What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Suspect Vundo.JD Virus Attack

29 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
I can't see anything that I can identify as nasty, apart from c:\windows\system32\drivers\atapi[INFECTED].sys which can be deleted, so I can't offer anything other than "informed" reasons for the problems with your stock program - otherwise known as guesses! It is possible that the infection corrupted something, either with the program itself or something that it uses, and uninstalling and reinstalling doesn't remove/correct it. Hopefully their tech people will be able to solve it, or ultimately you could reformat and reinstall to get things back to how they were pre-infection with the OS, but that is a serious step and not what you'd choose as a solution. Other than those two options, i'm not much help.

I'd like to see if GMER will run to completion now, just to satisfy my curiosity:

Go here and click the Download EXE button at the top and save the file to your Desktop - the file is randomly named to try to sidestep the actions of certain malicious files.
Double click the file to begin:
  • If you get a pop-up regarding rootkit activity and are asked if you want to scan, click No, and then Save… the log with any name to a handy location - the Desktop is always a good choice.
    If you don't get the warning about rootkit activity you don't need to save the log.
  • Make sure all the boxes on the right of the screen are checked, EXCEPT for
    • Sections
    • IAT/EAT
    • Show All
    • All drives except your main one, which is usually C:\.
  • Click the Scan button on the right.
  • When the scan has completed, (you'll have time for a snack and a cuppa!), click the Save… button and again save the log with any name to a handy location.
Post the contents of the log(s) into your next reply. The Preview option on the forum may show the whole log(s) being posted, but they sometimes get cut down when the actual post is made, so please check the post once it is completed.
Post #17
I deleted the atapi[INFEECTED].sys

I spent a couple of hours with the stock software tech support uninstalling, cleaning registry, re-installing with no success. There must still be
something left in the registry that may only be fixed by re-installing Windows. Not sure, but I will deal with that separately at this point.

My computer doesn't much like the GMER Rootkit Scanner. Here is a description of the behavior along with the log I saved…

Started GMER at about 10:00pm Saturday night. By 8:30 Sunday morning it was still scanning files when I left for church. When I returned at about 12:45pm the computer had rebooted.

My next attempt resulted in a state where I couldn't launch the Task Manager nor could I invoke a shut-down from the Start Menu. I manually turned the computer off.

For the next attempt I launched the Task Manager before launching GMER and had it scan all but the Files and the options you noted to disable. During the test I didn't have anything open on the desktop except for GMER. When GMER was scanning the CPU activity was:
zlclient.exe 50%
GMER 50%
When the scan completed it took 15 minutes for me to save the file. The CPU activity was:
zlclient.exe 0-3%
lsass.exe 47-50%
winlogon.exe 49-50%
avgwdsvc.exe 0-3%
The processes varied with time but always had 100% CPU usage wit a Commit Charge of 441M/4191M
After the log file was saved I clicked and the GMER screen went away and the CPU usage remained as noted above totally 100%.
I manually turned the computer off.

The next re-boot I launched Task Manager and then opened and closed GMER. After closing the CPU activity was:
avgwdsvc.exe 50%
zlclient.exe 50%
I manually turned the computer off.

The next re-boot I launched Task Manager and then launched GMER and scanned "Files" but nothing else.
During the scan the CPU usage was:
GMER 0-5%
System 35-50%
System Idle 2-60%
lsass.exe 0-60%
avgnsx.exe 0-5%
winlogon.exe 0-50%
At the beginning only GMER and System were reporint CPU usgage and then later lsass.exe, avgnsx.exe and winlogon.exe consitently reported CPU usage.
After 15 minutes or so GMER displayed "hasn't found and errors" and then shortly after the computer re-booted on its own.

Here is the log that was generated with the scan without scanning "Files".


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-10 20:58:42
Windows 5.1.2600 Service Pack 3
Running: 08qkhhbe.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ugtiakob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB6059FC0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB6056C80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB6071170]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB605A580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xB606E900]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xB606EB10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0xB6072B10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB605A670]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB6057210]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB60719F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB60717A0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xB606E280]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB6071F10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB6071F90]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB6057070]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xB6070180]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0xB606FF40]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB60726F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB6072150]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB6059BE0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB6072540]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xB605A190]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB6057440]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB60714E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xB606F200]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xB606F080]

