Trojan Horse IRC/Backdoor.SdBot4.QGB

And in this case the warning is for

C:\Program Files\Logitech\SetPoint\Connect.exe

The ODD thing is that AVG doesn’t seem to know anything more about the virus and will give 0 results if I search for it

hey dude you find him i’ll hold him down while you kick him in the balls a few times as long as i in black both his eyes. and may break a finger or 2 lol

help will be appricated

thank you

System Restore is such a useful tool – I’d recommend setting it up on every new computer before connecting it to a router and setting it up to automatically set restore points – it’s got me out of a load of holes over the years – do it now!!

would someone please find the person
that started this worm and kick him in the balls.
greatly appreaciated.

AVG spotted the virus after a manual deep scan (rather than a quick daily scan), removed 141 infected files, but couldn’t clean/remove or quarantine a further 4 infected files. I rebooted my machine and sure enough, the virus was back in all its glory.

I tried running Spyware Search and Destroy, but the virus wouldn’t let the program load or update. I read the above posts and downloaded malwarebytes for free.

The virus prevented me from downloading and running malwarebytes on my machine directly, so I downloaded it from an uninfected machine, saved the .exe file to a memory stick and attempted to run it on my machine.

Again, the virus was clever and wouldn’t let me run the install file on my machine. After reading some more on here, I renamed the .exe file to mbamm.exe and it still wouldn’t run!

I’m guessing the version of the virus I received was a more updated version than others received above. I completely renamed the install file to installme.exe and booted the computer in safe mode.

After I booted in safe mode, the install file managed to install onto my machine without any probs. I did the updates as suggested and ran the program. It found all my infected files, removed them and solved the problem.

I’m now Cryptor virus free! Thanks for all your help and a special gratitude goes to the makers of malwarebytes!

2) Re-Name mbam-setup.exe to something else with the .exe extension (like JoeAdmin.exe)

3) Copy the re-named .exe file to a memory stick, or write it to a CD/DVD

4) Restore it to the desktop of your infected PC
and execute it (Scan entire disk).

5) If you have any problems doin this with your current login (which should be a administrator) try creating a new login with administrator privs, loging in as that new login and follow the same instructions.

Works every time!

Problems with IE: Go START > RUN (type in regedit and hit enter) look for:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
Right click on Default, click Modify. Remove:
“C:\\Documents and Settings\\\\Local Settings\\Application Data\\av.exe\” /START \
Leave:
“C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE\”

If you can’t start any programs from desk top links or start menu the .exe shell open command may be broken. Download and run FixExe.reg: hxxp://download.bleepingcomputer.com/reg/FixExe.reg

Bingo
July 22nd, 2009 at 1:28 pm 56

Hello everybody. Only became aware of this thing about 5 days ago when the computer started shutting down and various programs became unworkable. Also, all files on my key drive disappeared and the drive had to be reformatted. Can’t swear that the virus did this but I cnn’t think of anything else to explain it. Windows Firewall (I’m running XP Pro) reported that I had a Virtob infection but AVG, Zone Alarm, and Ad-aware reported nothing. So after a bit of researching, I found the Kaspersky online scanner. This revealed that quite a lot of files were infected with win32.virut.ce but these could not be deleted by the online scanner. However, Kaspersky are doing a Full 30 day trial of Kaspersky Internet Security 2010 and I installed this. On checking drives C, D, and External Drive F, Kaspersky found and disinfected, or deleted, about 700 infected files. Reran the program and a few more files were found and treated. I am completed my third scan and the infection seems to have gone. Can’t say this will work for everyone but it seems to have worked for me. Worth a try and good luck to you. This is one awkward sob. I will report back if the infection recreates itself in the next few days, but so far it’s looking good

Bingo
July 22nd, 2009 at 10:48 pm 57

Following on from earlier post, I found that a few vrt.tmp files were appearing in C:\Documents and Settings\LocalService\Local Settings\Temp but Kaspersky was preventing them loading or connecting to the net. I ran the scan next in Safe Mode and this disinfected the few files which could not be done in normal mode. As of this moment, this machine is now completely free, as far as I can see, of Virut and anything else. All programs and files seem to be working normally and the Kaspersky Network Monitor is showing that there are no suspect connections. Just for information, my operating system is XP Pro SP3. Kaspersky seems to have given me the complete solution to this pest. Well worth giving it a try. Free 30 day trial could rid you of this problem.

