MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 04-09-12, 04:24
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Malware installed by a Trojan Horse

Okay. So my son allowed a trojan horse to get installed on the family computer. I was running AVG at the time, and a scan found it and removed it. (I didn't take note of the name of it, only that it was a trojan.)
Over the next few days I noticed odd things, like the desktop appearance was Windows Classic, instead of Windows XP. When I tried to change it, it gave me an error message that it couldn't be done because something wasn't running. (Had I realized how bad it was, I'd have written down all these error messages, in case they'd help.)
Oh, I should mention that I'm running Windows XP SP3. (Wiped and reinstalled within the last few months, if it matters.)
There seemed to be occasional browser redirects, but I didn't see it consistently. Pale Moon would stop responding after loading the home page, every time. Google Chrome started acting up too, so I uninstalled both of them, planning to reinstall later.
But the primary symptom I saw, and still see, is continuous internet activity, even when there seems to be nothing running. Task Manager confirms constant Networking activity, as well as CPU usage.
When I reran full scans with either AVG or MalwareBytes AntiMalware, I noticed it spent a considerable amout of time going through Temporary Internet Files in a couple of spots, even after running CCleaner. Upon looking directly into the folder(s) indicated, I actually watched various internet files appearing before my eyes, when I wasn't surfing at all. Also in Task Manager, one of the svchost.exe instances seems to grab more and more CPU usage and Memory, until I get an error message that pops up and says something about Internet Explorer using huge amounts of memory, and recommending it be shut down and restarted. If I kill that instance, the CPU and Network activity drop to where they should be, but after a short time it comes back.
Seems pretty clear I have Malware utilizing my machine in the background.
I ran MBAM and realized it wasn't finishing the scan before being shut down. I tried running it in Safe Mode, which worked, but it didn't find anything. (Also, further scans with AVG had found nothing.)
So I found you guys, and went through your Read Me Start Here process. I uninstalled MBAM, then reinstalled it to keep as close to your process as possible. It didn't occur to me until later that those earlier logs might have been useful.
SuperAntiSpyware, MalwareBytes AntiMalware and ComboFix seemed to run through fine.
RootRepeal froze up, then gave me a BSoD and restarted. I tried running it in Safe Mode, but it just froze up there too, so I moved on.
MGTools, also froze up. The last thing it said was to ignore any error messages, and stayed like that for two days. (I was out of town.) There was a log file for it though, so I'll post it with the others.
Did I miss anything?
Thank You! in advance for your help! I'm really impressed with the purpose and intent of this website! Good for you!
Attached Files
File Type: log SUPERAntiSpyware Scan Log - 04-06-2012 - 21-07-59.log (575 Bytes, 2 views)
File Type: txt mbam-log-2012-04-06 (21-46-05).txt (1.8 KB, 2 views)
File Type: zip MGlogs.zip (18.3 KB, 1 views)
File Type: txt CFlog.txt (15.1 KB, 2 views)
Reply With Quote
Sponsored links
  #2  
Old 04-09-12, 07:50
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run


Please also download MBRCheck to your desktop
  • Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
  • It will show a Black screen with some information that will contain either the below line if no problem is found:
    • Done! Press ENTER to exit...
  • Or you will see more information like below if a problem is found:
    • Found non-standard or infected MBR.
    • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
  • Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
  • MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.

MGTools did not run properly.

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.
  • cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
  • nwktst<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
  • GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
  • ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.
  • analyse <-- this attempts to run HijackThis. Be sure to click the Accept button twice in the license agreement popup or it will just sit there and wait.
Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-12-12)
  #3  
Old 04-12-12, 15:27
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Re: Malware installed by a Trojan Horse

Thank you. I'll be able to do this tomorrow; I'm out of town right now.

Didn't see the Email at first; it was in my spam folder. Shouldn't have that problem again.
Reply With Quote
  #4  
Old 04-13-12, 06:45
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

OK! I'll be about later after work, but late on.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-20-12)
  #5  
Old 04-13-12, 19:22
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Re: Malware installed by a Trojan Horse

Okay. Ran TDSSKiller apparently successfully.

