Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Backdoor.Bot.Q & Trojan.Agent by MBAM


  • Please log in to reply
11 replies to this topic

#1 black069

black069

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 03 May 2009 - 02:21 AM

My desktop computer has been infected with the 2 bugs below:

April 17: Files infected=1 C:\WINDOWS\SYSTEM32\DLL32.DLL (Backdoor.Bot.Q) --> Quarantined and deleted successfully.

April 21: Registry keys infected=1 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Trojan.Agent) --> Quarantined and deleted successfully.

I didn't realize there were bugs for several days; I just happened to look at the logs. (My wife tends to close the scan results if nothing jumps out at her.) MBAM did not know what to do with the bugs so the log read "No action taken." I quarantined and removed immediately. I then googled the bugs, and not much out there. I could not find any specific steps for malware removal. A couple sources said that all of my personal information should be considered breached, so I changed all passwords, credit card, etc. It also said that the best course of action would be to back up my data files on an external hard drive, and then re-install windows.

I do have an external hard drive, but I have never re-installed Windows before. The most I have done is a system restore. I do have all the original installation disks, but I don’t know in what order to do things, how to make sure the system is clean once it’s time to reinstall windows, etc.

As for symptoms, I don’t know where to start. First of all, when I try to boot into Safe Made (F8), I get a black-and-white screen saying “Keyboard failure” and my keyboard nor mouse works at all. I then have to manually shut down by hitting power button. But then the 2nd time I try to boot into Safe Mode, it works. This pattern occurs every time I try. Also, as soon as Windows boots, I get an error message stating that WCES is unable to activate (due to an error code). Lots of error msgs. Also, Office 2003 Suite does not seem to be recognized.


The affected computer is my desktop (Dell Dimension 4550) running Windows XP Home SP3. I also have a laptop (Dell Precision M6300 with wireless high speed internet connection) which is working fine that I could use to transfer any software, etc. over to the affected computer (if it is unsafe to download anything using the desktop computer).

I did not post a HiJackThis log because I don’t know if that is the correct avenue to take. In other words, I don’t know if it’s necessary to perform extensive malware removal/diagnosis on a system for which the OS is going to be re-installed anyway. Please let me know if I am incorrect about this, and I will be happy to post a HJT (or any other type of) log.


Thanks in advance!

PS As for security, I use AVG 8.5 Free, Malwarebytes’ Anti-Malware, and SuperAntiSpyware. I also have SpywareBlaster and Windows XP Firewall.

Edited by Orange Blossom, 30 May 2009 - 08:25 PM.
Removed font changes for ease of reading. ~ OB



BC AdBot (Login to Remove)

 


#2 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:12 PM

Posted 05 May 2009 - 07:17 PM

Registry keys infected=1 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Trojan.Agent) --> Quarantined and deleted successfully.

That means they should have been removed

Update Mbam and run a full scan and post the results
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#3 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 06 May 2009 - 08:45 AM

I also had the following bug (in addition to the one you listed):

Files infected=1 C:\WINDOWS\SYSTEM32\DLL32.DLL (Backdoor.Bot.Q) --> Quarantined and deleted successfully.

So even though these 2 bugs sat on my computer for several days, as long they are quarantined and deleted and then a subsequent scan shows that the system is clean, then I don't have to worry about damage that the bugs might have done before I quarantined them? Is that what you are saying? (Just to clarify.)

But also, I have the issue I described whereby I tried to use the Windows Installer CleanUp Utility (
http://support.microsoft.com/kb/290301) to remove all those old installation files that were taking up so much space on my hard drive. In the description of this utility, it states, "You can use the utility to remove installation information for programs that were installed by using Windows Installer. Be aware that Windows Installer CleanUp Utility will not remove the actual program from your computer. However, it will remove the installation files so that you can start the installation, upgrade, or uninstall over." But when I used the utility, it wiped out Microsoft Word, Excel, and Powerpoint (2003) completely, although my .doc, .xls, and .ppt files are still present (but without any program to open them up).

In addition, my System Standby/Hibernate functions have not worked for many, many months (please refer to my only other active topic on Bleeping Computer), plus many other issues I mentioned in my first post.

So, I guess my question is with all that is going on, do you think it might be easier to start from scratch (which I've never done) or to try to fix each of the existing issues one by one?

Thanks for your help.



#4 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:12 PM

Posted 06 May 2009 - 06:05 PM

as long they are quarantined and deleted and then a subsequent scan shows that the system is clean, then I don't have to worry about damage that the bugs might have done before I quarantined them?

Viruses do not damage the computer per se. It will attach to certain files and sometimes during the removal process, a good file is removed when it shouldn't have. That is the whole purpose of the quarantine folder. It can be retrieved to get the computer running again and then you would have to find another method for removal


Yes, you should have read the Windows Installer Cleanup Utility documentation more closely. It should not be used with MS Office products

I can't seem to find your other topic that you are referring to, but many standby/hibernate problems are caused by a corrupt video driver
Removing/reinstalling solves the problem


although my .doc, .xls, and .ppt files are still present (but without any program to open them up).

