BleepingComputer.com: I cannot log into Windows XP Home due to spy-agent.bw!mem infection

Hi,

My laptop has recently been infected by two instances of the Trojan spy-agent.bw!mem which were detected by a McAfee virus scan 5 days ago. Since that time, I have been struggling to log into Windows XP Home and desperately trying to find out how to get rid of these viruses, but with no luck...

The results of the McAfee scan:

Trojans

C:\WINDOWS\system32\twest.exe
Spy-Agent.bw!mem

C:\WINDOWS\system32\winlogon.exe
Spy-Agent.bw!mem

Status: termination failed.

When starting up, Windows XP hangs up at the log-in/select user screen. At first, I was able to get past the login screen and the computer stalled at the Desktop but with none of my desktop icons, start menu, etc...Initially, I was able to get past the blank desktop background by hitting cntrl-alt-del, bringing up the Command-line prompt in Task Manager, and then typing "C:\" at which time the following error message came up:

'/idlist,:0:3972, c:\
Windows can't find ‘/idlist,:0:3972, c:\’. Make sure you typed the name correctly, and then try again. To search a file, click the Start button, and then click Search.'

Now, that won't even work. When I tried to start my computer yesterday and this morning on numerous occasions, when I turn on the computer, Windows XP Home never gets past the log-in page where you select the user. Whether I select my user name or the Administrator, it logs in for a few seconds, at which time I see the desktop for a second, but then it immediately logs off again, and I'm back at the log-in screen.

The results of the last McAfee scan that was run before my computer stopped getting past the log-in/select user screen, it stated that it had detected 5 items of which 3 were quarantined and 2 remain, Would you please guide me as to how I should proceed to eradicate these little pests from my computer so I can log in?

The results of the DSS scan is as follows:

DDS (Ver_09-10-26.01) - NTFSx86
Run by Liam Zaidel at 19:18:16.28 on Wed 10/28/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.81 [GMT -7:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Liam Zaidel\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
mWinlogon: userinit=c:\windows\system32\sdra64.exe,
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\liamza~1\startm~1\programs\startup\wirele~1.lnk - c:\program files\linksys\wireless-g notebook adapter with srx utility\lcu.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~2.lnk - c:\program files\linksys\wusb100\WUSB100.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\liamza~1\applic~1\mozilla\firefox\profiles\82x10j67.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\documents and settings\all users\application data\google\toolbar for firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
FF - component: c:\documents and settings\all users\application data\google\toolbar for firefox\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-6-10 210216]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2007-7-28 517632]
S3 TNET1130x;Wireless-G Notebook Adapter v.2.0;c:\windows\system32\drivers\tnet1130x.sys --> c:\windows\system32\drivers\tnet1130x.sys [?]

=============== Created Last 30 ================

2009-10-28 17:29:27 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

==================== Find3M ====================

2009-09-16 17:22:48 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 17:22:48 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 17:22:48 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 17:22:48 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 17:22:14 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-05 09:01:48 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 03:44:46 2189184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-08-04 14:20:08 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe

============= FINISH: 19:19:18.11 ===============


I attached the results of the GMER Rootkit Scanner and 1 other document related to the DDS scan as recommended on other virus removal tech assistance forums--I ran before them before it became impossible to log into Windows XP.

Thank you very much in advance,
Liam

Hello my name is Sempai and welcome to Bleeping Computer.

Hi,

Do you have a Windows XP cd? We will be needing it to fix your log in problem, if you don't have it please do the instructions below:

• Please download the rc.iso file HERE.
  
• Burn it to a cd using "copy image to disk" or "burn iso".

Please tell me if you have provided the XP cd so we can start fixing your problem.


~Semp

Hi Sempai,

Thank you for helping me with this!! Yes, I have the XP CD--it's for service pack 2 instead of 3 which is the most current version installed on the computer, but perhaps this makes no difference.

I should mention that I was really desperate to save the important documents on this hard drive so I piggy-backed it to a healthy computer hard drive, and fortunately was able to copy over the Documents and Settings folder. I also got desperate and ran the ComboFix.exe file as was suggested in other posts by people with similar problems as I have (e.g., Spy-agent.bw!mem.exe, keeps logging off at log-in screen) because I tried posting this problem on another spyware/malware help forum, and nobody has responded in 4 day. I ran ComboFix on the infected drive when it was piggybacked on my tower with the healthy harddrive, and I hope I didn't screw anything up by doing so. I will attach the ComboFix log file here. I replaced the infected hard-drive back in the laptop, and after starting up, the same logging-in-and-logging-off-right-away problem recurs, unfortunately.

Please have mercy on me. I await your reply.

Thank you,

Liam

Hi Liam,

I understand the feeling of waiting for help and we are sorry for such delay, forum have been extremely busy due to numerous members asking for help. Please do not perform any actions unless i instructed you to do so, this will possibly hinder our cleaning process.

Also be careful on creating a back up. Do not backup any programs/applications/installers like .exe, .scr, .htm, .html, .xml, .zip/.rar files...
The reason for this is because these files may be infected also. If you replace them after we clean your computer, it will surely reinfect you again.

I am creating a fix for you and will post them ASAP.


~Semp

Hi,

We need to use the Recovery Console.

• You'll need to find your Windows XP installation disk.
  
• Insert the Windows XP CD into the CD-ROM drive, then restart your computer.
  
• If prompted, click any options that are required to start the computer from the CD-ROM drive.
  
• When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  
• The Recovery Console will start and ask you which Windows installation you would like to log on to.
  
  If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press enter.
  
  
• It will then prompt you for the Administrator's password. If there is no password, simply press enter.
  
• You will now be presented with a C:\Windows> prompt
  
• At the comand prompt window, type exactly the bolded text below the way I posted them one at a time then press Enter . (The d after the word expand is the drive letter to your CDROM. If it's different on your computer, please make the necessary adjustment).
  
  
  ren c:\windows\system32\winlogon.exe winlogon.exe.old
  
  del c:\windows\system32\sdra64.exe
  
  expand d:\i386\userinit.ex_ c:\windows\system32\sdra64.exe /y
  
  expand d:\i386\userinit.ex_ c:\windows\system32\userinit.exe /y
  
  expand d:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe /y
  
  
  
• You should get notified that the file is expanded.
  
• type exit to exit the command prompt and restart your computer.

Note: Please be careful with the following spaces like "expand d", "ex_ c" and "exe /".


Please let me know if you can now logon to windows.

~Semp

Hi Semp,

Thank you--I was able to log into Windows!! Some strange things happened along the way though...

The first command "ren c:\windows\system32\winlogon.exe winlogon.exe.old" worked initially as the files showed up in the Windows32 directory. But I had to shut down because I had to take the computer to another location. After relocating a few hours later, starting up and going into the windows recovery console, when I checked the Windows32 directory, neither "winlogon.exe" nor "winlogon.exe.old" were in the directory anymore--strange!

The "del c:\windows\system32\sdra64.exe" command didn't work because the file "sdra.exe" was not recognized--I then checked to see if it was in the directory, and it wasn't there--weird!

The "expand" commands you gave me ran, but for some reason "0 files were copied" after each command. So, I tried your same commands but with "copy" instead of "expand" and without the "/y" at the end, and the files showed up in the directory.

copy d:\i386\userinit.ex_ c:\windows\system32\sdra64.exe

copy d:\i386\userinit.ex_ c:\windows\system32\userinit.exe

copy d:\i386\winlogon.ex_ c:\windows\system32\winlogon.exe

Then, I exited, and rebooted from the HD, and it worked!


I want to thank you very much for your help so far!

Now what?!

Liam

Hi Liam,

Well done. We can now begin with the cleaning process. Please stay with me until I declare that your computer is clean as most users don't reply anymore once they found that their computer is running smoothly but absence of symptoms does not mean that a computer is free from infection.


1. Launch Notepad, and copy/paste the content of the code box below into a new text file. Save it on your C:\ drive as fixme.reg. For the "save as type" choose all files

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

• Locate fixme.reg on your Desktop and double-click on it.
  
• You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
  
• Answer "Yes" and wait for a message to appear similar to "Merged Successfully".

2. Please download Malwarebytes' Anti-Malware from here:




3. We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download
    • Primary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
  
  
• Open on your desktop.
  
• Click the tab.
  
• Click the button.
  
• Check all seven boxes:
  
• Push Ok
  
• Check the box for your main system drive (Usually C:), and press Ok.
  
• Allow RootRepeal to run a scan of your system. This may take some time.
  
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply.

4. Please create a new DDS log. Post it together with the results of MBAM and Rootrepeal when you reply.


~Semp

Hi Semp,

Thank you again for your patience with this Looks like MBAM caught a bunch of sewer rats lurking on this computer, and removed them. I pasted the results of the DDS scan, MBAM, and RootRepeal here. Please let me know if you'd like me to attach the additional file that was produced from the DDS scan called "Attach.txt".

The results of the DDS scan are as follows:

DDS (Ver_09-10-26.01) - NTFSx86
Run by Liam Zaidel at 13:41:30.62 on Tue 11/03/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.121 [GMT -8:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Liam Zaidel\Desktop\gmer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Liam Zaidel\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
mURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\liamza~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\liamza~1\startm~1\programs\startup\wirele~1.lnk - c:\program files\linksys\wireless-g notebook adapter with srx utility\lcu.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wirele~2.lnk - c:\program files\linksys\wusb100\WUSB100.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\liamza~1\applic~1\mozilla\firefox\profiles\82x10j67.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-6-10 210216]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2007-7-28 517632]
S3 TNET1130x;Wireless-G Notebook Adapter v.2.0;c:\windows\system32\drivers\tnet1130x.sys --> c:\windows\system32\drivers\tnet1130x.sys [?]

=============== Created Last 30 ================

2009-11-03 20:38:21 0 d-----w- c:\docume~1\liamza~1\applic~1\Malwarebytes
2009-11-03 20:38:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-03 20:38:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-03 20:38:13 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-11-03 20:38:12 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-01 13:13:24 507904 ----a-w- c:\windows\winlogon.exe.old
2009-10-30 22:37:57 3430299 ----a-r- C:\ComboFix.exe
2009-10-30 05:53:48 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-10-30 05:53:48 215920 ----a-w- c:\windows\system32\muweb.dll
2009-10-30 05:53:48 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2009-10-30 00:15:19 0 d-----w- c:\program files\Microsoft
2009-10-30 00:14:50 0 d-----w- c:\program files\Windows Live SkyDrive
2009-10-30 00:11:33 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-10-30 00:11:05 0 d-----w- c:\program files\Nikon
2009-10-30 00:11:03 0 d-----w- c:\program files\common files\Nikon
2009-10-30 00:10:44 0 d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-10-30 00:00:16 0 d-----w- c:\program files\common files\Windows Live
2009-10-28 17:29:27 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

==================== Find3M ====================

2009-10-11 12:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-16 17:22:48 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 17:22:48 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 17:22:48 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 17:22:48 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 17:22:14 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-11 14:18:39 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03:36 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 08:08:21 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-26 08:00:21 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-20 22:09:06 1193832 ----a-w- c:\windows\system32\FM20.DLL

============= FINISH: 13:42:54.24 ===============


The RootRepeal resuls are as follows:

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/11/03 14:04
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xBA077000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8BE2000 Size: 8192 File Visible: No Signed: -
Status: -

Name: kftiqkoc.sys
Image Path: C:\DOCUME~1\LIAMZA~1\LOCALS~1\Temp\kftiqkoc.sys
Address: 0xB8C39000 Size: 87040 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xB9AA0000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: c:\documents and settings\liam zaidel\local settings\application data\mozilla\firefox\profiles\82x10j67.default\urlclassifier3.sqlite
Status: Allocation size mismatch (API: 23724032, Raw: 23396352)

Path: c:\documents and settings\liam zaidel\local settings\application data\mozilla\firefox\profiles\82x10j67.default\cache\_cache_001_
Status: Size mismatch (API: 375720, Raw: 375203)

Path: C:\Documents and Settings\Liam Zaidel\Local Settings\Application Data\Mozilla\Firefox\Profiles\82x10j67.default\Cache\115EF8DFd01
Status: Visible to the Windows API, but not on disk.

==EOF==

The MBAM results are as follows:

Malwarebytes' Anti-Malware 1.41
Database version: 3094
Windows 5.1.2600 Service Pack 3

11/3/2009 12:48:53 PM
mbam-log-2009-11-03 (12-48-53).txt

Scan type: Quick Scan
Objects scanned: 104542
Time elapsed: 6 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wsaupdater.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.


There are several entries in the MBAM results log that are alarming because of the words "(stolen data)" at the end of the lines. Does this suggest personal data was stolen?

Thank you

Liam

Hi Liam,

Quote

We don't know for sure, that is the name given to the trojan. If any sensitive data is stolen or not, we can't say. To be on the safe side it is better to take the needed steps.

***********************

We need to settle some issues before we go to the cleaning process:






1. Please go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
  
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  
• When the downloads have finished, click on Settings.
  
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  
  
  
• Click on My Computer under Scan.
  
• Once the scan is complete, it will display the results. Click on View Scan Report.
  
• You will see a list of infected items there. Click on Save Report As....
  
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  
• Please post this log in your next reply .

~Semp

Hi Semp,

I plan to make sure all of my documents are copied over to another hard-drive, and then I will do a reformat and reinstall of the OS to be safe. But I decided to to a Kaspersky scan in the mean time.

Here are the results of the Kaspersky online scanner report:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, November 4, 2009
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, November 04, 2009 20:13:52
Records in database: 3132776
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Objects scanned: 33430
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 01:56:56

No threats found. Scanned area is clean.

Selected area has been scanned.

I read the article that you gave me the link to, but I'm still not completely clear on the risk posed if the backdoor trojan has been removed from my computer. Might the hacker still be able to access my computer anyway despite there being no backdoor trojan anymore? If so, how can this occur exactly? Might they have settings information about my computer that they obtained when the backdoor trojan was installed that would allow them to re-access my computer remotely should the computer remain on, or is my understanding of the way in which it's a risk post-removal of the trojan not correct?

Thank you,
Liam

Hi Liam,

Quote

Because backdoor trojans have the potential to gain such complete control of a system, and install malicious code that may not be detectable by the tools that we have used. Reformatting is not mandatory, I am just giving you some options and insight of the potential risk. Honestly giving a backdoor warning for me is difficult after the hard work that we've done, but all our help will be useless if you are not aware of the risk of backdoor.


Anyway your log is clean. If in case you will not reformat you will need to perform some housekeeping.


1. First and most important is change all your offline and online passwords. It is possible that they were stolen because of the backdoor infection.


2. Uninstall Combofix

• The following will implement some cleanup procedures as well as reset System Restore points:
  
• Click Start > Run and copy/paste the following bolded text into the Run box and click OK:
  
  ComboFix /Uninstall

3. Download TFC to your desktop (TFC only cleans temp folders. It will not clean URL history, prefetch, or cookies).



4. Your Log is Clean, please take the time to read below to secure your machine and take the necessary steps to keep it Clean





Thanks to farbar who is also working on this log behind the scene.

With regards,
~ Semp

Hi Semp and Farbar,

I want to thank you very much for all of your help!! I still haven't decided whether or not to do a complete reinstall and reformat of this drive yet... but either way, I'll keep referring to these tools you provided to me in case I encounter future malware problems.

Thanks again,
Liam

You are very much welcome. Glad we could help.

~Semp

This thread will now be closed since the issue seems to be resolved.

If you need this topic reopened, please send me a PM and I will reopen it for you.

If you should have a new issue, please start a new topic.