MBRCheck started okay, but crashed to a BSoD. Not sure if it matters but the message given was "MACHINE_CHECK_EXCEPTION" with the following:
"STOP: 0x0000009c (0x00000004, 0x8054e5f0, 0xb2000000, 0x00070f0f)"

GetRunKey gave a message saying, The system cannot find the file specified."

After GetRunKey finished, a window came up from Internet Explorer. The standard Do you want to show only content that was delivered securely? I suspect it was because of whatever the malware was running. I did not have Internet Explorer (Or any other browser) open at the time. I just closed the window, didn't click either answer.

Hijackthis only needed one Accept click, but then opened up a "MainMenu" with choices. I selected "Do A System Scan And Save A Logfile." Just in case, I'm uploading the Hijackthis logfile separately, as well.
Attached Files
File Type: txt TDSSKiller.2.7.28.0_13.04.2012_13.26.16_log.txt (83.8 KB, 1 views)
File Type: txt MBRCheck_04.13.12_13.41.36.txt (10.0 KB, 1 views)
File Type: zip MGlogs.zip (105.5 KB, 1 views)
File Type: log hijackthis.log (8.1 KB, 1 views)
Reply With Quote
Sponsored links
  #6  
Old 04-14-12, 19:05
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

You need to re-run TDSSKiller and have it fix this that you previously skipped:
Quote:
Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip
Attach the new log.


Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
  • O4 - HKLM\..\Run: [PC Health Status] C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
  • O4 - HKCU\..\Run: [PC Health Status] C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
  • O4 - HKUS\S-1-5-18\..\Run: [PC Health Status] C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe (User 'SYSTEM')
  • O4 - HKUS\.DEFAULT\..\Run: [PC Health Status] C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe (User 'Default user')


After clicking Fix exit HJT.


Now we need to use ComboFix by sUBs
  • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    • If it is not on your Desktop, the below will not work.
  • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
  • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
  • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

Atjob::
File::
C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe
C:\Documents and Settings\All Users\Application Data\dK367807.exe
C:\Documents and Settings\Russ\Application Data\5CF06878.exe
Folder::
C:\Documents and Settings\All Users\Application Data\Ask
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PC Health Status"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"PC Health Status"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PC Health Status"=-
[HKEY_USERS\S-1-5-21-790525478-1078145449-725345543-1004\Software\Microsoft\Windows\CurrentVersion\run]
"PC Health Status"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6D0DA9FC-64FA-458B-9D32-9ED32032D3DD}]
  • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
  • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
  • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  • Now use your mouse to drag CFscript.txt on top of ComboFix.exe



  • Follow the prompts.
  • When it finishes, a log will be produced named c:\combofix.txt
  • I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.



Run CCleaner (Not the registry side of things, just the cleaner) to be rid of temp files.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-20-12)
  #7  
Old 04-15-12, 03:02
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Re: Malware installed by a Trojan Horse

Okay, First off, I had an alert from Ad Aware about:
Win32.TrojanDropper.Daws, with a filename of 9df63b0b.exe(4512)

Ran TDSSKiller and had it delete the indicated problem. It ran without incident.

I uninstalled my AVG when I originally started the Read & Run Me. Didn't reinstall it, since I'm doing nothing else with this machine until it is fixed.

I shut down my AdAware to run analyse.exe, and it ran without incident.

When I ran ComboFix, it started okay, then gave me a message that said ComboFix has expired, and asked to run in reduced functionality mode. Yes/No? I cliked Yes and all seemed fine until it restarted the computer, at which point AdAware restarted. I shut it down again; hopefully it didn't cause any problems.

My symptoms seem to be gone. But as I said, I haven't been using this machine. I'll keep an eye on it...


And then today...

I noticed my wife's laptop gave the same error message that this machine did earlier, about Internet Explorer using a large amount of memory. It doesn't have any other symptoms, so hopefully I'm just being paranoid. I don't know if anything has crossed through my network, but I'm concerned so I'm going to run it through the Run & Read Me.
Attached Files
File Type: txt CFlog.txt (16.3 KB, 1 views)
File Type: zip MGlogs.zip (389.8 KB, 1 views)
File Type: txt TDSSKiller.2.7.28.0_14.04.2012_22.38.11_log.txt (83.0 KB, 1 views)
Reply With Quote
  #8  
Old 04-15-12, 18:11
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

Download a fresh version of Combofix, let it overwrite the old copy.