Open Office is free and compatible with MS Office docs.
http://download.openoffice.org/
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 09 May 2009 - 11:30 PM

Thanks for the explanation.

Sorry about the "Standby/Hibernate" reference; I actually posted that to a forum on a different site before I found out how great B.C. is.

So, let's just assume I wanted to reinstall windows (I've talked to several folks who say that they reinstall windows every x # of months, ranging from 9-24, because they say over time, things accumulate in the registry and/or hard drive...things that are unable to clean with programs like CCleaner or b/c it would take much longer to clean out all the "gunk" than the 3-4 hours it takes to reinstall windows.) I have never reinstalled windows before, but I have a general idea of what I need to do. But is there a good step-by-step guide on B.C. or anywhere else online. And preferably not one for IT pros nor newbies, but for a regular user with a below-average knowledge base of computers and a well-below-average IQ (approximately equivalent to that of a head of cabbage). :thumbsup:

To give you an idea, perhaps, I do know how to transfer my data files to an external hard drive. And I know that I need to use the CD-ROM's from the factory to reinstall the OS and the drivers. And to update to current versions via Windows Update and Dell's support site for drivers/downloads. And download all of my non-OEM software from the net.

But I don't know how to DELETE the current settings, files, and OS (called "wiping" maybe?). And I don't know what order I need to do things in. Nor do I know, for example, at what point I should enable Windows Firewall (if at all), and the same for the resident protection of antivirus software. And I remember hearing a while ago someone speak of taking an "image" (I think) of their current applications, configurations, etc.; perhaps Ghost-something??? But I don't know how useful this is to configuring to the way it was prior.

And last, but not least, what about programs like ERUNT, Windows Backup Utility, SpywareBlaster, etc. that can save registry settings, everything, or in the case of the latter, a "System Snapshot". I've never used any of these used during a reinstall, but I do have all 3 programs. Would having a picture of the old registry settings, for example, help me in some way?

Most importantly, I want to maximize (as opposed to screw up) the functioning the boot-up process (i.e. loading Windows, having the BIOS do its BIOSing,etc.). In other words, I want the computer to power up quickly, like it did originally. So any pearls of wisdom would be greatly appreciated.

Oh, one potential problem is that the computer is a Dell Dimension 4550, which was purchased in 2002 and had all original hardware until 2 years ago, when I purchased the following. So I'm not sure how that would affect the reinstall, for example, when I am installing drivers from the original factory CD-ROM and get to the point where it's time to install graphics card driver. Would I just take out the factory CD while I install the driver for the new graphics card, and then put the factory CD back in?
(1) new monitor
(2) new graphics card
(3) more RAM
(4) a wireless router
(5) Microsoft Office 2003 Suite

I'm sure such pearls and everything I need to know (without taking any shortcuts that would end up making things slower 4 months from now) has to exist online. I just don't know where to look (more accurately stated, "whom I can trust").

Anyway, if anyone knows of a good step-by-step guide of how to go all the way from a slow junky tugboat (the point where I am now) all the way to a refurbished and polished tugboat, please let me know.

It could very well be on a "tutorial" on B.C., but if it is, I could not locate it.

Thanks to all who read this and even think about providing a response or not. If it were me, I indeed would respond even to a head of cabbage, because are they really doing the world much good? Absolutely.



#6 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:12 PM

Posted 10 May 2009 - 07:08 PM

Actually with a Dell it's pretty painless
Most Dells come with a recovery partition
All you need is the driver for the video card you put in

http://support.dell.com/support/topics/glo...lang=en&cs=
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#7 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 29 May 2009 - 04:41 AM

Garmanma,



I assume that you are referring to the 'Run Dell's PC Restore by Symantec to Restore Default Settings' utility in your link.



I contacted Dell to ask how one can tell if their computer is equipped with this feature. The tech said that the Dell Dimensions should all have it, but a net search revealed that MOST Dimension systems have the feature (btw, my system is from late 2002). I found out that the Dell PC Restore is supposed to be located in a separate (hidden) partition on the C: drive. So I'm not sure if my system has it. The article instructs to press and hold Ctrl when the Dell logo appears, then press F11, then release both at the same time. I have tried numerous times. The problem (I think) is that either I don't have the feature or I don't have the timing correct for pressing/releasing the keys or I've done something to screw up access to the utility. When I do the Ctrl-F11, one of 2 things happens: (1) nothing and it proceeds to the next startup screen as normal; or (2) a black screen with text (see below) appears, telling me that I have an error with either my mouse and/or my driver (in which cases they don't work at all), forcing me to shut down by pressing 'Power' button.


Phoenix ROM BIOS Plus Version 1.10 A08

Copyright 1985-1988 Phoenix Technologies Ltd.

