Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Missing MS Paint in the Start Menu and Rootkit infection?

  • This topic is locked This topic is locked
6 replies to this topic

#1 badboy00z


  • Members
  • 16 posts
  • Local time:12:08 PM

Posted 26 July 2010 - 12:42 AM

Hi everybody, new guy here. I was recommended here by the guys at the Symantec Forum.

Before I talk about the problem in the thread title I just want to let you guys know what has been happening with my computer. I'm using Windows XP Home with Norton Anti Virus 2009, Ad-Aware, and most recently Malware Byte and Microsoft Security Essentials as my security software.

1) A few weeks ago I had some Malware problems. I experienced Internet Explorer popping up and my mouse (cursor) was moving by itself and I had no control of it. This happened twice and fortunately I was able to stop it by pressing the "on" button on the computer tower. Norton and Ad-Aware 6.0 (free) was not able to detect or get rid of them and I ended up getting the most recent free version of Ad-Adware and that was able to get rid of the infections. However I did not make a note of what the Malwares were.

2) Sometime after that I noticed the status of Norton Anti Virus is "At Risk". I click on the "Fix Now" button which started Live Update. When that finished it said I have the latest virus definitions but the status is still "At Risk". I tried a few more times without success and then I finally figured it out and it turned out that my system date was set forward without my knowledge.

3) After all that happened I thought everything was okay but then I noticed that whenever I start or reboot my computer I would hear the CPU running really loud. And this would happen right away before I even open any programs or Fire Fox. The first time this happened I opened Task Manager to see what was spiking the CPU Usage. I noticed 2 instances of Explorer.exe running and one of them was at 40-50 under CPU Usage. I posted this problem over at the Symantec Forum and someone suggested I use Malware Byte to scan my system which was able to detect and get rid of the infections.

Here is the Malware Byte Log. I saved it before I clicked on the "Remove" threats button and that's why it says nothing is fixed.

Malwarebytes' Anti-Malware 1.46

Database version: 4345

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

7/24/2010 5:21:50 PM
mbam-log-2010-07-24 (17-21-50).txt

Scan type: Full scan (C:\|)
Objects scanned: 210099
Time elapsed: 1 hour(s), 11 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{16ms825v-41sy-n428-v460-i2x7psm8sja7} (Generic.Bot.H) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\internet explorer (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\internet explorer (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Kevin\Application Data\logs.dat (Bifrose.Trace) -> No action taken.
C:\Documents and Settings\Mom\Application Data\logs.dat (Bifrose.Trace) -> No action taken.
C:\Documents and Settings\Kevin\Start Menu\Programs\Startup\explorer.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Mom\Start Menu\Programs\Startup\explorer.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Kevin\Local Settings\Temp\UuU.uUu (Malware.Trace) -> No action taken.
C:\Documents and Settings\Mom\Local Settings\Temp\UuU.uUu (Malware.Trace) -> No action taken.
C:\Documents and Settings\Mom\Local Settings\Temp\XxX.xXx (Malware.Trace) -> No action taken.

After all that I got a pop up alert from Norton saying it blocked "Bloodhound.MalPE", twice. I didn't really pay attention to it since it says it has been blocked. I posted it on the Symantec Forum and they suggested that I come here to have my system checked. I was also worried about having a Rootkit infection after reading about it.

Now on to my current problem.

I was happy that I finally got rid of all the infections (to my knowledge) but when I tried to post a screen shot, I was not able to find the Microsoft Paint App in the Start Menu-> All Programs->Accessories (where I normally find it). So then I did a System Search and it found 2 MS Paint applications. One in "C:\i386" and the other one in "C:\WINDOWS\ServicePackFiles\i386". When I tried to open either of them from the search results, the program wouldn't load, the screen stays white and the cursor turns into the hour glass. I would have right click on the tab in order to close it and while that is happening, I would see "dumprep.exe" in the Task Manager spiking up the CPU Usage. And closing the program would take about 2 minutes. After I get the prompt asking to "Send" or "Don't Send" the CPU Usage would drop back to normal and the "dumprep.exe" would go away. Obviously something is wrong with my system since my MS Paint is missing from the Start Menu and it wouldn't load when I try to open it from the search results.

Since all of this happened I have done several full scans with Norton, Ad Aware, Malware Byte and now Microsoft Security Essentials.

My major concern now is whether or not I have a Rootkit infection.

Sorry for the long post and I would really appreciate it if you guys can help me with this problem.

