddressHijack.GetProcAddress ->76C65F90->77682893
Function user32.dll:DefWindowProcW (1665) intercepted, method - ProcAddressHijack.GetProcAddress ->76C65FAB->7767247D
Analysis: advapi32.dll, export table found in section .text
Function advapi32.dll:AddMandatoryAce (1029) intercepted, method - ProcAddressHijack.GetProcAddress ->769C24B5->752BC334
Function advapi32.dll:I_QueryTagInformation (1361) intercepted, method - ProcAddressHijack.GetProcAddress ->769C2655->765B72D8
[/QUOTE]

and then it goes for pages lke this (my guess - it hit the 'highjackthis' file I downloaded on my poor attempts here following your sophisticated iinstruction...

[QUOTE]

 ProcAddressHijack.GetProcAddress ->7370551B->74A35D67
Function netapi32.dll:NlBindingSetAuthInfo (304) intercepted, method - ProcAddressHijack.GetProcAddress ->73705543->74A36198
1.2 Searching for kernel-mode API hooks
Error loading driver - operation interrupted [C000036B]
1.4 Searching for masking processes and drivers
Checking not performed: extended monitoring driver (AVZPM) is not installed
1.5 Checking IRP handlers
Error loading driver - operation interrupted [C000036B]
2. Scanning RAM
Number of processes found: 37
[/QUOTE]
26.07.2010, 20:07
olejah

[QUOTE='anneR;676664']please - why are your last line instructions in russian? No good for me as you know :-([/QUOTE] Sorry, you asked me how to update data base and I thought your AVZ version is Russian.

Ok, now we're gonna check some files -

Close/unload all the programs

Switch off:
- Antivirus and, if you have - Firewall.

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing

[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(true);
QuarantineFile('C:\Windows\system32\msdtckrm.dll','');
QuarantineFile('C:\Windows\system32\lsm.exe','');
QuarantineFile('C:\Windows\system32\dwm.exe','');
QuarantineFile('C:\Windows\system32\drivers\fvevol.sys','');
QuarantineFile('C:\Windows\system32\drivers\fltmgr.sys','');
QuarantineFile('C:\Windows\system32\dfdts.dll','');
QuarantineFile('C:\Windows\System32\win32k.sys','');
QuarantineFile('C:\Windows\System32\snmptrap.exe','');
QuarantineFile('C:\Windows\System32\mdsched.exe','');
QuarantineFile('C:\Windows\System32\mctadmin.exe','');
QuarantineFile('C:\Users\Anneruth\AppData\Local\ebubaraxonug.dll','');
BC_ImportAll;
BC_Activate;
RebootWindows(true);
end.[/CODE]

After reboot:
- Execute following script in Manual Healing

[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.[/CODE]

- Upload the C:\quarantine.zip here: [URL="http://virusinfo.info/upload_virus_eng.php?tid=83713"]upload_virus_eng.[/URL]
27.07.2010, 16:14
anneR

clearing viruses in manual healing

hi Olejah

thank you for reply, and instructions...

Went to a friend yesterday afternoon as her husband offered to have a look at this infected laptop for me. He spent 4 - 5 hours on it and now at least the ebubaraxonug.dll beastie seems gone. There are still some problems - all browsers very slow in start up, firefox redirecting to a [I][U][B]nclk.[/B]gif image 1x1 with blank page[/U] in google searches >:([/I], are the worst. He recommended that I uninstall and rei-install firefox which I will do today.

the whole shebang here has thrown my workschedule - which is making a blog and online photo albums and videos for a craft project - totally off kilter. I must focus on this right now to fulfill my commitment to the project and its people, and hope that what my friend's husband did here will enable me for now to keep my head cool and my laptop free when busy. :)

I will get back here as soon as possible to do what you asked me here.

When you say "manual healing" - are you refering to the second tab in the Kasparsky virus removal tool programme I had downloaded?

kind regards
anneR
27.07.2010, 16:48
olejah

Exactly, I think [URL="http://www.avptool.ru/en/AVPTool_helpdesk_curescript.htm"]this instruction[/URL] could help.
27.07.2010, 17:44
anneR

nclk + Kasparsky anti banner

thanks again

some news here re nclk redirect in firefox:
when preparing to uninstall me firefox I realisd that not only would I need to safe ny bok marks, I also would hav to reset numerous pass words the browser remembers for me :O !
So I did another search on the nclk problem and found on
[URL]h**p://support.mozilla.com/tiki-view_forum_thread.php?locale=te&comments_parentId=182993&forumId=1[/URL]
that disabling Kasparski's antibanner was doing the trick. Tried it out just now, and right enough - no more blank nclk windows in my firefox when doing google searches!

What do you think about the anti-banner function of Kasparsky?
How needed is it?

on [URL]h**p://74.125.127.189/support/forum/p/Web+Search/thread?tid=51fd030d0949a690&hl=en[/URL]
someone who had tried lots of ways to find and delete malware found in the end that the ordinary Kasparsky virus scan found and cleared those two for him
[QUOTE]1. trojan-downloader.Win32 Mufanom.hpx

2. trojan.JS.Gord.a[/QUOTE]So, is nclk now a problem with a trojan or is it a conflict in antibanner?

since I had anti banner on all the time, and had no probs with any nclk redirect, I am puzzled doubly..

if you advise me with a good reason to activate Kasparsky anti banner again, I will do so and do my google searches with google chrome browser, which is fine just now (= doing the right redirects)
27.07.2010, 20:40
Rene-gad

[QUOTE=anneR;677323].............[/QUOTE]
Such questions you might discuss in any other forum, e.g. [url]http://forum.kaspersky.com/[/url]
Pls. let you read the manual for your antivirus :)
This topic is closed :)
28.07.2010, 20:40
CyberHelper

Итог лечения

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]1[/B][*]Обработано файлов: [B]2[/B][*]В ходе лечения вредоносные программы в карантинах не обнаружены[/LIST]