Trojan.Win32.small.bxz

I recently upgraded to TrendMicro Internet Security 16, and since doing so, I have been unable to update/scan with this in regular Windows XP. Prior to upgrading, I was having significant Yahoo redirect problems. I am also unable to access regedit.

When I scanned in safe mode, the AV found and deleted two instances of PAK_Generic.001. MalwareBytes found nothing, but Kapersky (which I can only run in safe mode) found Trojan.Win32.small.bxz in the file C:\WINDOWS\nqeqwp.kky

What are the next steps I should take to clean my computer or to find out if there are other infections? Thanks!

According to http://www.threatexpert.com/report.aspx?md...a05f2cb3f86ae48 , your infection (Trojan.Win32.small.bxz) is a severe one. Let's try and clean this up ASAP

Did you run MBAM in safe or normal mode? Please run it again, following these instructions:

Some types of malware will disable MBAM and other security tools. If MBAM will not install, try renaming it.

• Before saving any of your security programs, rename them first. For example, before you save Malwarebytes', rename it to something like MBblah.exe and then click on Save and save it to your desktop. Same thing after you install it. Before running it, rename the main executable file first
  
  Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.
  
  If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run..
• Another work around is by not using the mouse to install it, Just use the arrow keys, tab, and enter keys.

~ Courtesy of boopme

Please download Malwarebytes Anti-Malware and save it to your desktop.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here or here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes, they may alert you after scanning with MBAM. Please permit the program to allow the changes.

Please include the following in your reply:
MBAM log

Edited by xblindx, 20 May 2009 - 07:37 PM.

I uninstalled/reinstalled MBAM and changed the name, although I was unable to update using the button (I did so manually). It came up clean again in normal mode.

Also, during the restart, my computer acted as though it was installing a Windows update (the shut down screen said I was adding an update, the computer will turn itself off), but it's been off for about a week and was on only shortly to uninstall the MBAM. My AV is also apparently not turned on automatically when the computer starts, or at least Windows is giving me one of those security alerts that says it's turned off even when the AV window saysit is running.

Malwarebytes' Anti-Malware 1.36
Database version: 2110
Windows 5.1.2600 Service Pack 3

5/21/2009 12:10:13 AM
mbam-log-2009-05-21 (00-10-13).txt

Scan type: Quick Scan
Objects scanned: 140135
Time elapsed: 26 minute(s), 15 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on drweb-cureit.exe to start the program.
• Cancel any prompts to download the latest CureIt version and click Start.
• At the prompt to "Start scan now", click Ok. Allow the setup.exe/driver to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
• When complete, click Select All, then choose Cure > Move incurable.
  (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• Now put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
• Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

I have done both scans and found several Trojans (though it looks like some are copies of the same one). However, after the full scan, I am unable to select "cure -> move incurable." However, it appears the viles were moved anyways. Is it safe to go ahead and save a log/reboot from this point?

Yes, I need to review the log file

For some reason, this saved as an Excel file. Let me know if I need to put it into a different format for you.

And as an aside, when I went back into normal mode after running that scan, TrendMicro updated itself for the first time since this whole mess started. I figure it can't be that easy, but it's at least a step in the right direction.

nqeqwp.kky;c:\windows;Trojan.AuxSpy.5;Deleted.;
TIS15SEN_GB.exe\\Module\HtmlView.exe;C:\Documents and Settings\Erin Bolen\Desktop\Dell Stuff\TIS15SEN_GB.exe;Trojan.Fakealert.origin;;
TIS15SEN_GB.exe;C:\Documents and Settings\Erin Bolen\Desktop\Dell Stuff;Archive contains infected objects;Moved.;
AC.tmp;C:\Documents and Settings\Erin Bolen\Local Settings\Temp;Trojan.Packed.2355;Incurable.Moved.;
HtmlView.exe;C:\Documents and Settings\My Downloads\Module;Trojan.Fakealert.origin;Incurable.Moved.;
7U[1].exe;C:\Program Files\Trend Micro\Internet Security\Quarantine;Trojan.MulDrop.31461;Deleted.;
A0078679.exe\\Module\HtmlView.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513\A0078679.exe;Trojan.Fakealert.origin;;
A0078679.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513;Archive contains infected objects;Moved.;
A0078680.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513;Trojan.Fakealert.origin;Incurable.Moved.;
A0078681.exe;C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP513;Trojan.MulDrop.31461;Deleted.;
nqeqwp.kky;C:\WINDOWS;Trojan.AuxSpy.5;Deleted.;

Edited by kritter47, 21 May 2009 - 07:34 PM.

Are you still having any issues?

The computer is being a little slow, but the main issues seem to have gone away (I can access regedit; I'm not currently being redirected, though that was a sporadic issue; I can access the YouTube/Yahoo/GMail pages that were blocked before). The only issue now is the computer is running verrrry slowly, which I guess could be that I'm running a a scan with my normal AV right now.

Speaking of which, I'm running a scan with TrendMicro AV 16, and it's abuot halfway through with 7 "potential threats" found. I would like to get that cleaned out before we're done here, but the main problems seem to have vanished.

Which of those little buggers was the culprit?

There is a combination, redirects usually come up in MBAM logs though, but in your case, DrWeb seemed to have caught it

Excellent, everything my AV found was adware/tracking cookies (annoying, but nowhere near the level of suck of the other problems).

I hope, *knocks on wood*, that the Dr. Web killed everything. Is there anything I need to do from here on out other than to try and figure out how I got these suckers so I can avoid it next time?

Hello as I see you are here now.

Now you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been backed up, renamed and saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use Disk Cleanup to remove all but the most recently created Restore Point.
• Go to Start > Run and type: Cleanmgr
• Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
• Click Yes, then click Ok.
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
• Disk Cleanup will remove the files and close automatically.

Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Done. Anything else to make sure everything's good and dead?

Okay, maybe it's not quite dead yet. Ran an MBAM full scan and got this:

Malwarebytes' Anti-Malware 1.36
Database version: 2164
Windows 5.1.2600 Service Pack 3

5/21/2009 11:26:42 PM
mbam-log-2009-05-21 (23-26-42).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 234800
Time elapsed: 3 hour(s), 25 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\nqeqwp.kky (Trojan.JSRedir) -> Quarantined and deleted successfully.

hello ,I would like you to run SDFix

Please print out and follow these instructions: "How to use SDFix". <- This program is for Windows 2000/XP ONLY.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"

• Disconnect from the Internet and temporarily disable your anti-virus, script blocking and any real time protection programs before performing a scan.
• When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt.
• If SDFix is unable to run after rebooting from Safe Mode, run SDFix in either Mode, and type F, then press Enter for it to finish the final stage and produce the report.
• Please copy and paste the contents of Report.txt in your next reply.
• Be sure to renable you anti-virus and and other security programs before connecting to the Internet.

-- If the computer has been infected with the VirusAlert! malware warning from the clock and the Start Menu icons or drives are not visible, open the SDFix folder, right-click on either the XP_VirusAlert_Repair.inf or W2K VirusAlert_Repair.inf (depending on your version of Windows) and select Install from the Context menu. Then reboot to apply the changes.