Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32.mitglieder.ct Removal


  • Please log in to reply
1 reply to this topic

#1 bp238

bp238

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:32 PM

Posted 09 January 2007 - 10:24 PM

My XP pro lost McAfee and zonealarm yesterday after I downloaded a virus. After much research and reading I have found I might have the three pronged attack worm indicated by the topic title. Most of the past 24 hours has been spent trying to get McAfee and Zonealarm to work again to no avail. I even went through a lengthy process I found on ZA's website/forum to uninstall ZA completely with reg edits galore and tone of file deletions only to have the reinstall give another error and not le ZA install. So, I found COMODO firewall and it installed right away. Mind you this is the first time I have had a firewall up since this began. When COMODO started up it showed that wintems.exe was trying to access the internet. I did not know what that was ofcourse so I set to deny access and commence to google wintems.exe. This is what I found:

Description
Win32.Mitglieder.CT is a trojan that opens a backdoor on an infected machine, and acts as a SOCKS 4 proxy. The trojan also periodically contacts web sites with information pertaining to the infection. The main executable is 51,200 bytes in size.

Method of Infection

To infect a machine, the trojan copies itself to %System%\wintems.exe before dropping two DLL files. These files have been identified as:

%System%\forő.exe (27,136 bytes) and %System%\noat.exe (16,384 bytes).

Note: '%System%' is a variable location. The worm determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.

The various components are used in the following way:

Once executed, wintems.exe injects noat.exe into Explorer.exe, which in turn loads forő.exe, containing the main functionality of the trojan. This allows the trojan to run under the guise of the Windows process Explorer.exe.

Mitglieder.CT creates the following registry value so that it is run at each system startup:

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe = "%System%\wintems.exe"

Return to top

Payload
SOCKS Proxy/Backdoor

Much like all Mitglieders, the CT variant opens a backdoor on port 38884 which acts as a SOCKS 4 proxy. Additionally, the backdoor can be instructed to perform varying tasks which include the following:

* Changing the backdoor port number
* Updating the trojan
* Downloading and execute files
* Uninstalling the trojan
* Initiating an SMTP server on TCP port 25, which can be used to relay spam.
* Executing files on the infected computer
* Downloading and executing files via a URL

Terminates Processes

The trojan checks all running process names for instances of any of the following strings, terminating processes that match:

OUTPOST.EXE
NMAIN.EXE
NORTON_INTERNET_SECU_3.0_407.EXE
NPF40_TW_98_NT_ME_2K.EXE
NPFMESSENGER.EXE
NPROTECT.EXE
NSCHED32.EXE
NTVDM.EXE
NVARCH16.EXE
KERIO-WRP-421-EN-WIN.EXE
KILLPROCESSSETUP161.EXE
LDPRO.EXE
LOCALNET.EXE
LOCKDOWN.EXE
LOCKDOWN2000.EXE
LSETUP.EXE
CLEANPC.EXE
AVprotect9x.exe
CMGRDIAN.EXE
CMON016.EXE
CPF9X206.EXE
CPFNT206.EXE
CV.EXE
CWNB181.EXE
CWNTDWMO.EXE
ICSSUPPNT.EXE
DEFWATCH.EXE
DEPUTY.EXE
DPF.EXE
DPFSETUP.EXE
DRWATSON.EXE
ENT.EXE
ESCANH95.EXE
AVXQUAR.EXE
ESCANHNT.EXE
ESCANV95.EXE
AVPUPD.EXE
EXANTIVIRUS-CNET.EXE
FAST.EXE
FIREWALL.EXE
FLOWPROTECTOR.EXE
FP-WIN_TRIAL.EXE
FRW.EXE
FSAV.EXE
AUTODOWN.EXE
FSAV530STBYB.EXE
FSAV530WTBYB.EXE
FSAV95.EXE
GBMENU.EXE
GBPOLL.EXE
GUARD.EXE
GUARDDOG.EXE
HACKTRACERSETUP.EXE
HTLOG.EXE
HWPE.EXE
IAMAPP.EXE
IAMAPP.EXE
IAMSERV.EXE
ICLOAD95.EXE
ICLOADNT.EXE
ICMON.EXE
ICSUPP95.EXE
ICSUPPNT.EXE
IFW2000.EXE
IPARMOR.EXE
IRIS.EXE
JAMMER.EXE
ATUPDATER.EXE
AUPDATE.EXE
KAVLITE40ENG.EXE
KAVPERS40ENG.EXE
KERIO-PF-213-EN-WIN.EXE
KERIO-WRL-421-EN-WIN.EXE
BORG2.EXE
BS120.EXE
CDP.EXE
CFGWIZ.EXE
CFIADMIN.EXE
CFIAUDIT.EXE
AUTOUPDATE.EXE
CFINET.EXE
NAVAPW32.EXE
NAVDX.EXE
NAVSTUB.EXE
NAVW32.EXE
NC2000.EXE
NCINST4.EXE
AUTOTRACE.EXE
NDD32.EXE
NEOMONITOR.EXE
NETARMOR.EXE
NETINFO.EXE
NETMON.EXE
NETSCANPRO.EXE
NETSPYHUNTER-1.2.EXE
NETSTAT.EXE
NISSERV.EXE
NISUM.EXE
CFIAUDIT.EXE
LUCOMSERVER.EXE
AGENTSVR.EXE
ANTI-TROJAN.EXE
ANTI-TROJAN.EXE
ANTIVIRUS.EXE
ANTS.EXE
APIMONITOR.EXE
APLICA32.EXE
APVXDWIN.EXE
ATCON.EXE
ATGUARD.EXE
ATRO55EN.EXE
ATWATCH.EXE
AVCONSOL.EXE
AVGSERV9.EXE
AVSYNMGR.EXE
BD_PROFESSIONAL.EXE
BIDEF.EXE
Drvddll.exe
drvsys.exe
BIDSERVER.EXE
BIPCP.EXE
BIPCPEVALSETUP.EXE
BISP.EXE
BLACKD.EXE
BLACKICE.EXE
BOOTWARN.EXE
NWINST4.EXE
NWTOOL16.EXE
OSTRONET.EXE
OUTPOSTINSTALL.EXE
OUTPOSTPROINSTALL.EXE
PADMIN.EXE
PANIXK.EXE
PAVPROXY.EXE
DRWEBUPW.EXE
PCC2002S902.EXE
PCC2K_76_1436.EXE
PCCIOMON.EXE
PCDSETUP.EXE
PCFWALLICON.EXE
PCFWALLICON.EXE
PCIP10117_0.EXE
PDSETUP.EXE
PERISCOPE.EXE
PERSFW.EXE
PF2.EXE
AVLTMAIN.EXE
PFWADMIN.EXE
PINGSCAN.EXE
PLATIN.EXE
POPROXY.EXE
POPSCAN.EXE
PORTDETECTIVE.EXE
PPINUPDT.EXE
PPTBC.EXE
PPVSTOP.EXE
PROCEXPLORERV1.0.EXE
PROPORT.EXE
PROTECTX.EXE
PSPF.EXE
WGFE95.EXE
WHOSWATCHINGME.EXE
AVWUPD32.EXE
NUPGRADE.EXE
WHOSWATCHINGME.EXE
WINRECON.EXE
WNT.EXE
WRADMIN.EXE
WRCTRL.EXE
WSBGATE.EXE
WYVERNWORKSFIREWALL.EXE
XPF202EN.EXE
ZAPRO.EXE
ZAPSETUP3001.EXE
ZATUTOR.EXE
CFINET32.EXE
CLEAN.EXE
CLEANER.EXE
CLEANER3.EXE
CLEANPC.EXE
CMGRDIAN.EXE
CMON016.EXE
CPD.EXE
CFGWIZ.EXE
CFIADMIN.EXE
PURGE.EXE
PVIEW95.EXE
QCONSOLE.EXE
QSERVER.EXE
RAV8WIN32ENG.EXE
REGEDT32.EXE
REGEDIT.EXE
UPDATE.EXE
RESCUE.EXE
RESCUE32.EXE
RRGUARD.EXE
RSHELL.EXE
RTVSCN95.EXE
RULAUNCH.EXE
SAFEWEB.EXE
SBSERV.EXE
SD.EXE
SETUP_FLOWPROTECTOR_US.EXE
SETUPVAMEEVAL.EXE
SFC.EXE
SGSSFW32.EXE
SH.EXE
SHELLSPYINSTALL.EXE
SHN.EXE
SMC.EXE
SOFI.EXE
SPF.EXE
SPHINX.EXE
SPYXX.EXE
SS3EDIT.EXE
ST2.EXE
SUPFTRL.EXE
LUALL.EXE
SUPPORTER5.EXE
SYMPROXYSVC.EXE
SYSEDIT.EXE
TASKMON.EXE
TAUMON.EXE
TAUSCAN.EXE
TC.EXE
TCA.EXE
TCM.EXE
TDS2-98.EXE
TDS2-NT.EXE
TDS-3.EXE
TFAK5.EXE
TGBOB.EXE
TITANIN.EXE
TITANINXP.EXE
TRACERT.EXE
TRJSCAN.EXE
TRJSETUP.EXE
TROJANTRAP3.EXE
UNDOBOOT.EXE
VBCMSERV.EXE
VBCONS.EXE
VBUST.EXE
VBWIN9X.EXE
VBWINNTW.EXE
VCSETUP.EXE
VFSETUP.EXE
VIRUSMDPERSONALFIREWALL.EXE
VNLAN300.EXE
VNPC3000.EXE
VPC42.EXE
VPFW30S.EXE
VPTRAY.EXE
VSCENU6.02D30.EXE
VSECOMR.EXE
VSHWIN32.EXE
VSISETUP.EXE
VSMAIN.EXE
VSMON.EXE
VSSTAT.EXE
VSWIN9XE.EXE
VSWINNTSE.EXE
VSWINPERSE.EXE
W32DSM89.EXE
W9X.EXE
WATCHDOG.EXE
WEBSCANX.EXE
CFIAUDIT.EXE
CFINET.EXE
ICSUPP95.EXE
MCUPDATE.EXE
CFINET32.EXE
CLEAN.EXE
CLEANER.EXE
LUINIT.EXE
MCAGENT.EXE
MCUPDATE.EXE
MFW2EN.EXE
MFWENG3.02D30.EXE
MGUI.EXE
MINILOG.EXE
MOOLIVE.EXE
MRFLUX.EXE
MSCONFIG.EXE
MSINFO32.EXE
MSSMMC32.EXE
MU0311AD.EXE
NAV80TRY.EXE
ZAUINST.EXE
ZONALM2601.EXE
ZONEALARM.EXE
Contacts Sites