Copyright 1990-2003 Dell Computer Corporation

All Rights Reserved



Dell System Dimension 4550 Series

www.dell.com



Error 8602 ' Auxiliary Device Failure

[and/or]

Keyboard failure

So does anybody know how I can tell if I have this utility? And if so, how to access it. Or is it THAT bad to use the CD-ROMs that were shipped with the computer to install Windows XP SP1 and then download the upgrades, etc., etc? How much time would each of the ways take? (I've spent probably 10 hours already just trying to figure out HOW to reinstall windows.)


Thanks,

Edited by Orange Blossom, 30 May 2009 - 08:30 PM.
Removed font coding for ease of reading. ~ OB



#8 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:12 PM

Posted 30 May 2009 - 08:19 PM

The key combination can be rather tricky
To make sure you have the partition go to Control Panel>Administrative Tools>Disk Management and see if it shows a 6 gig partition
That would be the recovery partition
You can also order a replacement recovery CD. The lastt time I ordered one it was free
https://support.dell.com/support/topics/glo...n/backupcd_form
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#9 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 31 May 2009 - 04:58 PM

garmanma,

since you're a moderator and I can't find a way to ask this question on a how-to type forum (and can't find by searching), i was hoping you could help me out with this....

when i try to reply to your message, there is no place to add an attachment, which I have had before. I don't know why it has disappeared all of a sudden. any clue as to what might be the problem.

if you're not the correct person to ask, can you direct me to the correct forum or person, etc.

thanks!



#10 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:03:12 PM

Posted 31 May 2009 - 08:38 PM

Certain forums do not allow attachments
Am I Infected is one of them

Edited by garmanma, 31 May 2009 - 08:40 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#11 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 18 June 2009 - 06:45 AM

OK....no attachments allowed. Understand.

Sorry for the length of time between posts. I am in the process of moving to a new house so things are hectic, to say the least.

I have found out definitively that I do not have Dell PC Restore by Symantec, which leaves as the only option reinstalling Windows.

I have found a couple of step-by-step guides on how to do a clean install of Windows XP, one of which is on the Dell support site. The problem is that I have read, re-read, and repeated, but it's awfully hard to follow the steps when you don't even know what they mean by terms like "third party software."

I can't even find an adequate method of backing up my data files (the very first step in the guide). They say to make at least 2 copies. I made one by dragging and dropping files into the window that pops up when I open the external hard drive from My Computer. But then I also tried to follow their instructions and use "File and Settings Transfer Wizard" but the wise wizard thinks I want to immediately transfer data files and settings from an old computer to a new computer. And I can't even tell how much memory I will need b/c there is no point where it says you need x amount of storage, so I used a 1 GB flash drive hoping that would be enough, but it then asked me to insert another one after saving only a small amount. I am somewhat (okay, very) limited by the fact that I don't have a CD/DVD burner on the system. I do have a floppy and a zip drive though (a lot of good those are doing for me).

As for the "third-party software"....it apparently has to be installed at a different time than the non-third party software. I know what third party software is, but in this case, there are many ways to interpret third-party software in this context. Is the only non-third party software Microsoft products, and if so, is it limited to Microsoft products that were on the system when purchased? Or do they also mean Dell applications? What about non-Dell, non-Microsoft products (for example, my Intel network adaptor or my Nvidia graphics card) which came pre-installed on the computer? This is what is terribly confusing (just one of the many actually). I am not completely dumb...I do know that, for example, AVG Free falls into the category of third-party software. But for the others....I'm just lost. :thumbsup:

I would appreciately any help getting my computer back up and running.

Thanks.



#12 black069

black069
  • Topic Starter

  • Members
  • 66 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Tabor City, NC
  • Local time:03:12 PM

Posted 03 August 2009 - 07:24 AM

...been a while since my last (unanswered) post, so I thought I would summarize and close up this topic. [Word to other newbies, like myself: keep your questions short and succint...unlike mine. Then you will get more feedback.]

Since I have a Dell Dimension 4550 built in 2002, it does not have any of the recovery options that are available in newer computers. Thus, I had to do a fresh install of Windows XP. Luckily, I still have the original CD-ROM's, so I have been able to proceed.

A couple of the best websites I found for helping me understand how to reinstall XP are below:

http://www.winsupersite.com/showcase/windowsxp_sg_clean.asp (Paul Thurriott's SuperSite for Windows: an interactive guide)

and

http://support.dell.com/support/topics/glo...mp;docid=339949
(Dell's tech support section; a word of caution, though...if you are using Computer A to view the Dell site to get information about how to reinstall OS on Computer B (let's assume B is offline), you can do this, just know that if you log in with your Dell account, the information given will be specific to Computer A. My suggestion would be to go to the site, not log in, just enter your Product and OS and go from there.

Hope this helps someone!

Let's close 'er up!






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users