Can't get rid of this Trojan, acts like a VX2

SheharyaarSaahil,

Yes, I have run the VX2 Add-on for Ad-Aware.  It finds nothing.
System Restore is Turned Off
Um, I don't think I have run all the tools in safe mode.
I have done the fixes many times, and I thought I had deleted those files but perhaps not.

What you are sayign is making sense to me, but I've missed this boat a lot of times.  Would you write this up as a procedure for me to follow?  Also, should I be deleting the 2 htm files ast well?

Hi JohnSH,
regarding to the very suggestions of shehar,
install Pest Patrol from:
http://www.pestpatrol.com/Products/PestPatrolHE/Single_User_Evaluation.asp
make this settings:
Pest patrol > options > Where to Search :
 check : all files ;
 check : scanning method : thorough ,
 check : scan shell tree options > show hidden and show files .
Pest patrol > options > What to search for - and then check all the items-all!
Pest patrol > options > What to exclude : wtere must be only the recycle folder and system volume information nothing mere!
Pest patrol > options > Automatic scans !!!
 check : scan on boot --> your boot partition
 check : PPMemCheck Memory Scan > Invoke on boot
 check : CookiePatrol > Invoke on boot
 check : PPcontrol > Invoke on boot
 check : KeyPatrol > Invoke on boot
you can check also the right click option for folders too...
check in the main menue to scan all hard drives .... update the pest patrol.
install winpatrtol from:
http://www.winpatrol.com/winpatrol.html

Have you done everything ,restart your PC as normal and delete everything that the two programs detect....
ONLY AS A SUGGESTION!!! :
I would recommend that you install also Antivir Personal edition as antiviral program with the following settings:
on both scanner and virus watcher:
at the search section/tab:
-for boot sectors :check the two options
-for the data search :check all files
-for priority check :high
at the search subtab - archves:select all archive types
at the repair section:
-check :delete with prompt
at the unwanted program tab:
-check all
at the heuristic tab:
-select:enable mcro virus heuristic
-select:win32 file heuristic enabled and then detction level high
at the drag&drop tab:
-select:scan subfolders
at the miscellaneous tab:
-select: interruption allowed
-check the option for load the guard at system start
-check the option lload the guard via the control program
-enable:check for old virus definition files(7 days)
go to options and make: save setting...
this settings you must make to the main program and the virus guard too,,,
to start the virus guard menue -double click on the Antivir icon in the system tray=>options=>configure,,,
but you must first disable your recent virus scanner to install the antivir personal if you wish-i am very happy with this program....
hope this additional info could help!
CHEERS

New Version for L2M is out and it is autoupdating to Msg126. If the user has "old L2M" VX2Finder will do the job, but it is better we run this tool first now, as because we know L2M autoupdates.

Zee

Interim update:....I followed SheharyaarSahill's protocol, it almost worked....but I can't get rid of this kaspar thingie.  I searched the internet for "kaspar"+"trojan" and a lot came up, but only in eastern european languages.  

Anyone ever seen this kaspar.exe?

why you cannot et rid of it, whne you try to delete it from safemode, what error do you get ??
or does it come back after deleting, if yes then did you remove its entries from regedit also ??

it hides in safemode.  i think it is changing filenames around.  I can always find either kaspar.exe or lgkvgt.exe or lsp.dll, but never all 3.  I've even tried it in safemode with command line so the explorer shell doesn't get loaded (I think).

This variant is very very tricky, the only VX2 that ever sees it is ad-aware.  The only good thing about this so far is that I'm pulling my hair out which is getting rid of my bald spot......

oh, yeah, I've removed the entries from regedit, and from hijackthis, and from msconfig........arrrgh!  many times now....

Jon can you see any "ShopatHomeSelect Agent" in your Add Remove Programs....... or any other suspisious software ??

Yes, and I got rid of those a while back.  But I just saw something interesting.  I got the machine to a point that tested on hijack as a "clean" machine.  Then, I plugged the LAN cable back in and all of a sudden I get this popup from RUNDLL as follows:

An exception occurred while trying to run ""C:\WINDOWS\system32\rzgsvc.dll",UMonitor"

now I get this when I run Hijackthis:

http://www.hijackthis.de/logfiles/ea32713abf6d41f499e80b3591472168.html

so whatever this thing is, it is network aware......

the dll name appears to be random, changes after every boot....I let it sit connected to the internet for 90 minutes, undisturbed, the damm thing filled up the computer with another 15-20 pieces of ad-ware...Elite Toolbar, VBouncer, etceteras...this is some serious sh*t happening to this machine.....

....I'm this close to formatting the drive and starting clean.......

....Going to try Pest Patrol next, I guess,  in maximum modes.......

Okay, I'm currently Pest and Win patrolling, let's see if this stuff can get everything at once :)...once I've done a full sweep, I'm going to reboot and see what it finds on boot-up....

As posted above:

http://downloads.subratam.org/VX2Finder(126).exe

Don't click the link because the (...) break it.

Copy it and paste to your browser address bar.

Zee

Thankx blue_zee....I've been using it since the beginning of this issue, it finds no files.  Sorry I didn't mention that earlier.

Update:  Using Pest Patrol and Winpatrol, still not much help.  This Trojan is a bad-a$$; it is even blocking startup scans.  I've got a massively multiadware headache at thispoint.....

Have a go with the PeperFix:

http://downloads.subratam.org/PeperFix.exe

the log doesn't show a peper trojan infection,,, it clearly shows a Vx2 infection..... and its a new variant that is spreading :-\

The link to the log shows an empty page...

And throw it all available tools just to see if any work (even a little).

