Can't get rid of suspected malware: rtdvgbk.exe

jtmccabe

Estimable
Jan 21, 2015
4
0
4,510
0
On 3/14/17, I installed ImgBurn freeware on a Win7 PC and picked up a ton of malware. I think I've removed or crippled most of it via various removal and monitoring tools, but I am uneasy because it seems something is still lingering. The machine seems to run fine, but in Task Manager I see 1-2 instances of something called "client". I think I've found the name of the executable behind "client" (rtdvgbk.exe), but I can't find the actual file anywhere.

Norton Power Eraser was the only tool I tried that found and claimed to delete the last of the malware. But after each reboot, "client" still appears. I've re-run NPE a few times and it always finds the same things but fails to permanently delete them.

Below are some clues I found that might help someone help me. Thanks in advance for any ideas.



 

jtmccabe

Estimable
Jan 21, 2015
4
0
4,510
0


Thanks for the advice. I'm trying the AVG Rescue CD now. I updated it with today's definitions and ran the first scan with the default settings. That didn't find anything, so now I'm doing a deeper scan with all the options enabled (e.g. scan inside archives, "paranoid mode", etc.). Looks like that will take a few hours.

Since my Google searches on some of the suspicious file names don't get any hits, I think I might be dealing with a brand new virus that most tools won't recognize. Either that, or I'm chasing a red herring and the system is virus-free.

Does my first screen shot above look suspicious to any experts out there, or is it possibly something harmless?
 

jtmccabe

Estimable
Jan 21, 2015
4
0
4,510
0


I did try the Malwarebytes standard AV software. I noticed the "real-time web protection" kept getting turned off. I'd try to turn it on and it would immediately get turned off again. I tried some suggested fixes for that but nothing worked. I also tried Malwarebytes Anti-Rootkit and that didn't find anything.

I have McAfee Endpoint Security installed on the machine but it won't even run. The Sophos Virus Removal Tool installer does nothing when I try to run it. The common theme is this virus either disables or outsmarts every tool I try.

Microsoft Security Essentials seemed to run okay but didn't find anything. Same with Microsoft Malicious Software Removal Tool. I think that's all I've tried so far. Again, Norton Power Eraser has been the only tool that seemed to partially succeed.

I'll keep trying things and report back when there's any news.
 

SumTingW0ng

Prominent
Aug 6, 2017
92
0
610
5


Boot into safe mode with networking to run disinfection tools or boot into live CD such as Kaspersky, Bitdefender, or Avast.
 

jtmccabe

Estimable
Jan 21, 2015
4
0
4,510
0
Over the past few days, I tried the AVG Rescue CD a few more times (updating it before each scan) but it never found anything. Today I decided to try the Bitdefender Rescue CD and it found the items listed below. I think the system is finally clean now, since I no longer see any of the suspicious software running.

COLGeek, thanks again for your advice!

====================================================
= Logging started on Fri 23 Mar 2018 09:14:19 AM UTC
====================================================

List of objects to be scanned:
- /run/media/livecd/LocalDisk

Object '/run/media/livecd/LocalDisk/Users/Administrator/AppData/Local/dtshnbk/dtshnbk.exe' is infected with 'Gen:Variant.Johnnie.75314'
Object '/run/media/livecd/LocalDisk/Windows/musicality.exe' is infected with 'Trojan.GenericKD.30411670'
Object '/run/media/livecd/LocalDisk/Windows/System32/drivers/dwsuybeh.sys' is infected with 'Application.Agent.BKV'

==================================================
= Applying actions
==================================================
Object '/run/media/livecd/LocalDisk/Users/Administrator/AppData/Local/dtshnbk/dtshnbk.exe' has been deleted
Object '/run/media/livecd/LocalDisk/Windows/musicality.exe' has been deleted
Object '/run/media/livecd/LocalDisk/Windows/System32/drivers/dwsuybeh.sys' has been deleted
 
Thread starter Similar threads Forum Replies Date
C Antivirus / Security / Privacy 4
T Antivirus / Security / Privacy 7
frostin71 Antivirus / Security / Privacy 4
Me. Opanak Antivirus / Security / Privacy 1
S Antivirus / Security / Privacy 1
DCB007 Antivirus / Security / Privacy 4
N Antivirus / Security / Privacy 5
Nighty_z Antivirus / Security / Privacy 5
Ginko-san Antivirus / Security / Privacy 37
K Antivirus / Security / Privacy 2
A Antivirus / Security / Privacy 1
T Antivirus / Security / Privacy 4
T Antivirus / Security / Privacy 1
V Antivirus / Security / Privacy 5
O Antivirus / Security / Privacy 1
AndrewFreedman Antivirus / Security / Privacy 3
H Antivirus / Security / Privacy 5
M Antivirus / Security / Privacy 2
Z Antivirus / Security / Privacy 5
D Antivirus / Security / Privacy 4

ASK THE COMMUNITY