DNSChanger and Trojan.Agent infections on an Avast!-protected PC

[alisonnic]

This morning realized my computer had been infected by a trojan. I took the machine off the Internet immediately, copied MBAM and MBAM updates to it via a CD, and scanned the system. MBAM detected two trojans:

• Trojan.DNSChanger
  Trojan.Agent

Now that I know the symptoms I realize DNSChanger has been running for at least two days.

I cleaned the system using MBAM quick scan (a second quick scan turned up nothing) and am now doing a deep scan with MBAM.

I have some questions:

1. Assuming MBAM's full scan comes up clean, can I be sure that the system is now safe? This system has critical personal information on it. Should I reformat the hard drive and reinstall everything to be safe? Or is there anything else I can do to ensure that some villains have not installed some other malware (key loggers, file grabbers) through these infections?

2. How did I get these trojans? I am certain I did not install the PlayMP3z plugin into Firefox (as suggested in another thread). I am running a fully updated Avast! Free (at least, it was fully updated until the trojan got into the system.)

3. How can I make sure I don't get these or other malware again?

[!Donovan]

Try scanning with SuperAntiSpyware (SAS) if you wish.

==You could send the infected files to alwil==

[Lisandro]

Sorry, just now I've seen your topic... I've created a new one just before...
Maybe they're linked.

http://forum.avast.com/index.php?topic=45997.msg385828#msg385828

[alisonnic]

Tech, I'm sorry for double-posting. I got some scary messages from Donovansrb10 that made me think I'd done a bad thing by posting followups to existing posts, so I created a new thread. If you can tell me how to cross-link to those (if that's what you want me to do) then I'll be glad to do it.

Unforunately, I don't think I can send you the infected files now because MBAM appears to have deleted them. However, I am quite sure that the computer was infected with a DNS redirect type of trojan, because when I attempted to do a Microsoft Update this morning, I kept getting shunted to a Google search page or a Google file not found page. (That's what alerted me to the fact that I had a problem.)

When I investigated, I discovered that my connection in that computer was being redirected to DNS servers in the Ukraine (85.255.xxx.xxx) known to be associated with the DNSChanger trojan. (I found the following web page: http://www.bleepingcomputer.com/forums/lofiversion/index.php/t185655.html and worked from instructions there.)

The infected computer was running XP SP3 and Avast! 4.8 Home Edition. I have Firefox 3 installed on it, as well as IE7 and the Safari beta, but I use Firefox almost exclusively.

This computer is generally always on and connected to the Internet. According to the Avast! install on it, the current version of the virus database is 090608-0, 06/08, and the VRDB is dated 5/21/09. I've taken it off the Internet for now.

I've checked another computer on my LAN and it does not appear to have been infected (its DNS server entries are intact and a full boot-time system scan by Avast! didn't turn up anything.) If necessary I can run MBAM on that machine to see if either of these trojans are on it.

Please let me know what you'd like me to do. I'd be glad to assist in any way I can to try to help ensure these trojans are detected by Avast! in the future. I'm sorry I didn't come here first thing rather than using MBAM to destroy them!

[!Donovan]

If the other computer has the viruses, you can try sending it to alwil.

[Lisandro]

Maybe I do not have this infection because I use OpenDNS...

[alisonnic]

I should also mention that I could post the MBAM logs showing these two trojans. I'd have to jump through some hoops since I don't want to put this machine back on the LAN unless I know it's safe, but I can do it.

The MBAM log shows about a dozen registry entries for DNSChanger and two files infected with DNSChanger. It also shows one file infected with Trojan.Agent, and three infected Registry keys (one with Trojan.Agent and two with Trojan.DNSChanger).

The infected folders and files are as follows (I'm reading and typing, so please excuse typos!)

Folders Infected:
C:\Program Files\BlueRaTech (Trojan.DNSChanger)

Files Infected:
C:\program files\bluratech\Uninstall.exe  (Trojan.DNSChanger)
C:\WINDOWS\system32\gxvxccounter  (Trojan.DNSChanger)
C:\WINDOWS\system32\gxvxccnmwmioxdxepjewwpkjekqfrkutdmxstm.dll  (Trojan.Agent)

Unfortunately, as I said, I've already run MBAM and instructed it to clean these viruses. A subsequent run shows no infections.

BTW, I will follow Donovan's suggestion and run SAS as soon as the full scan of MBAM is done.

[alisonnic]

Maybe I do not have this infection because I use OpenDNS...

That's another thing that's puzzling: I am using OpenDNS. But somehow the DNSChanger trojan got into the system and redirected Windows to use those Ukrainian DNS servers.

[Lisandro]

That's another thing that's puzzling: I am using OpenDNS. But somehow the DNSChanger trojan got into the system and redirected Windows to use those Ukrainian DNS servers.

Are you with Vista? You may have UAC disabled then...

[alisonnic]

That's another thing that's puzzling: I am using OpenDNS. But somehow the DNSChanger trojan got into the system and redirected Windows to use those Ukrainian DNS servers.

Are you with Vista? You may have UAC disabled then...

No, I am using XP Pro SP3.

[alisonnic]

If the other computer has the viruses, you can try sending it to alwil.

Donovan,

I ran Malwarebytes on the other computer, and it came up clean. So unfortunately it looks like I cannot send you copies of the infected files.

[alisonnic]

Wait. I was wrong! Malwarebytes did not delete the infected files; it quarantined them. So I could theoretically restore them and send them to you.

Is there a safe way to do this? Can you tell me how to go about it?

[!Donovan]

Not-Safe Way: You can put the files back in there oridginal places and then send it to avast chest and then send it to alwil

Safe Way: Send the qurnined item to alwil (possible chances of no action)

[Spiritsongs]

   Hi :

 Several months ago on another forum, I recommended the following :

 "IF you use a router, you MUST do the following :


In order to destroy the terrible Trojan.DNSChanger you must re-set your router.

1. Disconnect your system from the internet

2. Scan your system to expose the Trojan.DNSChanger

3. Then have SuperAntiSpyware remove it. (re-boot your computer if necessary).

4. Next you must reset the router to its default configuration. This can be done by inserting something tiny like a paper clip end or pencil tip into a small hole labeled "reset" located on the back of the router. Press and hold down the small button inside until the lights on the front of the router blink off and then on again (usually about 10 seconds). If you don't know the router's default password, you can look it up here:

https://www.opendns.com/smb/start/router/

5. Re-run SuperAntiSpyware to see if the Trojan.DNSChanger is gone from your computer. And then connect to the internet.


IF you do NOT use a router, let me know . IF you use Flash Drive(s), I recommend you


use the FREE 'Flash Disinfector', with very good Info available at


http://experi3nc3.wordpress.com/2007/05/10/flash-disinfector-by-subs . "


 

[calcu007]

Not-Safe Way: You can put the files back in there oridginal places and then send it to avast chest and then send it to alwil

Safe Way: Send the qurnined item to alwil (possible chances of no action)

It was quaretine by MBAM so he need to restore them first before send it.