ljhhg.dll trojan? can't delete it

[ftechguy]

A user reported popups that say his laptop is infected, click here to scan, etc. Ok sounds familiar.

A Hijack log shows only one suspicious file: the above named dll is always loaded at startup. I tried to remove it, but a rescan always shows it appearing again. I can't delete the file, whether in safe-mode or command prompt safe-mode. Neither Killbox nor Moveon Boot could get rid of it. Norton, Spybot S&D and Ewido don't detect it at all.

Anybody have anything else I can try, or have any info about this? A google search gave only two pages which are not in English, but seem to confirm it's malware.
The file shows no info in its properties view. The creation date puts it around the time the user started having problems.
Any help would be appreciated.
TIA!

 

[pechenegs]

Download hijack this from the link below.Please do this. Click here:

http://www.thespykiller.co.uk/files/hijackthis_sfx.exe

to download HijackThis. Click scan and save a logfile, then post it here so
we can take a look at it for you. Don't click fix on anything in hijack this
as most of the files are legitimate.





* Download the trial version of Ewido Security Suite here

http://www.ewido.net/en/

* Install ewido.
* During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
* Launch ewido
* It will prompt you to update click the OK button and it will go to the main screen
* On the left side of the main screen click update
* Click on Start and let it update.
* DO NOT run a scan yet. You will do that later in safe mode.




* Click here to download ATF Cleaner by Atribune and save it to your desktop.

http://majorgeeks.com/ATF_Cleaner_d4949.html

* Double-click ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the Empty Selected button.
o If you use Firefox:
+ Click Firefox at the top and choose: Select All
+ Click the Empty Selected button.
+ NOTE: If you would like to keep your saved passwords, please click No at the prompt.
o If you use Opera:
+ Click Opera at the top and choose: Select All
+ Click the Empty Selected button.
+ NOTE: If you would like to keep your saved passwords, please click No at the prompt.
* Click Exit on the Main menu to close the program.


* Click here for info on how to boot to safe mode if you don't already know
how.

http://service1.symantec.com/SUPPOR...2001052409420406?OpenDocument&src=sec_doc_nam

* Now copy these instructions to notepad and save them to your desktop. You
will need them to refer to in safe mode.


* Restart your computer into safe mode now. Perform the following steps in
safe mode:




* Run Ewido:

* Click on scanner
* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop


reboot to normal mode and run a few online scans!



Run an online antivirus check from

http://www.kaspersky.com/virusscanner

choose extended database for the scan!



post another hijack this log, the ewido and kaspersky scan logs

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[erikhertzel]

I would try to hit it with spysweeper

Download it here:

http://www.sabethacomputing.com/downloads.html

Webroot Spysweeper 14 day Trial

Update the defs and do a sweep.

Erik

 

[ftechguy]

Well the person is just going to wipe everything now. I wanted to try RKR--I think that might've showed what was recreating the file entries that made it startup. oh well, probably a randomly generated trojan name.

 

[pechenegs]

the dll actually looks like vundo!


Please download

http://www.atribune.org/ccount/click.php?id=4

to your desktop.
· Double-click VundoFix.exe to run it.
· Click the Scan for Vundo button.
· Once it's done scanning, click the Remove Vundo button.
· You will receive a prompt asking if you want to remove the files, click YES
· Once you click yes, your desktop will go blank as it starts removing Vundo.
· When completed, it will prompt that it will shutdown your computer, click OK.
· Turn your computer back on.


Go here and downlaod the latest version of java, once
downloaded, go to add/remove and uninstall all previous versions of java
from add/remove and then instlall the latest version you just downloaded!

http://java.com/en/download/manual.jsp

Member of ASAP Alliance of Security Analysis Professionals

under the name khazars

 

[ftechguy]

Hi pechenegs,
Thanks for that link--I never heard of vundo before.
I won't be able to give it a try though unfortunately, since the laptop has already been wiped but I'll save it for future reference.
Thanks again!