Bingo
July 31st, 2009 at 8:35 am 59

Well, just to tie up the story on my experiences, I am now a week on from installing Kaspersky and ridding myself of Virut and it has not reappeared. That about says it all. Would highly recommend Kaspersky for ridding yourself of Virut

It must get deep into all drives that it finds to make them autorun. Anyway – Sunbelts Vipre anti-malware caught it on the hosting computer and kept it from spreading.

The lesson anyway: be sure and hold down the shift key as you insert a USB drive (even if it’s a adapter for IDE/serial/SCSI) to keep it from auto-running.

wow – this thing… it gets deep into sysvol and even maintenance partitions.

I used Darik’s Boot and Nuke (http://sourceforge.net/projects/dban/) for the guest drive (inc maint partition) after reading about the issues here and I’ve not heard from it again.

My guess is people keep on getting reinfected by using their infected-auto-running USB drives or accessing infected .exe’s that they backed up – unless their is some bios component it can load into that I’ve been luckily enough not to have encountered.

anyway
in the task manger, go to prosese’s, and look for a prosses called “YLq”, if its there, rightclick it and click on “open file location”.
if the file location is locat/temp then just ctrl A and press delete

if its not temp, highlight the file and any other things that start with YL (or there and round abouts) and press delete, if it says try again, go back to the task manger and press stop proses.. your welcom, i just made your computer a little safer

It was catched and locked by AVG the minute the file was written on my “safedisk”. Best thing you always must do is only download and safe it. DO NOT DOWNLOAD AND EXECUTE! When you safe the file first, you can scan it with a scanner. If it is infected, it will be locked and can’t infect your computer.

It has a habit of adding or changing the default gateway for the network adapter. Go to the tcp/ip properties if the adapter and click on advanced. remove the gateway entry if there is one.

i want to express my deep concern on this virus from a technical point of view and becuse i have related profession ..but not virsus making lolz! i have made few virus but not like dulla and i have not released them becuse they are for educational purpose only. What i have understood from ~dulla204 is it insert the string ~dulla204 in each file that have extensions like .xlsx .vbp.asp.aspx. and so on…and it strats using a service application(as a windows helpfull application) but.it’s not i have seen some of the prtion of code by opening it in a notpad i have come to undrrstood that it is written in delphi programing language….

I can’t say that I’m 100% free of the stupidity this thing does, but… I might have easy tips for getting rid of the virus, and some pointers to note for people who might be having issues:

1. The virus indiscriminantly infects all .exe and .scr files (even inside .zip, .rar, .7z, or any other kind of archive.) It also infects mostly system .dll files.

2. It does NOT infect any other “media” file. These include .mp3, .ogg, .wav, .avi, .mpg extensions and the like.

3. It doesn’t matter if you have more than one internal or external HDD or Flash drive (or any media that is rewritable), anything that meets the infection criteria WILL get infected.

4. Even if one file is already infected, the virus and any instances running WILL re-infect the same file in a different section of the coding. Thus, multiple scans are necessary to make sure the file is ABSOLUTELY clean.

So… I have a LOT of music and videos that I’m a little too attached to and that I don’t want to lose. When I noticed that this stupid thing targets executables, I realized that I needed to reformat the HDD carrying the OS. I did, and the virus came back.

I then noticed some strange occurrences. Obviously, port 65520 was being accessed by winlogon.exe and explorer.exe. Even though this was a fresh install, I needed to reformat again already.

So, I took up the task of arming myself to clear out this virus from my system with the following tools:

1. Windows XP CD
2. Hiren’s Boot CD v. 10.0
3. Ubuntu v. 8.04 Live CD

Here’s how that worked.

1. I turned off my computer and unplugged the power cord and the Ethernet cable. Left off for 30 min, then plugged the power cord (not ethernet) back in, then booted to Hiren’s Boot CD.
2. I used Hiren’s Boot CD’s partition tools to delete all partitions and destroy the data in the HDD carrying Windows XP.
3. I used the HDD Regenerator in the Hard Disk tools section to check for corrupted sectors. Usually this only applies to physical errors and not so much to data, but if a section has been damaged it’s good to know. Everything came back clean.
4. Went back to Partition Tools and formatted out an NTFS partition for Windows XP.