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

—- EOF - GMER 1.0.15 —-
Post #21
Yes, it runs by double-clicking. Is that Safe Mode? If so, it is how I have run GMER every time regardless of its name. I didn't see any setup options once it launched that indicated Safe Mode. As I have documented it will slow down to a crawl and/or re-boot the computer unexpectedly before completion. That is why I have run it without scanning files and then gone back and run only scanning files on the occasions that it has re-booted and posted two logs. How do you want me to proceed?
Post #22
No, it's the PC that wants to be in Safe Mode:
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Post #23
Sorry, I didn't understand that you meant Windows Safe Mode. I thought there was a Safe Mode within the GMER software. I was able to run GMER successfully in Safe Mode. There were no problems found and no log generated so there is nothing to post. The stock software provided graciously gave me a free upgrade yesterday to the latest version since we weren't able to resolve the data feed problem. However, last night the data feed program, Telechart 2007 Gold, wouldn't launch. It went through it's normal startup sequence but then the dialogue box disappeared and the software didn't complete the launch. I also had some difficulty connecting to the Internet through IE8 and Outlook was unable to connect to the e-mail server. I didn't have time to check to see if an older computer I have was able to connect so it is possible that it be my cable service. However, over the past couple of weeks as we've been cleaning viruses I have had occassions where this computer would lose connection via IE8 and Outlook but the older computer was OK. I believe it may have been before we had this computer cleaned up but I am not sure. My Zone Alarm indicates traffic at times that I'm not sure where the traffic is coming from but I don't know how to know for sure what initiates the traffic. I will wait for your next reply.
Post #24
Pay a visit to the Kaspersky Online Scanner 7 - I.E. is preferred for this scan.
  • Read the Information panel and then click Accept.
  • Allow the ActiveX download if necessary.
  • Both the anti-virus engine and database will need to be downloaded, which may take a little time.
  • Once this has been completed, select My Computer from the Scan section on the left hand side.
  • Put the kettle on!
  • Although it is recommended by Kaspersky that you should disable your anti-virus scanner before starting this scan, it should work OK with it still active - it does on my PC.
    Although you may find the scan speed increases if you carry out this step, I never like to disable my resident scanner while online, so I don't.
  • When the scan has completed, click View scan report at the bottom.
  • Click Save Report As…
  • Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
  • Click Save and pick a location for the file - the Desktop is always handy.
Copy and paste the report into your next reply.
Post #25
I received an error about half way through updating the database with the Kaspersky Online Scanner. I restarted and got another error. See below, copied from the Kaspersky Online Scanner dialogue box….


Program is starting. Please wait…
Update source selected: http://www.kaspersky.com
Downloading file: packages/kos-extras.jar
Program has started.

Program database is being updated. Please wait…

Update has failed. Program has failed to start. Close the Kaspersky Online Scanner 7.0 window and open it again to install the program. You must be online to update the Kaspersky Online Scanner 7 database. With the latest database updates, you can find new viruses and other threats. Please go online to use Kaspersky Online Scanner 7. [ERROR: Key is expired]

Starting Java applet has failed! Please go online to use this program.
Post #26
This morning IE was unable to connect to the Internet and Outlook was unable to connect to mail servers. IE on an older computer was able to connect to the Internet and I was able to view files between computers. Hence I am confident that my cable service is OK, my wireless router and modem are OK and the wireless cards in both computers are OK. The problem comes back to this computer and its ability to connect to the Internet. In an attempt to get the on-line scanner to run last night I made a few adjustments in Zone Alarm, removing the permananet block on a few processes, requiring Zone Alarm to prompt for access instead. This morning I was prompted with the following: * Generic host process for Win32 services is trying to access the trusted zone. - I allowed this * Generic host process for Win32 services wants to accept connections from the trusted zone. - I allowed this * Generic host process for Win32 services is trying to access the Internet. - I did NOT allowed this I don't know what the Generic host process is related to, nor do I know how to find out. Is there a way to understand what process or application is making the request? We seem to have made progress but still have something that isn't 100% right. The repeatable problems that still exist are: 1. Sometimes access to the Internet is restricted 2. Some of the scanners you have requested to run don't run completely normal 3. My stock software still doesn't connect to the data feed even after uninstalling, downloading and installing the current version of the stock program and uninstalling and re-installing the data feed. Both seem to run normally but the connection between them is not. (I have a new request in to their support, waiting on a reply) There seems to be a large number of processes running. I don't know what most of them are but think that a number have been added by Google, Microsoft, and the likes that aren't really necessary. I suspect we may get to them at some point in this cleanup process. I wait for you next reply and recommendation(s).
Post #27
Lets review the problem:

Symptoms:
* Windows Defender no longer runs at startup nor does it check for automatic updates

AVG virus scan identified the presence of Vundo.JD and indicated its removal

Have these been resolved?

My Zone Alarm indicates traffic at times that I'm not sure where the traffic is coming from but I don't know how to know for sure what initiates the traffic.

Is this inbound or outbound traffic?

In an attempt to get the on-line scanner to run last night I made a few adjustments in Zone Alarm, removing the permananet block on a few processes, requiring Zone Alarm to prompt for access instead.

What did you unblock and why did you block it in the first place?

Generic host process for Win32 services is trying to access the Internet. - I did NOT allowed this

I don't know what the Generic host process is related to, nor do I know how to find out. Is there a way to understand what process or application is making the request?

Does ZA have an option to list firewall events? If it does, it may be more informative in it.

1. Sometimes access to the Internet is restricted

When and in what way?

2. Some of the scanners you have requested to run don't run completely normal

Kaspersky is known to be a bit flaky since some updates were done, so I wouldn't read anything into this and GMER sometimes acts up as well. Are there any others that are causing problems?
Post #28
QUOTE Symptoms: * Windows Defender no longer runs at startup nor does it check for automatic updates AVG virus scan identified the presence of Vundo.JD and indicated its removal Have these been resolved? ANSWER I haven't checked if Windows Defender is running but it hasn't notified of updates since we started this process. I can check when I get home and reply. The Vundo.JD was related to the atapi.sys file that has been corrected QUOTE My Zone Alarm indicates traffic at times that I'm not sure where the traffic is coming from but I don't know how to know for sure what initiates the traffic. Is this inbound or outbound traffic? ANSWER I don't know whether it is inbound or outbound nor do I know how to check. QUOTE In an attempt to get the on-line scanner to run last night I made a few adjustments in Zone Alarm, removing the permananet block on a few processes, requiring Zone Alarm to prompt for access instead. What did you unblock and why did you block it in the first place? ANSWER I unblocked a Svchost. Since I don't know what it is I don't know when I would have blocked it. When Zone Alarm is first installed nothing is blocked and nothing is automatically allowed. All programs request approval. Some things like Outlook, IE, stock data feed that are routinely needing access to the Internet I have allowed to access the Internet without requesting permission. Almost everything else I either allow or deny access when prompted. A few times I have blocked access permanently to programs that over time I have routinely disallowed when prompted rather than always being prompted. I don't remember blocking anything permanently in the past month. Zone Alarm has been installed for a number of years and keeps increasing its list of programs so it's hard to know when I blocked the ones that are "generic" program names. QUOTE Generic host process for Win32 services is trying to access the Internet. - I did NOT allowed this I don't know what the Generic host process is related to, nor do I know how to find out. Is there a way to understand what process or application is making the request? Does ZA have an option to list firewall events? If it does, it may be more informative in it. ANSWER I don't know. I will check when I get home. I am using their free version so it may not. QUOTE 1. Sometimes access to the Internet is restricted When and in what way? ANSWER IE Browser launching to a website times out and displays "Unable to connect". Outlook attempts to retrieve e-mail, times out and reports an error. These have happened randomly over the past 2-3 weeks. Maybe once every day or so. Sometimes when it happens it happens over a period of 15 minutes or longer and then suddenly Outlook will retrieve e-mail. When that happens IE will also connect. On about 3 or 4 occasions I have tried my older computer and each time IE will connect to the homepage. QUOTE 2. Some of the scanners you have requested to run don't run completely normal Kaspersky is known to be a bit flaky since some updates were done, so I wouldn't read anything into this and GMER sometimes acts up as well. Are there any others that are causing problems? ANSWER The only scanners that have been a problem are the ones you have requested. GMER and Kaspersky are the only two I remember being problems. The other problem that continues to baffle is the stock program that won't connect to the data feed. Last night I downloaded and installed the current version and it wouldn't connect to the datafeed. Tech support replied today that they have no idea why it wouldn't connect and didn't offer any explanation of how it attempts to connect to know what may be the problem. It isn't a problem they have had before that the things I have tried didn't fix. It is odd that it doesn't work with either the old version or the latest.
Post #30
No, I am not fixed on Zone Alarm. It is what I have used the past 5 years and haven't had any problems but I am open if something else might correct the problem with the stock program and connecting to the Internet. Two things I discovered tonight. First, today's problem with IE and Outlook connecting to the Internet was because I said "No" to the svchost generic host when prompted by Zone Alarm. The prompt was most likely triggered by the change in settings although I am not sure how it was connecting before clearing the permanent restriction. The second is that after I tried Kaspersky again tonight without success the IE browser session would no longer connect to the Internet. Closing IE and re-opening seemed to correct the problem. Hence the problems I have experienced connecting to the Internet may be a result of the scanners that haven't run properly. What is your thought? It still doesn't explain why the stock program doesn't run unless there is a program restriction that got set in Zone Alarm by inadvertantly selecting "always restrict" somewhere along the way. If that is the case uninstalling and then re-installing Zone Alarm would clear all the old settings and begin to build a new database. Another option would be to use a different firewall as you are implying.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI