It all started with executing a suspicious file that in turn installed several infections on my laptop. I used Malwarebytes' Anti-Malware and AVG in efforts to get it under control, but one particular infection kept eluding me, and neither of the programs would give me a clear answer as to what the infections were nor pinpoint and eliminate the source. ComboFix and then SUPERAntiSpyware eventually helpfully told me there were traces of the Seneka malware. I then proceeded to attempt to reinstall Windows, and even format the hard drive and reinstall Windows, but somehow, it kept coming back. I found out it was reinstating itself whenever I installed my backed up wireless drivers, so apparently it was hiding in there. I reinstalled Windows and re-downloaded my wireless drivers from Dell. For a bit, everything was fine. Then I loaded in one of my programs that I backed up after the infection, and was thrown back into an infected state.
A few things I noticed about the infection:
1) It seems to be a strain that is better at disguising the files it uses to reinstate itself (other Seneka-related posts said to look for an installed "driver" with certain prefixes, which aren't evident on my laptop).
2) No virus scan or malware scan that I've ran so far will pick up any indication that backed up files are contaminated with the dormant malware (scans passed off both my drivers and the backed up program as clean).
3) Symptoms include repeated messages from Windows Data Protection blocking RUNDLL32.EXE and EXPLORER.EXE from running (about 25-50% of the time), and making me log in through a Username and Password prompt before Windows starts even though there is only one profile on my machine and it is not currently set up to go to such a prompt. It also frequently tries to use a C:\Windows\Services.exe file as part of the infection. In the event Explorer won't start, I can run ComboFix through the Task Manager, and this usually brings Explorer back (when it doesn't reboot). Though ComboFix doesn't always detect something... see #5.
4) It seems to come back in multiple forms: I've had Vundo, Rustock.G, Seneka, Sheur2.OCF, Virut.AJ.Dropper and HTML/Framer detected by my Anti-Virus and Anti-Spyware programs, among other more generic names.
5) I can run an Anti-Virus or Anti-Spyware program at times and it will detect absolutely nothing, even in the case that Explorer is blocked from running! Other times, it will detect infections and eliminate them, usually asking me to reboot, which may or may not bring me back to a Windows which gives the symptoms described in #3.
6) Disabling my Internet Connection occasionally allows me to reduce the infection down to a minimum, but as soon as I connect to the Internet again, no matter how many clean scans I was given beforehand and despite the presence of the Windows Firewall, the malware's hidden subroutine activates and everything is reinstated.
Here are the things I need to know:
1) What I'm infected with
2) How to remove the infection permanently
3) How to recognize if my backed-up programs carry the dormant malware before I run them, and a way to clean them
Logs are as follows:
DDS (Ver_09-02-01.01) - NTFSx86
Run by Zorpheus at 16:45:55.43 on Fri 02/06/2009
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1489 [GMT -5:00]
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\9f68a7cb-a121-4aeb-9122-102924fb38b6.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\Zorpheus\Desktop\dds.scr
============== Pseudo HJT Report ===============
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\9f68a7cb-a121-4aeb-9122-102924fb38b6.exe
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: avgrsstarter - avgrsstx.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\zorpheus\applic~1\mozilla\firefox\profiles\r32u64zq.default\
============= SERVICES / DRIVERS ===============
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-2-5 325128]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-2-5 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-2-5 107272]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-15 55024]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-2-5 903960]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-2-5 298264]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-15 7408]
S1 ethecynu;ethecynu;c:\windows\system32\drivers\ethecynu.sys --> c:\windows\system32\drivers\ethecynu.sys [?]
S1 ethfdqxv;ethfdqxv;c:\windows\system32\drivers\ethfdqxv.sys --> c:\windows\system32\drivers\ethfdqxv.sys [?]
S1 ethkitqx;ethkitqx;c:\windows\system32\drivers\ethkitqx.sys --> c:\windows\system32\drivers\ethkitqx.sys [?]
S1 ethlguly;ethlguly;c:\windows\system32\drivers\ethlguly.sys --> c:\windows\system32\drivers\ethlguly.sys [?]
S1 ethmakex;ethmakex;c:\windows\system32\drivers\ethmakex.sys --> c:\windows\system32\drivers\ethmakex.sys [?]
S1 ethmkpzu;ethmkpzu;c:\windows\system32\drivers\ethmkpzu.sys --> c:\windows\system32\drivers\ethmkpzu.sys [?]
S1 ethognsw;ethognsw;c:\windows\system32\drivers\ethognsw.sys --> c:\windows\system32\drivers\ethognsw.sys [?]
S1 ethoyvdk;ethoyvdk;c:\windows\system32\drivers\ethoyvdk.sys --> c:\windows\system32\drivers\ethoyvdk.sys [?]
S1 ethphvcu;ethphvcu;c:\windows\system32\drivers\ethphvcu.sys --> c:\windows\system32\drivers\ethphvcu.sys [?]
S1 ethpvoug;ethpvoug;c:\windows\system32\drivers\ethpvoug.sys --> c:\windows\system32\drivers\ethpvoug.sys [?]
S1 ethqpcyc;ethqpcyc;c:\windows\system32\drivers\ethqpcyc.sys --> c:\windows\system32\drivers\ethqpcyc.sys [?]
S1 ethtcnox;ethtcnox;c:\windows\system32\drivers\ethtcnox.sys --> c:\windows\system32\drivers\ethtcnox.sys [?]
S1 ethtnrhc;ethtnrhc;c:\windows\system32\drivers\ethtnrhc.sys --> c:\windows\system32\drivers\ethtnrhc.sys [?]
S1 ethulaik;ethulaik;c:\windows\system32\drivers\ethulaik.sys --> c:\windows\system32\drivers\ethulaik.sys [?]
S1 ethxnhfv;ethxnhfv;c:\windows\system32\drivers\ethxnhfv.sys --> c:\windows\system32\drivers\ethxnhfv.sys [?]
S3 dofxquxg;dofxquxg;\??\c:\windows\system32\drivers\dofxquxg.sys --> c:\windows\system32\drivers\dofxquxg.sys [?]
S3 iqgjnnqb;iqgjnnqb;\??\c:\windows\system32\drivers\iqgjnnqb.sys --> c:\windows\system32\drivers\iqgjnnqb.sys [?]
=============== Created Last 30 ================
2009-02-06 16:24 179,712 a------- c:\windows\SWREG.exe
2009-02-06 16:24 116,224 a------- c:\windows\sed.exe
2009-02-06 16:10 324,096 a------- c:\windows\IsUninst.exe
2009-02-06 15:45 <DIR> --d----- c:\windows\system32\CatRoot_bak
2009-02-06 15:45 <DIR> --d----- c:\windows\system32\LogFiles
2009-02-06 05:01 <DIR> --d----- c:\windows\pss
2009-02-06 04:30 67,585 a------- c:\windows\system32\EB.tmp
2009-02-06 04:26 163,652 a------- c:\windows\system32\E9.tmp
2009-02-06 04:26 168 a------- c:\windows\system32\E8.tmp
2009-02-06 03:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-02-06 03:26 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-02-06 03:26 <DIR> --d----- c:\docume~1\zorpheus\applic~1\SUPERAntiSpyware.com
2009-02-06 03:11 32,768 a---h--- c:\documents and settings\zorpheus\lctj.exe
2009-02-06 03:11 67,585 a------- c:\windows\system32\DF.tmp
2009-02-06 03:10 32,768 a---h--- c:\documents and settings\zorpheus\tuybky.exe
2009-02-06 03:10 66,560 ----h--- c:\windows\system32\secupdat.dat
2009-02-06 03:10 616 a------- c:\windows\system32\DD.tmp
2009-02-06 03:10 67,585 a------- c:\windows\system32\DB.tmp
2009-02-06 03:08 162,948 a------- c:\windows\system32\D9.tmp
2009-02-06 03:08 168 a------- c:\windows\system32\D8.tmp
2009-02-06 03:08 <DIR> --d-h--- C:\$AVG8.VAULT$
2009-02-06 03:07 162,948 a------- c:\windows\system32\C9.tmp
2009-02-06 03:07 168 a------- c:\windows\system32\C8.tmp
2009-02-05 18:00 <DIR> --d----- c:\program files\uTorrent
2009-02-05 17:59 <DIR> --d----- c:\program files\Peach Princess
2009-02-05 17:58 <DIR> --d----- c:\program files\3D Custom Girl
2009-02-05 17:50 <DIR> --d----- C:\dawn
2009-02-05 17:50 <DIR> --d----- C:\PSXsound
2009-02-05 17:46 <DIR> --d----- C:\illusion
2009-02-05 17:46 <DIR> --d----- C:\downloads
2009-02-05 17:40 <DIR> --d----- C:\MegaTen
2009-02-05 17:40 <DIR> --d----- C:\Battle Arena Toshinden 3
2009-02-05 17:39 <DIR> --d----- C:\OpenRPG
2009-02-05 17:28 <DIR> --d----- C:\NeverwinterNights
2009-02-05 17:27 <DIR> --d----- C:\mIRC
2009-02-05 17:18 107,272 a------- c:\windows\system32\drivers\avgtdix.sys
2009-02-05 17:18 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-02-05 17:18 325,128 a------- c:\windows\system32\drivers\avgldx86.sys
2009-02-05 17:18 <DIR> --d----- c:\windows\system32\drivers\Avg
