fighting msvmiode.exe and cfdrive32.exe on XP

Hi all,

I have dificulty fighting msvmiode.exe and cfdrive32.exe on XP. Tried various methods to kill them but they still apears again. I would need help finding a root who creates them. As an effect antivirus sites are blocked, some net trafic is generated, plus in the usb flash drive as soon as they are connected new hiden aurotun.inf and randoim folder + exe is created.
The latest MS malicious removal tool finds Conficker.C or .B, and Pushbot, telling it is removed, but after reboot they are here again.

Any ideas what can be done?

Hello
- Disconnect your PC from network (internet/intranet)
- Disable antivirus, firewall and other memory resident security tools
- Disable System Restore


- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
TerminateProcessByName('c:\windows\system32\msvmiode.exe');
TerminateProcessByName('c:\windows\cfdrive32.exe');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Wireless Zero ConfigurationWZCSvc (XP)');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Windows Logon Application');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','TCP/IP NetBIOS Helper');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Spooler SubSystem App');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Plug and Play');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','NTLM Security Support Provider');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Local Security Authority Service');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Background Intelligent Transfer Service');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Application Layer Gateway service');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Print Spooler');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','MSRPC');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\vjuipt');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\lctlvvrss');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\golkolmzc');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\fopkx');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\fnjibzm');
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\fdfrhob');
RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows NT\CurrentVersion\Winlogon','Taskman');
QuarantineFileF('%appdata%', 'exe.*', false, '', 0, 0);
QuarantineFile('c:\windows\system32\msvmiode.exe','');
QuarantineFile('c:\windows\system32\11.exe','');
QuarantineFile('c:\windows\cfdrive32.exe','');
QuarantineFile('C:\autorun.inf','');
DeleteFileMask('%appdata%','*.exe', false);
DeleteFile('C:\WINDOWS\system32\msvmiode.exe');
DeleteFile('C:\WINDOWS\system32\11.exe');
DeleteFile('C:\WINDOWS\cfdrive32.exe');
DeleteFile('C:\autorun.inf');
DeleteService('vjuipt');
DeleteService('lctlvvrss');
DeleteService('golkolmzc');
DeleteService('fopkx');
DeleteService('fnjibzm');
DeleteService('fdfrhob');
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 2, 2, true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.[/CODE]

[COLOR="Red"]If the system after reboot would try to install any unknown hardware, abort the installtion and remove unknown hardware over hardware manager[/COLOR]

After reboot:

[URL="http://virusinfo.info/showthread.php?t=9207"]execute following script[/URL]
[code]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/code]
- Upload C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=85585[/url]
- Make new logs and attach them to the new posting.

PS:
[QUOTE]Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)[/QUOTE]
You system is a great catastrophe - no SP3, no patches, no IE8. Be ready to update your system asap.

Yes, systems will undergo updates as soon as problems resolved.

Scrip did a job. At the begining all looked ok, just AVZ find one suspicious file wit "x" name in system foder. I uploaded 2 separate quarantine archives. First one just aftre executing your script, second after new check where "x" file was found (name "quarantine-X.zip").

However aftre some 30mins, (and may be one more reboot) all antivirus sites (including this) blocked again, and on the lan connection I see that some havy traffic going out to the internet.

One note that at the end of execution of script system tried to rebood - bacame empty screen in color of desktop and just alive mouse pointer. It stayed long time like this (~5min). Then I hit Ctrl+Atl+Del and right after this it showed Windows LogOff notification and finished reboot.





Here

[QUOTE=marco;689572]
However aftre some 30mins, (and may be one more reboot) all antivirus sites (including this) blocked again, and on the lan connection I see that some havy traffic going out to the internet. [/QUOTE]You system is very vulnerable, that is why you had received your problem back: install SP3 + all updates + IE 8, than repeat all the logs + log of Malwarebytes antimalware [url]www.malwarebytes.org[/url]

Upgraded as suggested. However situation is same. Tried to clean with script (adding new file names as from scan) severeal times. Few mins system looks ok, but then starts generating outgoing traffic and blocks virus sites. Looked hosts file - it is ok, so sites blocked elsewhere.
Some notes:

Just after reboot pops up "found new hardware" which is not true, so I cancel it.

Sometimes after reboot systems report svchost service crash. Then lan look like connected, but browser says no connection.

Also file ..\Application Data\ltzqai.exe is never killed. After script clean up and reboot it is here again while others are still not present and system works ok for few mins.

I tried to boot from external disk and delete it, or overwirite content with FF's in hex editor, but later it comes again corrected.

so it looks like msvmiode.exe cfdrive32.exe is already consequence and ltzqai.exe is the cause, while sombody else takes care about ltzqai.exe.
Also I have feeling that something wrong near network intrface drive(s).

Any ideas?