Now we need to use ComboFix by sUBs
  • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    • If it is not on your Desktop, the below will not work.
  • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
  • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
  • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

DirLook::
c:\documents and settings\Russ\Application Data\Sigi
c:\documents and settings\Russ\Application Data\Caky
File::
c:\documents and settings\Russ\Application Data\9DF63B0B.exe
c:\documents and settings\NetworkService\Application Data\5CF06878.exe
c:\documents and settings\NetworkService\Application Data\9DF63B0B.exe
c:\documents and settings\NetworkService\Application Data\DDA3363F.exe
c:\documents and settings\NetworkService\Application Data\FBAD0180.exe
  • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
  • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
  • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
  • Now use your mouse to drag CFscript.txt on top of ComboFix.exe



  • Follow the prompts.
  • When it finishes, a log will be produced named c:\combofix.txt
  • I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.



Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-20-12)
  #9  
Old 04-15-12, 23:30
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Re: Malware installed by a Trojan Horse

Alright, Re-downloaded ComboFix and ran it. Thought I had shut off my AVG, but it popped up in the middle with a warning. So after it finished, I uninstalled AVG again, then ran ComboFix again. Uploading both logs, just in case. The second one is CFlog2.txt

No problems with MGtools. Logs attached.

Thank you again for your help, and having this site up!
Attached Files
File Type: txt CFlog.txt (16.3 KB, 0 views)
File Type: txt CFlog2.txt (13.6 KB, 1 views)
File Type: zip MGlogs.zip (391.2 KB, 1 views)
Reply With Quote
  #10  
Old 04-16-12, 10:57
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

Everything looks good now. Ready for final steps?
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-20-12)
Sponsored links
  #11  
Old 04-18-12, 14:30
Quackling Quackling is offline
Private E-2
 
Join Date: Apr 2012
Location: Sacramento, CA
Posts: 11
Thanks: 7
Thanked 0 Times in 0 Posts
Default Re: Malware installed by a Trojan Horse

Um... Yes?
Reply With Quote
  #12  
Old 04-18-12, 17:54
Kestrel13!'s Avatar
Kestrel13! Kestrel13! is offline
Super Malware Fighter - Major Dilemma
 
Join Date: Apr 2007
Location: cloud cuckoo land
Posts: 28,445
Thanks: 919
Thanked 3,615 Times in 3,524 Posts
Default Re: Malware installed by a Trojan Horse

Quote:
Um... Yes?
Well here ya go! Cheers!

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
  2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
    • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
    • "%userprofile%\Desktop\combofix" /uninstall
      • Notes: The space between the combofix" and the /uninstall, it must be there.
      • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
  3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
  6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  7. Go to add/remove programs and uninstall HijackThis.
  8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
    • Refer to the cleaning procedures pointed to by step 7 of the READ ME
      for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
  10. After doing the above, you should work thru the below link:
__________________
Have we been helpful? Did our services here at MajorGeeks save you a whole lot of cash? If you would like to bequest a small amount as a token of your appreciation, please look out for the yellow 'Donate' button on the top right of any page. Thanks!
Reply With Quote
The Following User Says Thank You to Kestrel13! For This Useful Post:
Quackling (04-20-12)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Trojan Horse Crypt.ANVH and other possible malware skagator Malware Removal 1 01-18-12 14:33
malware issues : trojan horse agent_rxj plasmablade Malware Removal 8 02-22-11 13:47
Malware Removal - Trojan Horse Sheur2 Infection - Please Help! Tradius Malware Removal 1 09-04-09 14:36
Trojan Horse (zlob.trojan) and Malware (Log Included) FroggerMan Malware Removal 1 04-23-08 01:00
AVG Says Infected With Trojan Horse Generic5.guh,trojan Horse Backdoor.agent.iql mrpugowski Malware Removal 2 08-08-07 12:06


All times are GMT -5. The time now is 00:57.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger