Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

I am infected


  • This topic is locked This topic is locked
10 replies to this topic

#1 capwings

capwings

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 08 September 2009 - 09:53 PM

Pre-info: Dell Inspiron 1501 - AMD Turion64, 1.99GHz, 1.87GB Ram, XP Media Center 2002, SP3. Had Norton Internet Security but did not renew (trying to cut costs) now have AVG 8.5 free.

I week ago I noticed some things wrong with the system.

1. When I use any search engine and click on the hyperlink results, it opens a new tab in IE8 that is spam. The link you clicked on does not appear in the current or new tab/window. I can type the address of any page in the address bar and it works fine.

2. After a reboot, I would receive googleupdate.exe application error (the exception breakpoint has been reached) Ok to terminate or Cancel to Debug and google installer encounted a problem, send error report or dont send. I believe I have fixed these problems. I no longer receive these errors on reboot. (deleted all registry entries, folders and files that have google name in it. then ran CCleaner to delete the files.)

3. After a period of time, my computer is locking up, mouse doesn't work, hotkeys not working, etc. Turning the computer off and rebooting is the only option.

4. Blaster virus? - When the computer boots, iexplore.exe auto starts in the processes. Right now I have had the computer on for about 30 minutes (with no lockup) but 4 processes for iexplore.exe running (i am browsing using Firefox) I can end the process but it always returns.

5. I am also noting that I have multiple processes running for the same exe file. 2 ati2evxx.exe, 8 svchost.exe.

I have downloaded Malwarebytes Anti-Malware, but when I try and run it, it never opens.
I have HijackThis and scan everyday with AVG Free 8.5. AVG says it moves the infections to the vault, but nothing seems to get better.
Any help would be great.

BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:22 PM

Posted 09 September 2009 - 11:14 AM

Some types of malware will disable Malwarebytes Anti-Malware and other security tools. If MBAM will not install, try renaming it first.
  • Right-click on the mbam-setup.exe file file and rename it to mysetup.exe.
  • Double-click on mysetup.exe to start the installation.
  • If that did not work, then try renaming and changing the file extension. <- click this link if you do not see the file extension
  • Right-click on the mbam-setup.exe file, rename it to mysetup and change the .exe extension to .scr, .com, .pif, or .bat.
  • Then double-click on mysetup.scr (or whatever extension you renamed it) to begin installation.
If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files.
  • Right-click on mbam.exe, rename it to myscan.exe.
  • Double-click on myscan.exe to launch the program.
  • If that did not work, then right-click on the file and rename it to winlogon.exe.
  • If that still did not work, then try renaming and change the .exe extension in the same way as noted above.
  • Double-click on myscan.scr (or whatever extension you renamed it) to launch the program.
If using Windows Vista, refer to How to Change a File Extension in Windows Vista.

Note: MBAM uses Inno Setup instead of the Windows Installer Service to install the program. If installation fails in normal mode, try installing and scanning in safe mode. Doing this is usually not advised as MBAM is designed to be at full power when running in normal mode and loses some effectiveness for detection & removal when used in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of MBAM. Therefore, after completing a scan it is recommended to uninstall MBAM, then reinstall it in normal mode and perform another Quick Scan.

ati2evxx.exe is a process related to ATI Display Adapters that provides additional configuration options for these devices and can be disabled. Read here.

Svchost.exe is a generic host process name for a group of services that are run from dynamic-link libraries (DLLs) and can run other services underneath itself. This is a valid system process that belongs to the Windows Operating System which handles processes executed from .dll's. It runs from the registry key, HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost where details of the services running under each instance of svchost.exe can be found. At startup, Svchost.exe checks the services portion of the registry to construct a list of services that it needs to load. It is not unusual for multiple instances of Svchost.exe running at the same time in Task Manager in order to optimize the running of the various services.

svchost.exe SYSTEM (there can be more than one listed)
svchost.exe LOCAL SERVICE
svchost.exe NETWORK SERVICE (there can be more than one listed)

Each Svchost.exe session can contain a grouping of services, therefore, separate services can run, depending on how and where Svchost.exe is started. This grouping of services permits better control and easier debugging. The process ID's (PID's) are not static and can change with each logon but generally they stay nearly the same because they are running services all the time. The PID's must be checked in real time to determine what services each instance of svchost.exe is controlling at that particular time.

Determining whether a file is malware or a legitimate process sometimes depends on the location (path) it is running from. One of the ways that malware tries to hide is to give itself the same name as a critical system file like svchost.exe. However, it then places itself in a different location on your computer. Another techinique is for the process to alter the registry and add itself as a Startup program so that it can run automatically each time the computer is booted. In XP, the legitimate Svchost.exe file is located in your C:\WINDOWS\system32\ folder.

Other legitimate copies can be found in the following folders:
C:\I386
C:\WINDOWS\ServicePackFiles\i386\
C:\WINDOWS\$NtServicePackUninstall$\
C:\WINDOWS\Prefetch\SVCHOST.EXE-3530F672.pf

If svchost.exe is running as a startup (shows in msconfig), it can be bad as shown here and here. Make sure the spelling is correct. If it's scvhost.exe, then your dealing with a Trojan.

There are several ways to investigate and see what services a Svchost.exe process is controlling:Note: Process Explorer shows two panes by default: the upper pane is always a process list and the bottom pane either shows the list of DLLs loaded into the process selected in the upper pane, or the list of operating system resource handles (files, Registry keys, synchronization objects) the process has open. In the menu at the top select View > Lower Pane View to change between DLLs and Handles.

Tools to investigate running processes and gather additional information to identify them and resolve problems:These tools will provide information about each process, CPU usage, file description and its path location If you right-click on a file and select properties, you will see more details.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 capwings

capwings
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 09 September 2009 - 08:05 PM

Thanks for the info quietman7. I renamed the application and that worked. Ran a quick scan and it found
2 rootkit.tdss
1 adware.mywebsearch
1 Trojan.downloader
1 Trojan.agent
1 Adware.trymedia
2 Malware.trace
1 Disabled.securitycenter

After a reboot, I will run a full scan.

Will Malwarebytes find and fix everything I need or do I need to do something else?

Thanks again for your help.

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:22 PM

Posted 09 September 2009 - 09:18 PM

Please post the results of your MBAM scan for review.

To retrieve the Malwarebytes Anti-Malware scan log information, launch MBAM.
  • Click the Logs Tab at the top.
    • The log will be named by the date of scan in the following format: mbam-log-date(time).txt
      -- If you have previously used MBAM, there may be several logs showing in the list.
  • Click on the log name to highlight it.
  • Go to the bottom and click on Open.
  • The log should automatically open in notepad as a text file.
  • Go to Edit and choose Select all.
  • Go back to Edit and choose Copy or right-click on the highlighted text and choose copy from there.
  • Come back to this thread, click Add Reply, then right-click and choose Paste.
  • Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Logs are saved to the following locations:
-- In XP: C:\Documents and Settings\<Username>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs
-- In Vista: C:\Documents and Settings\Users\All Users\Malwarebytes\Malwarebytes' Anti-Malware\Logs


Will Malwarebytes find and fix everything I need or do I need to do something else?

Depends...Some infections are difficult to remove completely because of their morphing characteristics which allows the malware to regenerate itself. Sometimes there is hidden piece of malware (i.e. rootkit) which has not been detected by your security tools that protects malicious files and registry keys so they cannot be permanently deleted without using more powerful tools.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 capwings

capwings
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 10 September 2009 - 07:43 PM

The last scan I did.