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore
-[URL="http://virusinfo.info/showthread.php?t=9206"]Fix[/URL] with Hijackthis
[CODE]O4 - HKLM\..\Run: [MSODESNV7] C:\WINDOWS\system32\msvmiode.exe
O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINDOWS\cfdrive32.exe
O4 - HKCU\..\Run: [Background Intelligent Transfer Service] C:\Documents and Settings\RTHD\Application Data\bits.exe
O4 - HKLM\..\Policies\Explorer\Run: [Microsoft Driver Setup] C:\WINDOWS\cfdrive32.exe[/CODE]

- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL]
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
TerminateProcessByName('c:\windows\system32\msvmiode.exe');
TerminateProcessByName('c:\windows\cfdrive32.exe');
DeleteFile('c:\windows\cfdrive32.exe');
DeleteFile('c:\windows\system32\msvmiode.exe');
DeleteFile('C:\Documents and Settings\RTHD\Application Data\ltzqai.exe');
DeleteFile('C:\Documents and Settings\RTHD\Application Data\bits.exe');
DeleteFile('C:\Documents and Settings\RTHD\Application Data\WLANSvc.exe');
RegKeyParamDel('HKEY_USERS','.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run','Wireless Zero ConfigurationWZCSvc (XP)');
RegKeyParamDel('HKEY_USERS','S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run','Wireless Zero ConfigurationWZCSvc (XP)');
RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Background Intelligent Transfer Service');
DeleteFile('C:\RECYCLER\S-1-5-21-2810265621-3299971027-892322188-2326\syscr.exe,explorer.exe,C:\Documents and Settings\RTHD\Application Data\ltzqai.exe,Explorer.exe');
DeleteFile('C:\RECYCLER\S-1-5-21-2810265621-3299971027-892322188-2326\syscr.exe');
DeleteFile('C:\Documents and Settings\RTHD\Application Data\ltzqai.exe');
DeleteFile('C:\WINDOWS\cfdrive32.exe');
DeleteFile('C:\WINDOWS\system32\26.exe');
DeleteFile('C:\WINDOWS\system32\msvmiode.exe');
DeleteFile('C:\Documents and Settings\RTHD\Local Settings\Temp\105.exe');
DeleteFileMask('%appdata%','*.exe', false);
ExecuteWizard('TSW', 2, 2, true);
ExecuteWizard('SCU', 3, 3, true);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- Make new logs
- Make a log file of Malwarebytes Antimalware: [url]http://www.malwarebytes.org/mbam.php[/url]

C:\RECYCLER\...\syscr.exe and Application Data\ltzqai.exe is persistantly not deletes or rewrites. Tried 2 times. MBAM seems to give some more hints. Any clues?

The files are not visible in AVZ-logs, ergo they are not active anymore.
Pls. remove all founds with MBAM. Repeat the MBAM-Log.

Done. System is clean and works fine all day. ltzqai.exe is not created any more. MBAM log now is totally empty and I'm not attaching it (let me know if it still has to be posted).

Now I will go cleaning some other similar PC's using that techniques, and in case of troubles will post new thread.

So the job is done. Thank you very much for great help!

Статистика проведенного лечения:
[LIST][*]Получено карантинов: [B]6[/B][*]Обработано файлов: [B]41[/B][*]В ходе лечения обнаружены вредоносные программы:
[LIST=1][*] c:\\windows\\cfdrive32.exe - [B]Net-Worm.Win32.Kolab.kis[/B] ( DrWEB: BackDoor.IRC.Bot.166, BitDefender: Trojan.Dropper.TOW, NOD32: IRC/SdBot trojan, AVAST4: Win32:Flot-Q [Wrm] )[*] c:\\windows\\cfdrive32.exe - [B]Trojan.Win32.Jorik.SdBot.cf[/B] ( DrWEB: Trojan.AVKill.2, BitDefender: Trojan.Generic.4847085, NOD32: IRC/SdBot trojan, AVAST4: Win32:Inject-AII [Trj] )[*] c:\\windows\\cfdrive32.exe - [B]Net-Worm.Win32.Kolab.maa[/B] ( DrWEB: Trojan.AVKill.2800, BitDefender: Trojan.Generic.5032117, AVAST4: Win32:Malware-gen )[*] c:\\windows\\system32\\msvmiode.exe - [B]Net-Worm.Win32.Kolab.kht[/B] ( DrWEB: Trojan.Spambot.9106, BitDefender: Worm.Generic.280610, NOD32: Win32/SpamTool.Tedroo.AN trojan, AVAST4: Win32:Flot-Q [Wrm] )[*] c:\\windows\\system32\\x - [B]Net-Worm.Win32.Kido.ih[/B] ( DrWEB: Win32.HLLW.Shadow.based, BitDefender: Win32.Worm.Downadup.Gen, AVAST4: Win32:Confi [Wrm] )[/LIST][/LIST]