Please help me with Trojan Horse IRC/Backdoor.Sdbot.MYX virus

BullGuard Antivirus Forum > Virus Removal > Removal Help > Please help me with Trojan Horse IRC/Backdoor.Sdbot.MYX virus

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Dave22
New Member

Date Joined Nov 2005
Total Posts : 5

Posted 11-11-2005 12:32 (GMT +2)

Ive got this virus :IRC/Backdoor.Sdbot.MYX virus and AVG FREE wont get rid of it, it keeps coming back, it has filled my hard drive so i have 0kb space left!!

I have tried the advice on previous threads but it wont let me run any online scans and when i try to install Hijack This, Ewido, Mwav and CCleaner it says they are not valid Win32 Applications!!

Please help me!!

*Cookie
Junior Member

Date Joined Oct 2005
Total Posts : 79

Posted 11-15-2005 1:43 (GMT +2)

Hi Dave 22,

The Win32 Applications problem might be due to one of the reasons mentioned here.

But let’s try to make room on your HDD first - enabling you to download and run the necessary programmes for the cleaning process. Follow this procedure.

Now, try to carry out these steps:

1. Download these programmes (i.e. in their own folders on your Desktop), but do not run them till I ask you to:

Ewido

CCleaner

HijackThis (HJT)

2. Boot PC into Safe Mode (tap the F8 key repeatedly at bootup - or click here).

3. Run CCleaner

4. Run a full scan with Ewido

Click on scanner. Click on Complete System Scan and the scan will begin.

While the scan is in progress, you will be prompted to clean files, click OK

When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

Click Save report. Save the report .txt file to your desktop. Close ewido security

5. Reboot PC into Normal Mode.

6. Run HijackThis, save and post the log together with the log from Ewido in this thread and I’m confident someone will try to help you :-)

//*Cookie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Make somebody else's day - commit an act of kindness ... TODAY :o)!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Post Edited (*Cookie) : 11/15/2005 8:34:07 AM GMT

Dave22
New Member

Date Joined Nov 2005
Total Posts : 5

Posted 11-16-2005 12:20 (GMT +2)

Ewido didnt find anything, but it spent ages scanning the files the virus has added to the computer. These files are in the directory C:\Documents and Settings\Dave\Complete but i cant find this folder even with hidden files shown.

Here are my logs:

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 22:00:47, 15/11/2005
+ Report-Checksum: A3BF8A10

+ Scan result:

No infected objects found.

::Report End

Logfile of HijackThis v1.99.1
Scan saved at 22:05:17, on 15/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\S3hotkey.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [S3TRAY2] S3tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [S3hotkey] S3hotkey.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1131821722013
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005102501/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe

Thanks in advance for any help!

*Cookie
Junior Member

Date Joined Oct 2005
Total Posts : 79

Posted 11-16-2005 1:14 (GMT +2)

Hi again Dave22,

“Unfortunately”, your log is clean - but for the sake of good order, we can go for another check. Please, follow the steps below:

1. Download these programmes (i.e. in their own folders on your Desktop), but do not run them till I ask you to:

Mwav

Dr.Web

2. Reboot PC into Safe Mode (tap the F8 key repeatedly at bootup - or click here).

3. Run the downloaded programmes:

Mwav:

Place a checkmark in: Memory, Startup folders, drive, Registry, System folders and Services.

- and a dot in: All local drives og Scan all files. Click on Scan.

The scanning might take a couple of hours - depending on how much you have installed on your PC.

Once scanned and items deleted: Click OK. Click Exit - and Exit again if you don’t want to buy the programme.

NOTE! Do NOT click ”Add to Start-up folders”!

Dr.Web:

Double-click on drweb-cureit.exe file. Let the programme delete all found entries. Close the programme when finished.

Click Start -> Search - and search for the file named: drweb32w.log. Open the log and copy the bottom of the log - beginning with “Total session statistics” - into your next reply.

4. Reboot PC into Normal Mode and post the log from Dr.Web for a final check, please.

By the way, it appears you have tried to uninstall the BitDefender Online Scanner but not finalize the uninstallation. But I presume, it's OK now - after you've rebooted your PC?!