Malwarebytes' Anti-Malware 1.40
Database version: 2769
Windows 5.1.2600 Service Pack 3

9/9/2009 10:20:11 PM
mbam-log-2009-09-09 (22-20-11).txt

Scan type: Full Scan (C:\|)
Objects scanned: 193149
Time elapsed: 42 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

Previous scans:

Malwarebytes' Anti-Malware 1.40
Database version: 2769
Windows 5.1.2600 Service Pack 3

9/9/2009 8:52:36 PM
mbam-log-2009-09-09 (20-52-36).txt

Scan type: Full Scan (C:\|)
Objects scanned: 193169
Time elapsed: 42 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Ashlye Bays\My Documents\Downloads\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

Malwarebytes' Anti-Malware 1.40
Database version: 2769
Windows 5.1.2600 Service Pack 3

9/9/2009 8:03:24 PM
mbam-log-2009-09-09 (20-03-24).txt

Scan type: Quick Scan
Objects scanned: 99078
Time elapsed: 4 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
\\?\globalroot\systemroot\system32\UACvfvhjnkxyl.dll (Rootkit.TDSS) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
\\?\globalroot\systemroot\system32\UACvfvhjnkxyl.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xa.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot.

I will also add, something is still on the computer that Malware, AVG, Highjack or CCleaner are not finding. iexplorer.exe auto starts when computer boots. I checked msconfig and only have ctfmon.exe checked in the start up tab. Could it be a service?

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:22 PM

Posted 10 September 2009 - 09:40 PM

Please download Sophos Anti-rootkit & save it to your desktop.
alternate download link
Note: If using the vendor's download site you will be asked to register with MySophos so an email containing an activation link can be sent to your email address.

Be sure to print out and read the Sophos Anti-Rookit User Manual and Release Notes.
  • Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click Accept.
  • Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
  • A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now".
  • Click Yes and allow the driver and its randomly named .tmp file (i.e. F.tmp) to load if asked.
  • If the scan did not start automatically, make sure the following are checked:
    • Running processes
    • Windows Registry
    • Local Hard Drives
  • Click Start scan.
  • Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper panel.
  • When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK to continue.
  • Click on the suspicious file to display more information about it in the lower panel which also includes whether the item is recommended for removal.
    • Files tagged as Removable: No are not marked for removal and cannot be removed.
    • Files tagged as Removable: Yes (clean up recommended) are marked for removal by default.
    • Files tagged as Removable: Yes (but clean up not recommended) are not marked for removal because Sophos did not recognize them. These files will require further investigation.
  • Select only items recommended for removal, then click "Clean up checked items". You will be asked to confirm, click Yes.
  • A pop up window will appear advising the cleanup will finish when you restart your computer. Click Restart Now.
  • After reboot, a dialog box displays the files you selected for removal and the action taken.
  • Click Empty list and then click Continue to re-scan your computer a second time to ensure everything was cleaned.
  • When done, go to Posted Image > Run..., then copy and paste this command into the open box: %temp%\sarscan.log
  • This should open the log from the rootkit scan. Please post this log in your next reply. If you have a problem, you can find sarscan.log in C:\Documents and Settings\\Local Settings\Temp\.
Important: Before performing an ARK scan it is recommended to do the following to ensure more accurate results and avoid common issues that may cause false detections.
  • Disconnect from the Internet or physically unplug you Internet cable connection.
  • Clean out your temporary files.
  • Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
  • Temporarily disable your anti-virus and real-time anti-spyware protection.
  • After starting the scan, do not use the computer until the scan has completed.
  • When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.
Note: Not all hidden components detected by ARKs are malicious. It is normal for a Firewall, some Anti-virus and Anti-malware software (ProcessGuard, Prevx1, AVG AS), sandboxes, virtual machines and Host based Intrusion Prevention Systems (HIPS) to hook into the OS kernal/SSDT in order to protect your system. SSDT (System Service Descriptor Table) is a table that stores addresses of functions that are used by Windows. Both Legitimate programs and rootkits can hook into and alter this table. You should not be alarmed if you see any hidden entries created by legitimate programs after performing a scan.