Zee

yeah its now a blank page..... i looked at it many times before...... there was not a single sign of peper trojan :)

Sheharyaar, yeah, they run in safe-mode too.  Whoever crafted this crafted a beauty.  Blue_zee, I'm on the way to formatting the box, we just took a software inventory......sigh :)

hmmm can i ask a last question if you dont mind =\
when you goto Start>Run>regedit and navigate to the following key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows

in the right pane you will find an AppInit_DLLs entry, when you right click it and click Modify, what is the value data written here ??

Okay, the damm adware wins.  I just formatted the drive and am now building a better mousetrap.  Any suggestions as to how I might divide up the points?

No problems here if you want to ask for a refund at Community Support:

http://www.experts-exchange.com/Community_Support/

I honestly don't believe that suggesting a format and reinstall could be an accepted answer to this question.

Cheers and good luck!

Zee

Well, I give us all a "C", including myself....we failed, and the patient died :)  So, I split it up among answers that streched my mind technically, showed me something I hadn't considered,  or answers that made me a little better about failing :)

Much thanx, folks!  Jon

hmmmmm new infections disappoint us like this... but ONLY when they are new.... im sure that this variant also gonna have some removal tool out there..... just give it some days.... :)

JonSh,

I feel your pain, I am still dealing with same thing. Its a nasty one to say the least, and to address blue_zee yes format c: sometimes just provides a sense of relief. I have spent since Thanksgiving trying to resolve from what it seems the same issues. I have stayed with it because it entered thru a door (port 135) that was opened by one of my vendors applications. Needless to say the potential for my clients to get this is very high. So I figured going thru the pain today will pay off when my clients get this.

Just  few things that happened to me when I was hit:

Google toolbar and popup blocker disabled
Reycycle bin icon always showed full, oped folder nothing, right click asked to delete 9 files?
Certian keys on keyboard were remapped
Host file, unlocked
NAV disabled
Spybot disabled certian things, but not completely, enough not to casue attention
Right click possible culprit, it would disappear
Process running in safe mode
Randomly create a dll upon winlogin and logout, also dll name is random containing numbers a letters
provide new key in Notify of Winlogin which appeared to look like a normal name such as Restart, Startup, Stillimage with newly created dll registered already
host of pop-ups even with opera and firefox using their stuff
cpu cycles just kill system after a while
turned restore feature backon disks
populate temp directories with links
turned feature on folders to hide hidden files

From what I can tell is that two files seem to be at the root at least for me, pkpbpp.exe and klkikk.exe

My next step is to use a linux LiveCD distro to boot up in RAM and delete all files on HD past a certian date.

Ouch!!

Thing that actually scares me is that what is next? A friend and I have talked about the entire collapse of the Internet infrastructure in the next 3 years (running bet we started 5 years ago). This was based more upon the downsizing and outsourcing of IT, aslo companies stretching systems original intent well beyond its means. I am starting to rethink that "what is next" a little ole piece of software written in C+ will bring the Internet down even sooner.


 

Hi!

This Vx2 variant is being worked on - mixed success.
2 or more randomly named dll's - that change on reboot.
A hidden file in system32 named guard.tmp
Causes things deleted to be immediately deleted and not sent
to the recycle bin.
Messes with a user's ability to print anything.
Some success using DLLCompare and PocketKillbox to find all the dll's
Trys to connect to {www.a-d-w-a-r-e.com} or something simliar
One user had success dealing with it using Recovery Console - link here:
{http://computercops.biz/postp381429.html#381429}
Don't know yet if this fix works all the time, though.
{Zupe} over at SWI has written a batch file to try to help find the bad dll's -
http://www.dslreports.com/r0/download/725998~d44d0289add36c04c2a05ef54e5a84f2/FindIt.zip
Check the warning about it also showing valid files!!
Here's a link to a post where he's using it -
http://www.dslreports.com/forum/remark,12023321~mode=flat
Sheeesh!!! - what will they come up with next!?!

Regards

RF

Looks like what I have, here is the link to my ongoing post here at EE:

http://www.experts-exchange.com/Applications/Viruses/Q_21226919.html

I believe that the dll's are created at each login and logout and shutdown, this is how it even happens during safe mode since I have been logging in. This is supported by the fact I have two new dlls each day at least on system. The key under HKLM\Software\Microsoft\WINNT\Currentversion\Winlogin\notify shows values for WinLogin, WinLogout, Shutdown.

Also I just noticed that all the other keys that are normally in the Notify have neen delted (not by me) so this Vx2 variant is self mutating and smart enough to delte keys over time. Aslo there are several more new .exe running I have not seen before in the process list.

Today when I booted my software from various companies were no longer registered including Spysubtract, TrendMicro and XP Pro!!!!!

I have a copy of Knoppix, which I have been informed can write and read to NTFS without a hitch. My plan later is to boot Knoppix off CD and have a good old time delting.

The main key with this variant is to get as quick as possible, rebooting and log on/off the sytem the least amount of times possible. The best would be a bootable floppy/CD with a batch program to delete suspect files based on time, size and naming convention.


I hope this provides some insight to anyone who may have this on their system. I will report back if using Knoppix approach works or does not.

Joel_Sisko

Hi JonSh,thanks for the given points and damn sorry that we couldn't solve the problem...
Good luck with the new system,,,a good firewall and antiviral system will prevent you from having theese troubles again,so if you wish keep on patrolling :) with the right settings on each program!
All the best!

Joel_Sisko,

it's true that knoppix has the experimental captive system:
http://www.jankratochvil.net/project/captive/ , which gives the chance to be written on NTFS5 system,the win Pro partitions,but it's still experimental, so pay attention!
I can give you a suggestion ,that you use the ERD Commander,it's very expensive ,but does a good work -in case of overwriting or deleting files from all kind of ntfs-partitions...
CHEERS