How is the PC behaving now eyes

//*Cookie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Make somebody else's day - commit an act of kindness ... TODAY :o)!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dave22
New Member

Date Joined Nov 2005
Total Posts : 5

Posted 11-16-2005 8:51 (GMT +2)

Right, have done what you said, here is the Dr.Web logfile:

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 123468
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 2
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 2
Objects moved: 0
Objects ignored: 0
Scan speed: 302 Kb/s
Scan time: 03:48:55
=============================================================================

PS. I havent tried uninstalling BitDefender, i dindt even know the online scanners installed on the hard drive!
The file C:\oo.exe has gone and doesnt reappear on startup. Alot of space has been freed by the various scans, but the scanners still scan through lots of porn files which i cant find.
Thanks for your help.

*Cookie
Junior Member

Date Joined Oct 2005
Total Posts : 79

Posted 11-18-2005 4:56 (GMT +2)

Hi Dave22

Sorry this belated reply but my PC is down, so I do not have net access regularly till I get a new one cry

Anyway, have you enabled “show all files”? If not, please enable it (f you don’t know how, click here). I suspect you might have a folder called "MSmovies". Have you?

Then run HJT again and post the log here for another check, please.

//*Cookie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Make somebody else's day - commit an act of kindness ... TODAY :o)!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Dave22
New Member

Date Joined Nov 2005
Total Posts : 5

Posted 11-21-2005 6:09 (GMT +2)

Yeah i found a file called MSmovies! PC is behaving normal, no signs of a virus. Thought it had gone completely!

Here is my new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 16:05:50, on 21/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\S3tray2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\WINDOWS\system32\S3hotkey.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\HJT\HijackThis.exe

Thanks for you help!

*Cookie
Junior Member

Date Joined Oct 2005
Total Posts : 79

Posted 11-21-2005 10:51 (GMT +2)

Hi again Dave22,

I presume you deleted the MsMovies folder?! If not, please do so, and your PC is clean again. Well done!

Now with a clean PC, it’s a good idea to carry out the following procedure so you have a clean point to return to if your PC should get infected again:

A) Hide system files again if you haven’t done so (if you don’t know how, click here).

B) Run CCleaner again.

C) IMPORTANT: Define a new point of System Restore:

- Disable System Restore (if you don’t know how, click here)

- Reboot PC

- Re-activate System Restore

-------

It appears you have no Firewall installed?! Let me recommend:

Sygate Personal Firewall . It's very effective, easy to use - and FREE!

For further protection, I can also recommend below-mentioned programmes:

SpywareBlaster

SpywareBlaster prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers and other potentially unwanted software. Unlike other programs, SpywareBlaster doesn’t have to remain running in the background.

SpywareGuard

SpywareGuard provides a real-time protection solution against spyware. It’s a great addition to SpywareBlaster.

IE Spyad

IE-SPYAD adds a long list of sites and domains associated with known advertisers, marketers, and crapware pushers to the Restricted sites zone of Internet Explorer. Nor will they be able to use your browser to push unwanted pop-ups, cookies or auto-installing programmes on your PC.

Microsoft Update

Visit Microsoft and check for Critical Security Updates!

-------

By the way, you’re welcome. Always a pleasure to help someone who does an effort himself smilewinkgrin

Safe surfing cool

//*Cookie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Make somebody else's day - commit an act of kindness ... TODAY :o)!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Post Edited (*Cookie) : 11/21/2005 8:52:11 PM GMT

Dave22
New Member

Date Joined Nov 2005
Total Posts : 5

Posted 11-22-2005 12:01 (GMT +2)

Ok, have deleted the MSmovies folder and instaled the recommended programs.

Thanks again for all your help!

*Cookie
Junior Member

Date Joined Oct 2005
Total Posts : 79

Posted 11-22-2005 1:59 (GMT +2)

No probs, you're very welcome. Now, it appears your PC-problems are solved, I will ask a Mod to close this thread :-)

//*Cookie

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Make somebody else's day - commit an act of kindness ... TODAY :o)!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Forum Information

Currently it is Sunday, September 07, 2008 3:31 PM (GMT +2)
There are a total of 61.867 posts in 15.443 threads.
In the last 3 days there were 21 new threads and 57 reply posts. View Active Threads