IMPORTANT NOTE: One or more of the identified infections (uacinit.dll) was related to a nasty variant of the TDSSSERV rootkit component. Rootkits, backdoor Trojans, Botnets, and IRCBots are very dangerous because they compromise system integrity by making changes that allow it to by used by the attacker for malicious purposes. Rootkits are used by Trojans to conceal its presence (hide from view) in order to prevent detection of an attacker's software and make removal more difficult. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. They can disable your anti-virus and security tools to prevent detection and removal. Remote attackers use backdoors as a means of accessing and taking control of a computer that bypasses security mechanisms. This type of exploit allows them to steal sensitive information like passwords, personal and financial data which is send back to the hacker. To learn more about these types of infections, you can refer to:If your computer was used for online banking, has credit card information or other sensitive data on it, you should stay disconnected from the Internet until your system is fully cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromised and change each password using a clean computer, not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read:Although the rootkit was identified and may be removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume the computer is secure even if the malware appears to have been removed. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired so you can never be sure that you have completely removed a rootkit. The malware may leave so many remnants behind that security tools cannot find them. Tools that claim to be able to remove rootkits cannot guarantee that all traces of it will be removed. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 capwings

capwings
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 11 September 2009 - 12:07 AM

It did not recommend cleaning up anything in this log:


Sophos Anti-Rootkit Version 1.5.0 © 2009 Sophos Plc
Started logging on 9/10/2009 at 23:01:27 PM
User "Home" on computer "BAYSLAP"
Windows version 5.1 SP 3.0 Service Pack 3 build 2600 SM=0x100 PT=0x1 Win32
Info: Starting process scan.
Info: Starting registry scan.
Hidden: registry item \HKEY_LOCAL_MACHINE\SOFTWARE\UAC
Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UACd.sys
Hidden: registry item \HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\UACd.sys
Info: Starting disk scan of C: (NTFS).
Hidden: file C:\WINDOWS\Temp\UAC7a6b.tmp
Hidden: file C:\WINDOWS\system32\UACmqpqjwcfyn.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntf16.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntf32.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntfNT.dll
Hidden: file C:\WINDOWS\Temp\UAC7092.tmp
Hidden: file C:\WINDOWS\Temp\UACf826.tmp
Hidden: file C:\WINDOWS\system32\uacinit.dll
Hidden: file C:\WINDOWS\Temp\UAC9759.tmp
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UACff5c.tmp
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UACcc12.tmp
Hidden: file C:\WINDOWS\system32\UACsklyfwabwu.db
Hidden: file C:\WINDOWS\system32\drivers\UACshoeorojcs.sys
Hidden: file C:\WINDOWS\system32\UACchdndswubj.dll
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UAC8bbd.tmp
Hidden: file C:\WINDOWS\system32\UAClrgipjdpkj.dll
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UAC8c4a.tmp
Hidden: file C:\WINDOWS\system32\drivers\UACdmyqxyubom.sys
Hidden: file C:\WINDOWS\system32\UACwkwkcwptgm.dll
Hidden: file C:\WINDOWS\Temp\UAC5714.tmp
Hidden: file C:\Documents and Settings\Phillip Bays\My Documents\Program Downloads\IE7-WindowsXP-x86-enu.exe
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\is-QP0U1.tmp\gtapi.dll
Hidden: file C:\WINDOWS\Temp\UAC11a5.tmp
Hidden: file C:\WINDOWS\Temp\UAC1416.tmp
Hidden: file C:\WINDOWS\system32\UACdovhowberr.dat
Hidden: file C:\WINDOWS\system32\UACvfvhjnkxyl.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Application Data\OfficeUpdate12\oudetect.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\SWA\swadcmpr.x32
Hidden: file C:\Documents and Settings\Phillip Bays\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\SWA\SWASTRM.X32
Hidden: file C:\Documents and Settings\Phillip Bays\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\MacroMix\MacroMix.x32
Hidden: file C:\Documents and Settings\Phillip Bays\Application Data\Macromedia\Shockwave Player\xtras\download\MacromediaInc\FlashAsset\Flash Asset.x32
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\Aes.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\7zAes.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\Branch.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\Copy.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\LZMA.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Codecs\Swap.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Application Data\Seven Zip\Formats\7z.dll
Stopped logging on 9/10/2009 at 23:38:32 PM

#8 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:22 PM

Posted 11 September 2009 - 07:06 AM

As I said, not all hidden components detected by ARKs are malevolent. Thus, its not unusal to find legitimate files mixed in with malicious ones. Sophos ARK does not recommend removal of files which the scanner does not recognize. However, that does not mean those files are all good and should be left alone. Further investigation is required after the initial scan to analyze and identify the files which were detected so they can be removed during a subsequent scan if found to be malicious.