BC AdBot (Login to Remove)


#2 badboy00z

  • Topic Starter

  • Members
  • 16 posts
  • Local time:12:08 PM

Posted 26 July 2010 - 09:58 PM

So this morning after booting up there was a pop up from Windows Automatic Update saying there was an update available. I click on install and everything seems normal until it finished. It said it installed Office XP Service Pack 3 but I am pretty sure that I already have the SP3 and have had it for awhile. Not only that I looked it up on the Microsoft website and it said Office XP SP3 was published back in 2004. Why would I get it now 6 years later? Then right after the first "update" another pop up came up saying Windows found 1 update again. I recently had a bag string of events happen and so I was a bit wary so I didn't install the last update. Normally any Windows update would install automatically when I turn off my computer but for this one it didn't so that was another red flag.

Another symptom is that my MS Paint is missing from the Start Menu-> Accessories. I have another thread here that explains everything that has happened to me. The problem is still not resolved.

Thanks in advance.

Edited by Orange Blossom, 29 July 2010 - 10:54 PM.
Merged topics. ~ OB

#3 badboy00z

  • Topic Starter

  • Members
  • 16 posts
  • Local time:12:08 PM

Posted 28 July 2010 - 02:16 AM

I figured out my missing MS Paint. Turns out it was removed via Add/ Remove Windows Components. I feel like such a moron. Lol.

But to be safe I wouldn't mind having my system scanned for any Rootkits even though I have no obvious symptoms.

#4 boopme


    To Insanity and Beyond

  • Global Moderator
  • 73,489 posts
  • Gender:Male
  • Location:NJ USA
  • Local time:01:08 PM

Posted 28 July 2010 - 02:17 PM

Hello, then run rhese next.

Please perform a scan with Eset Online Antiivirus Scanner.
(Requires Internet Explorer to work. If given the option, choose "Quarantine" instead of delete.)
Vista users need to run Internet Explorer as Administrator. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
  • Click the green ESET Online Scanner button.
  • Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.
  • A new window will appear asking "Do you want to install this software?"".
  • Answer Yes to download and install the ActiveX controls that allows the scan to run.
  • Click Start.
  • Check Remove found threats and Scan potentially unwanted applications.
  • Click Scan to start. (please be patient as the scan could take some time to complete)
  • If offered the option to get information or buy software. Just close the window.
  • When the scan has finished, a log.txt file will be created and automatically saved in the C:\Program Files\ESET\ESET Online Scanner\log.txt
  • Click Posted Image > Run..., then copy and paste this command into the open box: C:\Program Files\ESET\EsetOnlineScanner\log.txt
  • The scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply.
Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.
-- If you encounter any problems, try running GMER in safe mode.
-- If GMER crashes or keeps resulting in a BSODs, uncheck Devices on the right side before scanning
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#5 badboy00z

  • Topic Starter

  • Members
  • 16 posts
  • Local time:12:08 PM

Posted 28 July 2010 - 11:18 PM

Hi thank you for your assistance.

The Eset Online AV Scan went successfully. Here's the Log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=
# api_version=3.0.2
# EOSSerial=2a59b081b731614c935a661ac14cd4cb
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2010-07-29 12:08:59
# local_time=2010-07-28 05:08:59 (-0800, Pacific Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=3587 16777173 100 94 0 28513735 0 0
# compatibility_mode=5891 16776533 100 100 0 9858939 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=84181
# found=1
# cleaned=1
# scan_time=3780
C:\Documents and Settings\Kevin\My Documents\Programs\AIM.exe Win32/Adware.WBug.A application (deleted - quarantined) 86D151CC9AE8A37F5828A59B22B29D7E C

I followed all of the instruction however I was not successful with GMER. In normal mode after scanning, I clicked on the Save... button and the keyboard froze and anything on the screen is unresponsive when clicked. I had to reboot with the power button. Then I booted up in Safe Mode (F8 method) and tried again. The scan went okay but again after clicking the Save...button, the cursor turned into the hour glass for a long time but the keyboard and everything else still responded. I had to close GMER by right clicking on the tab in the Task Bar. The Program Not Responding window came up and I clicked End Program. I had problem exiting Safe Mode as well. It stayed in the black screen with Safe Mode on all 4 corners a really long time and I had to reboot using the power button again. I hope that didn't cause any damage.

What do I do now?

#6 boopme


    To Insanity and Beyond

  • Global Moderator
  • 73,489 posts
  • Gender:Male
  • Location:NJ USA
  • Local time:01:08 PM

Posted 29 July 2010 - 10:38 AM

Ok Something is in the way. We'll need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#7 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 37,009 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:01:08 PM

Posted 29 July 2010 - 10:55 PM


Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/335789/possible-malware-and-rootkit-infection/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users