W32/bube.gen

[Verwijderd]

Hoe kan ik deze virus verwijderen ? Hij opent een explorer.exe en vreet enorm veel cpu usage , schijnt dat het een redelijk nieuw virus is maa rik kan hem op geen enkele manier verwijderen.
Ik heb mcafee geprobeerd in safe mode, hij vond hem wel maar kon hem ook niet verwijderen.

Iemand enig idee ?

[pasta]

Probeer eens met een andere virusscanner te scannen, zoals Kaspersky. Verder, welke Windows versie gebruik je?

[Verwijderd]

XP sp1

[pasta]

Hmm, dat is vreemd, want volgens de eerste hit op Google hoor je juist deze melding te krijgen, wegens WFP.

Daarbij, SP2 is uit, het is verstandig om hier naar te updaten. Het heeft namelijk verbeterde veiligheids functies. Daarnaast kan je ook nog even met HijackThis even kijken naar registerentries en processen die dat virus aanmaakt.

[ Voor 33% gewijzigd door pasta op 16-02-2005 18:07 ]

[Borromini]

je kan ook bij symantec de virus removal tools zoeken en kijken of ie op de lijst staat. Zoja, dan download je het aangepaste progje en voer je dat handmatig uit.

[Verwijderd]

wow haha thx pasta , ik had inderdaad die melding .
Kan ik dat programma gewoon installen etc ?

[pasta]

Verwijderd schreef op woensdag 16 februari 2005 @ 18:10:
wow haha thx pasta , ik had inderdaad die melding .
Kan ik dat programma gewoon installen etc ?

Hijackthis hoeft niet geïnstalleerd te worden, maar ik zou het wel ergens in een mapje neerzetten. Mocht je er niet uitkomen met Hijackthis, post dan je log hier tussen [code]tags. Geef dan wel aan wat je zelf al verdacht vond.

Om je explorer.exe hierna nog te repareren, kan je gebruik maken van het commando sfc /scannow.

[Verwijderd]

code:

Logfile of HijackThis v1.98.2
Scan saved at 6:19:20 PM, on 2/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\asuskbservice.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\crqr.exe
C:\WINDOWS\system32\atlni32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\MooN\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = www.msn.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: run=C:\WINDOWS\System32\soft.exe
O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: (no name) - {F3512289-B634-D7C1-9C21-CEC10846BE2E} - C:\WINDOWS\system32\mfcmc32.dll
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NVRT] F:\ProgZ\NVRefreshTool\nvrt.exe /startup
O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\System32\sm.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\elitehin32.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [crqr.exe] C:\WINDOWS\crqr.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\RunOnce: [atlni32.exe] C:\WINDOWS\system32\atlni32.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\System32\sm.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.frame.crazywinnings.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098457293633
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B4F32846-56DD-4CF5-94FD-17DE1A12E9EB} (CounterX Class) - http://t058.com/cabtest/counter.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)

Met die eTrust scanner zou ik toch de W32/bube virus kunnen verwijderen?

[ Voor 12% gewijzigd door pasta op 16-02-2005 18:22 ]

[pasta]

Nkroone84 schreef op woensdag 16 februari 2005 @ 18:20:
Met die eTrust scanner zou ik toch de W32/bube virus kunnen verwijderen?

eTrust hoort volgens deze pagina het bestand te herkennen ja.

[ Voor 72% gewijzigd door pasta op 16-02-2005 18:23 ]

[Verwijderd]

die windows\explorer moet ik vanaf :<

[Verwijderd]

FYI: http://www.viruslist.com/en/weblog?weblogid=159054634

Ik heb trouwens gehoord - niet 100% bevestigd gekregen - dat eTrust het beestje in quarantine zet ipv. disinfecteert.

[Verwijderd]

dat hoop ik dan niet , ben het aant downloaden nu..

[Verwijderd]

ik heb de hele tijd een webpage als desktop en 80 a 90% cpu usage

[Verwijderd]

pasta schreef op woensdag 16 februari 2005 @ 18:04:
Hmm, dat is vreemd, want volgens de eerste hit op Google hoor je juist deze melding te krijgen, wegens WFP.

Nope, eerst wordt explorer.exe uit dllcache geïnfecteerd/vervangen en dan wordt windir\explorer.exe vervangen/geïnfecteerd.

Je krijgt pas zo'n melding te zien als je gaat disinfecten.

Nkroone84, je kan je posts ook editten, dat zien we zelfs veel liever als je binnen 24 uur op jezelf reageert.

[Pendaco]

ook maar even de rommel aangeven;

ga naar jotti's virusscanner en scan deze files, want die horen zeker niet in windows thuis!

code:

C:\WINDOWS\crqr.exe
C:\WINDOWS\system32\atlni32.exe

kan de wel bekende prullenbak in

code:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\wjmnd.dll/sp.html#93256
R3 - Default URLSearchHook is missing

daar is je trojan (Win32.Bube.A), lees ook hier

code:

F3 - REG:win.ini: run=C:\WINDOWS\System32\soft.exe

hoort waarschijnlijk bij elkaar, scan eerst ook even met jotti's scan, de bovenste is zowiezo onderdeel van een toolbar

code:

O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\boln.dll
O2 - BHO: (no name) - {F3512289-B634-D7C1-9C21-CEC10846BE2E} - C:\WINDOWS\system32\mfcmc32.dll

controleer ook even, heb geen zin om die ook allemaal langs te lopen

code:

O4 - HKLM\..\Run: [Web Service] C:\WINDOWS\System32\sm.exe
O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe
O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe
O4 - HKLM\..\Run: [antiware] C:\windows\system32\elitehin32.exe
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe boln.dll, DllRegisterServer
O4 - HKLM\..\Run: [crqr.exe] C:\WINDOWS\crqr.exe
O4 - HKLM\..\Run: [Security iGuard] C:\Program Files\Security iGuard\Security iGuard.exe 
O4 - HKLM\..\RunOnce: [atlni32.exe] C:\WINDOWS\system32\atlni32.exe
O4 - HKCU\..\Run: [Web Service] C:\WINDOWS\System32\sm.exe
O16 - DPF: {B4F32846-56DD-4CF5-94FD-17DE1A12E9EB} (CounterX Class) - http://t058.com/cabtest/counter.cab

kan zowiezo nog weg

code:

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)   
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file) 
O15 - Trusted Zone: *.finefind.nettraffic2cash.biz
O15 - Trusted Zone: *.frame.crazywinnings.com
O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - (no file)

godsklere zeg, heb je uberhaupt wel iets van een anti spyware programma gebruikt??
begin anders eerst eens met http://www.hitmanpro.nl
daarna hijack this!, en nog een keer hijack this in veilige modus

over die sp.html is genoeg te vinden mbv de search op GoT
succes

[Cobalt]

Sophos Virus information
W32/Bube-A
Summary

Summary Description Recovery Advanced

Profile Prevalence: low high
Name W32/Bube-A
Type Worm

Affected operating systems Windows

Side effects Allows others to access the computer
Reduces system security
Installs itself in the Registry

Protection Download virus identity (IDE) file
Protection available since 4 February 2005 14:01:20 (GMT)
Included in our products from March 2005 (3.91)
More information on IDE files What are IDE files?
How to use IDE files
Get the latest IDE files

Staying up to date
EM Library, part of the Enterprise Manager suite of management tools, allows fully automated web-based installation and updating of Sophos Anti-Virus on a wide range of platforms. If you're using one of our enterprise solutions and aren't already using EM Library, check it out now. Users of our small business solutions are automatically updated by Sophos AutoUpdate.


Description

Summary Description Recovery Advanced

This section helps you to understand how it behaves
W32/Bube-A is a downloader Trojan for Windows operating systems.
Once the Trojan has installed itself on a computer it attempts to set certain registry entries to make the computer more vulnerable by disabling the functionality of Windows Security Centre, disabling automatic updates, and disabling the Windows Firewall.
The Trojan tries to contact a pre-specified website, from where it downloads instructions that may tell it to install software to the registry, set and delete registry entries, open Internet Explorer to a specific web page, run Explorer with specified parameters, and download and execute files.


Recovery

Summary Description Recovery Advanced

This section tells you how to disinfect.
Please follow the instructions for removing worms.


Advanced

Summary Description Recovery Advanced

This section is for technical experts who want to know more.
W32/Bube-A is a downloader Trojan for Windows operating systems.
The Trojan makes two copies of itself in the <System> folder - one with the original filename it was run with on a computer and one as soft.exe.
To ensure that the copy that keeps its original name and is automatically started when a user logs on to an infected computer, the following registry entries are set:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Web Service
<filename>
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Web Service
<filename>
As a further attempt to ensure that W32/Bube-A runs when an infected computer starts, the Trojan attempts to create or modify win.ini (depending on whether it is present or not), creating the following entry:
[Windows]
run=<Windows>\soft.exe
The Trojan also registers soft.exe as a component of Windows that needs to be installed, and thus it will be run every time Windows loads. It does this by setting the following registry key:
HKLM\Software\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500}
StubPath
<System>\soft.exe
As a final attempt to ensure that W32/Bube-A is automatically run on an infected computer, the Trojan attempts to infect explorer.exe so that when it is run it will start a thread containing the resident Trojan code. The Trojan tries to modify copies of Explorer at the following locations:
<Windows>\explorer.exe
<System>\dllcache\explorer.exe
<Windows>\ServicePackFiles\i386\explorer.exe
To facilitate the patching of explorer.exe, an entry in wininit.ini will be added. If wininit.ini does not exist, then it will be created. The new entry will read:
[rename]
<Windows>\explorer.exe=<Windows>\explorer.new
The Trojan will also try to rename explorer.new as explorer.exe by setting a registry entry that will cause this operation to be performed when the infected computer restarts. Any pending renaming operations are stored under the following registry entry:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations
Once W32/Bube-A has installed itself on a computer it attempts to set the following registry entries to make the computer more vulnerable by disabling the functionality of Windows Security Centre, disabling automatic updates, and disabling the Windows Firewall:
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKCU\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKCU\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKCU\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate
1
HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
NoAutoUpdate
1
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
AUOptions
1
HKCU\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
AUOptions
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
1
HKCU\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
1
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
1
HKCU\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
1
Once fully installed, the Trojan contacts a pre-specified website to report its presence on the computer, and periodically tries to download a file that will specify further commands for the Trojan to execute. W32/Bube-A can be instructed to:
Install software to the registry
Set and delete registry entries
Open Internet Explorer to a specific web page
Run Explorer with specified parameters
Download and execute files

[Verwijderd]

Onofficiële removal guide: http://www.dslreports.com/forum/remark,12688162~mode=flat

[ Voor 7% gewijzigd door Verwijderd op 16-02-2005 20:41 ]