Mitglieder.CT periodically contacts the following sites with information pertaining to the infection of the machine. This includes the port on which the backdoor is running and the IP address of the infected machine. (Asterisks have been used to mask exact URL for privacy purposes).

http://www.lowenbrau.ru/manager_old/images/********
http://www.gasterixx.de/gfx/********
http://www.deadlygames.de/DG/BF/BF-Links/clans/********
http://www.eurostretch.ru/********
http://mir-auto.ru/********
http://artesproduction.com/********
http://www.hhc-online.de/home/links/pics/********
http://gaz-service.ru/img/pict/********
http://rdwufa.ru/img/pict/********
http://www.komandor.ru/sessions/********
http://www.mirage.ru/sport/omega/pic/omega/********
http://prizmapr.ru/test/images/********
http://avistrade.ru/prog/img/proizvod/********
http://service6.valuehost.ru/images/********
http://www.thomas-we.de/Design/********
http://partiyazerna.1gb.ru/menu/analitika/********
http://pvcps.ru/images/********
http://monomah-city.ru/vakans/********
http://mir-vesov.ru/p/lang/CVS/********
http://promco.ru/sovrem/panorama/********
http://www.13tw22rigobert.de/_themes/kopie...n-blau/********
http://die-cliquee.de/inhalt/mitglieder/foto/********
http://plastikp.ru/img/********
http://www.levada.ru/htmlarea/images/********
http://multi-gaming.com/design/images/icons/********
http://www.metzgerei-gebhart.de/pic/********
http://www.ferienwohnung-in-masuren.de/boc...images/********
http://www.admlaw.ru/new/translations/********
http://egogo.ru/lj/0223/********
http://unbound.de/galerie/thumbnails/********
http://mc-figga.de/********
http://investexpo.ru/banners/********
http://www.etype.hostingcity.net/mysql_adm...images/********
http://tpoint.ru/sys/include/QuestionClasses/********
http://blackwidow.nsk.ru/group/zlyeyazyki/photos/********
http://www.emil-zittau.de/karten/********
http://www.ordendeslichts.de/intern/********
http://stroyindustry.ru/service/construction/********
http://vladzernoproduct.ru/control/sell/t/********
http://hannes-wacker.de/galerie/util/********
http://schiffsparty.de/bilder/uploads/********
http://sound-cell.de/prosite/pics/********
http://shop-of-innovations.de/media/********
http://bernlocher.de/cms/img/********
http://komtel.spb.ru/dk/old/using/********
http://www.gay-traffic.de/images/banner/********
http://www.progame.de/newtexte/_notes/********
http://st-agnes.de/geschichte/********
http://web298.server7.webplus24.de/********
http://gnet30.gamesnet.de/photogallery/photo25939/********
http://dabigbadboy.de/pass/********
http://roszvetmet.com/images/********

Downloads Files
The trojan downloads a list of IP addresses every hour from the following sites, saving the list to the file %System%\ban_list.txt. This file is used to filter connections made to the backdoor (Asterisks have been used to mask exact URL for privacy purposes).

http://www.lowenbrau.ru/manager_old/images/********
http://gaz-service.ru/img/pict/********
http://rdwufa.ru/img/pict/********
http://prizmapr.ru/test/images/********
http://avistrade.ru/prog/img/proizvod/********
http://service6.valuehost.ru/images/********
http://www.thomas-we.de/Design/********
http://partiyazerna.1gb.ru/menu/analitika/********
http://pvcps.ru/images/********
http://monomah-city.ru/vakans/********
http://mir-vesov.ru/p/lang/CVS/********
http://promco.ru/sovrem/panorama/********
http://www.13tw22rigobert.de/_themes/kopie...n-blau/********
http://die-cliquee.de/inhalt/mitglieder/foto/********
http://www.lowenbrau.ru/manager_old/images/********
http://comdat.de/kreta/********
http://www.psnr.ru/rus/images/banners/********
http://gaz-service.ru/img/pict/********
http://rdwufa.ru/img/pict/********
http://prizmapr.ru/test/images/********
http://avistrade.ru/prog/img/proizvod/********
http://service6.valuehost.ru/images/********
http://www.thomas-we.de/Design/********
http://partiyazerna.1gb.ru/menu/analitika/********
http://pvcps.ru/images/********
http://monomah-city.ru/vakans/********
http://mir-vesov.ru/p/lang/CVS/********
http://promco.ru/sovrem/panorama/********
http://www.13tw22rigobert.de/_themes/kopie...n-blau/********
http://die-cliquee.de/inhalt/mitglieder/foto/********

Return to top

Additional Information

The trojan creates a mutex 'zorro' so that only one copy of itself runs at a time. It also creates the following registry values for its own use:

HKCU\SOFTWARE\DateTime9\Uid = <Unique ID>
HKCU\SOFTWARE\DateTime9\Port = <Port Number>
HKCU\SOFTWARE\DateTime9\wdrn = 1/0 - Indication of whether it is a new or old infection.

Analysis by Scott Molenkamp






Sounds like what happened right? So here's the rub, because there always is a rub with this kind of thing......I search my registry and hard drive, hidden files and all and can't find wintems.exe or noat.exe or the other one. How can wintems.exe be trying to access the internet but not be found on my machine????

Please help. BTW, I downloaded StopSign anti virus which scanned and found some other stuff but not this but I unistalled it when the firewall portion of the program malfunctioned. I just hope the COMODO firewall can stay up.

Thanks for any help on removing this worm/virus/malware...

BC AdBot (Login to Remove)

 


m

#2 fozzie

fozzie

    aut viam inveniam aut faciam


  • Members
  • 3,516 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ossendrecht/The Netherlands
  • Local time:05:32 AM

Posted 09 January 2007 - 10:29 PM

In normal mode, run an online antivirus check from at least two and preferably three of the following sites.
BitDefender
Computer Associates Online Virus Scan
Panda's ActiveScan
Trend Micro Housecall
Windows Live Safety Center Free Online Scan
This scanner from Trend does not require an Active X to run.

1. Detects and removes malware ( viruses, worms, trojans, etc. )
2. Detects and removes grayware and spyware
3. Restores damage caused by malware to your system.
4. Notifies about vulnerabilities in installed programs and connected network services.
5. Multi-platform support for: Windows, Linux, Solaris.
6. Easy-to-use with the Microsoft Internet Explorer and Mozilla Firefox.

After that

Download and scan with SUPERAntiSypware Free for Home Users

* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Udates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
* When done, select "Scan for Harmful Software".
* There are three scanning options. Choose "Perform Complete Scan" and click "Next".
* When done, a Scan Summary will appear with potentially harmful items that were detected. Click "OK".
* Make sure they all have a checkmark next to them and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* Click Preferences and then click the statistics/logs tab.
* Click the dated log and press View log. A text file will appear so you can see the results.
* Select close to exit the program.


After that, download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in SAFE MODE using the F8 method.

Scan with DrWeb-CureIt as follows:

* Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
* Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan tab" and UNcheck "Heuristic analysis"
* Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
* Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
* When done, a message will be displayed at the bottom advising if any viruses were found.
* Click "Yes to all" if it asks if you want to cure/move the file.
* When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
* Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the DrWeb.csv report to your desktop.
* Exit Dr.Web Cureit when done.
* Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

Edited by fozzie, 09 January 2007 - 10:37 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users