5. Rebooted and used the Ubuntu Live CD. Using this I was able to get the drivers for anything that I needed on the computer, and clean virus free copies of them because Linux doesn’t have these kinds of virus issues. I also downloaded Virut Removal Tools and Comodo Internet Security and Dr. Web Cure It!. This is good for people that have lost their recovery CDs or their motherboard or display drivers. I placed all these into a clean USB Flash drive. When I copied everything in, I ejected and disconnected the drive.

6. I rebooted into the Windows XP CD. When asked for the desired partition, I performed yet another Format (not quick) on the blank NTFS partition. Proceeded with installing Windows.

7. When Windows loaded, I connected the USB Flash drive and placed its contents on the desktop. Proceeded with installing everything, starting with the basic motherboard drivers all the way to the AV tools and Security software. Ethernet cable is STILL disconnected.

8. Here I noticed none of the system files were behaving erratically. When Comodo Internet Security asked me to update the Virus DB, I then connected the Ethernet cable. Connections were safe, and port 65520 was not being accessed by any program. Definitions were updated, and port 65520 was eventually blocked.

9. Used Dr. Web Cure It! and performed a complete scan of the computer and all disks connected (USB Flash disconnected) overnight. Found a ridiculous amount of instances of Win32.Virut.56. Also found a few miscellaneous backdoors and other trojans.

10. Removed all files mentioned by the Dr. Web scan. Proceeded to scan computer again with Comodo Internet Security AV scan. Few more infections came up, proceeded to remove those as well.

11. Noticed that none of the removed content was on C:\. Proceeded with a deep scan of both HDDs’ “System Volume Information” folder. Found another ridiculous set of instances of Win32.Virut.Ce. Removed them all.

12. This is where I find myself.

Every time I idle my computer and it accesses the screen saver, I notice that my computer has found yet another instance of Virut in the non-Windows HDD’s “System Volume Information” folder. I did just scan again and found more instances, so I removed those.

I just can’t seem to tell whether the virus is still active, or if it’s just remnants. When I use the system, Comodo does not alert me of anything. Also, websites are not blocked, and media files from that HDD do not further aggravate the system as I use them.

Though, I think I’m pretty clear! Hope this helps as another guide and alternative to clear out Virut.

I’m not sure if it’s still in my system but i have the proof!! My laptop is so slow, everytime i open the laptop, Avira Gaurd is disabled, and sometimes my firewall turns of everytime i open the laptop.

Please help me!!!! I’m not sure if it’s in my laptop but i’m very sure it’s infected!! thanks

John McIsaac

1. Download the latest Windows Malicious Software Removal Tool at hxxp://www.microsoft.com/downloads/en/default.aspx
run the tool. restart computer.

2. Since windows update wasn’t working I opened up a support ticket at hxxp://support.microsoft.com/ph/6527/en-us/#tab0
click contact a support professional by email. They helped me through the process until I was able to download all the critical security updates I missed.

3. Run a full free PC scan at hxxp://onecare.live.com/site/en-us/default.htm
follow instuctions after scan.

4. Download Microsoft Security Essentials from same website.

5. Disable all anti-virus/spyware programs and run Microsoft Security Essentials complete scan.

6. Repeat steps 3 and 5 until all infections are removed.

“We have a number of IT solution providers who are solving a number of problems”… what problems, do you call a stupid straight froward database to calculate some stupid calculations real programming? Where were they when dulla struck? Any real programmer can program a remover for dulla but it took them ages before they can manage that, that shows how inexperienced and dumb they are.

If you have evidences, why don’t you post it here. You make it sound like some type of mesterious mission. And if programming a PE infector is that easy, then why did it take them so long. And how many of the CS graduates here can program a remover for it, how many? I bet 99.99% of the graduates don’t even know the difference between PE infector and some other script “viruses”, let alone knowing the structure of PE and programming a remover for a PE infector virus!!!

do exactly as it says, good luck

there r a number of C++ virus scripts on hackers and P2P site anyone with little programming skill specially in C++ can modify and increase the risk of the virus. Its is not a big deal nowadays.

for those who r suffering from ~dulla^@204~ u files could be recovered partially, if u uses Easy Recovery Professional or Advanced Word repair programs. If can’t find the Software emailme at jaffermohATyahooDOTcom
wishing u all including ephrem, all the best.