Please rescan with Sophos AntiRootkit again and select to remove the following entries if still present.
Hidden: file C:\WINDOWS\Temp\UAC7a6b.tmp
Hidden: file C:\WINDOWS\system32\UACmqpqjwcfyn.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntf16.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntf32.dll
Hidden: file C:\Documents and Settings\Phillip Bays\Local Settings\Temp\SIntfNT.dll
Hidden: file C:\WINDOWS\Temp\UAC7092.tmp
Hidden: file C:\WINDOWS\Temp\UACf826.tmp
Hidden: file C:\WINDOWS\system32\uacinit.dll
Hidden: file C:\WINDOWS\Temp\UAC9759.tmp
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UACff5c.tmp
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UACcc12.tmp
Hidden: file C:\WINDOWS\system32\UACsklyfwabwu.db
Hidden: file C:\WINDOWS\system32\drivers\UACshoeorojcs.sys
Hidden: file C:\WINDOWS\system32\UACchdndswubj.dll
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UAC8bbd.tmp
Hidden: file C:\WINDOWS\system32\UAClrgipjdpkj.dll
Hidden: file C:\Documents and Settings\Ashlye Bays\Local Settings\Temp\UAC8c4a.tmp
Hidden: file C:\WINDOWS\system32\drivers\UACdmyqxyubom.sys
Hidden: file C:\WINDOWS\system32\UACwkwkcwptgm.dll
Hidden: file C:\WINDOWS\Temp\UAC5714.tmp
Hidden: file C:\WINDOWS\Temp\UAC11a5.tmp
Hidden: file C:\WINDOWS\Temp\UAC1416.tmp
Hidden: file C:\WINDOWS\system32\UACdovhowberr.dat
Hidden: file C:\WINDOWS\system32\UACvfvhjnkxyl.dll
  • Follow the prompts to remove them and restart your computer.
  • After reboot, a dialog box displays the files you selected for removal and the action taken.
  • Click Empty list and exit the program when done.
Malwarebytes Anti-Malware has been updated to v1.41. Please download and install the most current version from here.
You may have to reboot after updating in order to overwrite any "in use" protection module files.

Update the database through the program's interface (preferable method). Then perform a new Quick Scan in normal mode and check all items found for removal. Don't forgot to reboot afterwards. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. When done, click the Logs tab and copy/paste the contents of the new report in your next reply.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#9 capwings

capwings
  • Topic Starter

  • Members
  • 18 posts
  • OFFLINE
  •  
  • Local time:10:22 PM

Posted 13 September 2009 - 09:40 PM

I ran Sophos again and removed all of the files in your post, but it did not remove 2 dll files due to the process running. Here is the Malware log that was completed after Sophos.

Malwarebytes' Anti-Malware 1.41
Database version: 2794
Windows 5.1.2600 Service Pack 3

9/13/2009 9:30:55 PM
mbam-log-2009-09-13 (21-30-55).txt

Scan type: Full Scan (C:\|)
Objects scanned: 186227
Time elapsed: 1 hour(s), 4 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\UACd.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP492\A0117910.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP492\A0117911.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP492\A0117912.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP492\A0117914.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACchdndswubj.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UACvfvhjnkxyl.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:11:22 PM

Posted 14 September 2009 - 06:09 AM

Some infections are difficult to remove completely because of their morphing characteristics which allows the malware to regenerate itself. Sometimes there is hidden piece of malware (i.e. rootkit) which has not been detected by your security tools that protects malicious files and registry keys so they cannot be permanently deleted. Disinfection will probably require the use of more powerful tools than we recommend in this forum. Before that can be done you will need you to create and post a DDS/HijackThis log for further investigation.

Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,963 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:11:22 PM

Posted 14 September 2009 - 09:14 PM

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/257653/infections/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days, up to two weeks perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users