2009-02-05 17:18 <DIR> --d----- c:\program files\AVG
2009-02-05 17:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-02-05 17:14 45,568 a----r-- c:\windows\system32\drivers\bcm4sbxp.sys
2009-02-05 17:14 <DIR> --d----- c:\program files\Broadcom
2009-02-05 17:12 217,088 a----r-- c:\windows\system32\UCI32M21.dll
2009-02-05 17:12 94,208 a----r-- c:\windows\system32\mdmxsdk.dll
2009-02-05 17:12 12,672 a----r-- c:\windows\system32\drivers\mdmxsdk.sys
2009-02-05 17:12 <DIR> --d----- c:\program files\CONEXANT
2009-02-05 17:12 989,952 a----r-- c:\windows\system32\drivers\HSF_DPV.sys
2009-02-05 17:12 731,136 a----r-- c:\windows\system32\drivers\HSF_CNXT.sys
2009-02-05 17:12 211,200 a----r-- c:\windows\system32\drivers\HSFHWAZL.sys
2009-02-05 17:09 <DIR> --d----- c:\windows\system32\NtmsData
2009-02-05 16:41 <DIR> --d----- c:\windows\system32\AGEIA
2009-02-05 16:40 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-02-05 16:40 453,152 a------- c:\windows\system32\nvuninst.exe
2009-02-05 16:40 453,152 a------- c:\windows\system32\nvudisp.exe
2009-02-05 16:40 206,530 a------- c:\windows\system32\nvapps.xml
2009-02-05 16:40 18,725 a------- c:\windows\system32\nvdisp.nvu
2009-02-05 16:40 <DIR> --d----- c:\windows\nview
2009-02-05 16:36 <DIR> --d----- c:\program files\Synaptics
2009-02-05 16:35 54,272 ac------ c:\windows\system32\dllcache\swmidi.sys
2009-02-05 16:35 <DIR> --d----- c:\program files\SigmaTel
2009-02-05 16:33 <DIR> --d----- c:\windows\system32\SoftwareDistribution
2009-02-05 16:30 <DIR> --d----- c:\program files\Dell
2009-02-05 16:29 26,496 ac------ c:\windows\system32\dllcache\usbstor.sys
2009-02-05 16:27 <DIR> --d----- c:\documents and settings\Zorpheus
2009-02-05 16:27 <DIR> --ds---- c:\windows\system32\Microsoft
2009-02-05 15:54 8,192 a------- c:\windows\REGLOCS.OLD
2009-02-05 15:52 101,376 ac------ c:\windows\system32\dllcache\srusbusd.dll
2009-02-05 15:51 29,696 ac------ c:\windows\system32\dllcache\admexs.dll
2009-02-05 15:50 23,392 a------- c:\windows\system32\nscompat.tlb
2009-02-05 15:50 16,832 a------- c:\windows\system32\amcompat.tlb
2009-02-05 15:50 316,640 a------- c:\windows\WMSysPr9.prx
2009-02-05 15:50 <DIR> --dsh--- c:\documents and settings\all users\DRM
2009-02-05 15:49 <DIR> --d-h--- c:\program files\WindowsUpdate
2009-02-05 15:48 <DIR> --d----- c:\program files\common files\MSSoap
2009-02-05 15:47 <DIR> --d----- c:\program files\Online Services
2009-02-05 15:47 <DIR> --d----- c:\program files\Messenger
2009-02-05 15:47 <DIR> --d----- c:\program files\MSN Gaming Zone
2009-02-05 15:46 <DIR> --d----- c:\program files\Windows NT
2009-02-05 03:49 <DIR> --d----- c:\program files\common files\ODBC
2009-02-05 03:49 <DIR> --d----- c:\program files\common files\SpeechEngines
2009-02-05 03:49 <DIR> --d--r-- c:\documents and settings\all users\Documents
==================== Find3M ====================
2009-02-05 15:50 87,263 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-02-05 15:47 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-12-10 09:45 70,936 a------- c:\windows\system32\PhysXLoader.dll
2008-12-04 09:28 24,344 a------- c:\windows\system32\PhysXDevice.dll
2008-11-26 08:55 288,024 a------- c:\windows\system32\PhysXCplUI.exe
2008-11-25 08:38 288,024 a------- c:\windows\system32\PhysXCompatCplUI.exe
============= FINISH: 16:46:12.53 ===============
Attached Files
Edited by Zorpheus, 06 February 2009 - 05:41 PM.