Name: toddho Date: November 27, 2007 at 20:59:09 Pacific Subject: Brontok Virus OS: WindowsXP SP2 CPU/Ram: Pentium III Mobile/256MB Model/Manufacturer: IBM/Thinkpad A30
Comment:
I live in a foreign country (guess which one) & I've been having intermittent pop-ups from my AV (Command AV from Authentium) telling me that files are being quarantined & that these files were created by the W32/Brontok.BA@mm virus. OK, fine, I've been protected. But when I do a scan of my hard disk, no virus is detected. But I'll get the same pop-up again 20 minutes later or the next day...
I've found very little info online about this specific virus, but most of the info I've seen about Brontok viruses in general suggests that:
1. These viruses surface when a certain e-mail attachment is opened. (I can assure you I haven't opened any executable attachments.)
2. These viruses pop up a message in a foreign language about resisting corruption, pollution & moral decay, etc. (I can assure you I've seen no such message.)
It seems this "virus" becomes active only when I'm connected to the internet. When the AV pop-up shows that it is active, I pull up Task Manager to see the active processes & everything looks pretty normal.
A friend gave me Brontok-Washer to try, but that hasn't helped. I also tried some online scanner (don't remember anymore which one), but that hasn't helped either.
So far it seems no damage has been done, but I find this AV pop-up rather annoying as for several minutes I am unable to do anything other than watch my AV software quarantine files.
By the way, my wife's laptop has not had this problem, though we use the same network connection (DSL) & share files. One difference is that her laptop has AVG anti-virus.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button.
Balaji, I tried downloading Microsoft's Malicious Software Removal Tool, and it said that it removed this virus & 2 others. However, the virus has appeared again since then...
Hi jabuck, I wanted to try your suggestions, but the link that you gave: http://www./computer-virus/brontok-jun19.htm is invalid. (I tried removing the / after www. but it's still invalid.) Please advise...
Please download and install the latest version of HijackThis v2.0.2:
Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop. 2. Double click on HJTInstall.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:36:41 AM, on 12/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal
To get to the Sophos removal tool type brontok removal into google or your favorite browser. Scroll down to the Sophos link and click on it.
Next click BRONTGUI > click run> click run again> click accept> click Go.
Please run the BitDefender online scan this link BitDefender.com
You will need to allow an active x install for the scan to run. Leave the scanning options at default and press "click here to scan" When finished scanning, click on "click here to export the scan report" Save it to your desktop, at "file name" type in "bdscan" then click save. Post a log in your reply.
I followed your instructions. BRONTGUI found nothing. When I tried running the BitDefender online scan, my laptop suddenly shut off while it was downloading its stuff.
This has happened before, usually when I'm trying to work on this virus. But then the next time I try to download the same thing, it succeeds.
In this case, BitDefender completed th second time, but only found files already quarantined by my AV. Meanwhile, the virus became active several times while BitDefender was running, and several more times since.
Here's the log... ----- BitDefender Online Scanner
Scan report generated at: Sun, Dec 09, 2007 - 20:26:30
Thanks, balaji, for your suggestion. A few days ago I turned off System Restore and then ran the m/s tool. Then I had a couple days with intermittent internet access. So I did not see the virus directly, but I did see my laptop shut itself off while updating antivirus. This seemed suspicious, like the virus was still active. Sure enough, this morning, I saw the same old behavior: creating executable files with the same names as my shared folders. What do I try now?
Also, when is it safe to turn System Restore back on?
Hi Johnw, thanks for your suggestions. By the way, the exact name of this virus is: W32/Brontok.BA@mm. I don't know if this is an alias for W32.Brontok.E or not.
I tried the online scan from www.eset.com. It seemed to run OK, but only reported the files previously quarantined by my AV software as needing to be cleaned. In other words, didn't work. In fact, the virus kicked into action while the scan was running, but ESET didn't detect it. Their online information seems to indicate that the downloadable version scans the same stuff as the online version, so I didn't bother downloading.
As for CounterSpy, I didn't try it. It is advertised as mainly a Spy/Ad remover. If I haven't succeeded with general-purpose AV software or those that specifically mention their ability to clean up Brontok, I don't suppose I will succeed with a Spy/Ad remover that claims to handle a few types of malware.
Johnw, I had already tried the MS malware tools, as reported above. By the way, your link didn't work for me, so I did a search for Brontok on the MS site, and everything looked pretty much the same as it did last time. Their description of the Brontok virus doesn't quite match what I'm seeing...
Hi, it turns out my problem is the same as a virus from a prior posting: I-Worm/VB.GK. W32/Brontok.BA@mm was the name given by Authentium's Command Anti-virus. When I switched to AVG, the same behavior was attributed to I-Worm/VB.GK.
I have come to believe that the reason I cannot clean this virus from my system is that it is not on my system.
When the virus is running, if I disconnect the DSL cable, the virus stops dead. It only starts when the cable is connected. It only affects the folders under Shared Documents. To me this all points to a virus that is running on my ISP's server...
Am I completely off-base? Is there anything I can do if I'm right?
prathyush, if you will read the prior postings, you will see that TrendMicro's HiJackThis tool did not find anything to clean.
The information on Computing.Net is the opinions of its users. Such
opinions may not be accurate and they are to be used at your own risk.
Computing.Net cannot verify the validity of the statements made on this site. Computing.Net and Computing.Net, LLC hereby disclaim all responsibility and liability for the content of Computing.Net and its accuracy.
PLEASE READ THE FULL DISCLAIMER AND LEGAL TERMS BY CLICKING HERE
Version Tracker Pro
Driver Agent