Malware installed by a Trojan Horse

[Quackling]

Okay. So my son allowed a trojan horse to get installed on the family computer. I was running AVG at the time, and a scan found it and removed it. (I didn't take note of the name of it, only that it was a trojan.)
Over the next few days I noticed odd things, like the desktop appearance was Windows Classic, instead of Windows XP. When I tried to change it, it gave me an error message that it couldn't be done because something wasn't running. (Had I realized how bad it was, I'd have written down all these error messages, in case they'd help.)
Oh, I should mention that I'm running Windows XP SP3. (Wiped and reinstalled within the last few months, if it matters.)
There seemed to be occasional browser redirects, but I didn't see it consistently. Pale Moon would stop responding after loading the home page, every time. Google Chrome started acting up too, so I uninstalled both of them, planning to reinstall later.
But the primary symptom I saw, and still see, is continuous internet activity, even when there seems to be nothing running. Task Manager confirms constant Networking activity, as well as CPU usage.
When I reran full scans with either AVG or MalwareBytes AntiMalware, I noticed it spent a considerable amout of time going through Temporary Internet Files in a couple of spots, even after running CCleaner. Upon looking directly into the folder(s) indicated, I actually watched various internet files appearing before my eyes, when I wasn't surfing at all. Also in Task Manager, one of the svchost.exe instances seems to grab more and more CPU usage and Memory, until I get an error message that pops up and says something about Internet Explorer using huge amounts of memory, and recommending it be shut down and restarted. If I kill that instance, the CPU and Network activity drop to where they should be, but after a short time it comes back.
Seems pretty clear I have Malware utilizing my machine in the background.
I ran MBAM and realized it wasn't finishing the scan before being shut down. I tried running it in Safe Mode, which worked, but it didn't find anything. (Also, further scans with AVG had found nothing.)
So I found you guys, and went through your Read Me Start Here process. I uninstalled MBAM, then reinstalled it to keep as close to your process as possible. It didn't occur to me until later that those earlier logs might have been useful.
SuperAntiSpyware, MalwareBytes AntiMalware and ComboFix seemed to run through fine.
RootRepeal froze up, then gave me a BSoD and restarted. I tried running it in Safe Mode, but it just froze up there too, so I moved on.
MGTools, also froze up. The last thing it said was to ignore any error messages, and stayed like that for two days. (I was out of town.) There was a log file for it though, so I'll post it with the others.
Did I miss anything?
Thank You! in advance for your help! I'm really impressed with the purpose and intent of this website! Good for you!

[Kestrel13!]

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run


Please also download MBRCheck to your desktop

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.

MGTools did not run properly.

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

• cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
• nwktst<-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
• GetRunKey <-- this will try to run all one scan from MGtools. Tell me what error messages, if any, you see.
• ShowNew <-- this will try to run all another scan from MGtools. Tell me what error messages, if any, you see.
• analyse <-- this attempts to run HijackThis. Be sure to click the Accept button twice in the license agreement popup or it will just sit there and wait.

Now look for the C:\MGlogs.zip file and attach it no matter what happened while doing the above.

[Quackling]

Thank you. I'll be able to do this tomorrow; I'm out of town right now.

Didn't see the Email at first; it was in my spam folder. Shouldn't have that problem again.

[Kestrel13!]

OK! I'll be about later after work, but late on.

[Quackling]

Okay. Ran TDSSKiller apparently successfully.

MBRCheck started okay, but crashed to a BSoD. Not sure if it matters but the message given was "MACHINE_CHECK_EXCEPTION" with the following:
"STOP: 0x0000009c (0x00000004, 0x8054e5f0, 0xb2000000, 0x00070f0f)"

GetRunKey gave a message saying, The system cannot find the file specified."

After GetRunKey finished, a window came up from Internet Explorer. The standard Do you want to show only content that was delivered securely? I suspect it was because of whatever the malware was running. I did not have Internet Explorer (Or any other browser) open at the time. I just closed the window, didn't click either answer.

Hijackthis only needed one Accept click, but then opened up a "MainMenu" with choices. I selected "Do A System Scan And Save A Logfile." Just in case, I'm uploading the Hijackthis logfile separately, as well.

[Kestrel13!]

You need to re-run TDSSKiller and have it fix this that you previously skipped:

Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Attach the new log.


Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

• O4 - HKLM\..\Run: [PC Health Status] C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
• O4 - HKCU\..\Run: [PC Health Status] C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
• O4 - HKUS\S-1-5-18\..\Run: [PC Health Status] C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe (User 'SYSTEM')
• O4 - HKUS\.DEFAULT\..\Run: [PC Health Status] C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe (User 'Default user')

After clicking Fix exit HJT.


Now we need to use ComboFix by sUBs

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

KILLALL::

Atjob::
File::
C:\Documents and Settings\Russ\Application Data\gqneqdpe.exe
C:\Documents and Settings\NetworkService\Application Data\gqneqdpe.exe
C:\Documents and Settings\All Users\Application Data\dK367807.exe
C:\Documents and Settings\Russ\Application Data\5CF06878.exe
Folder::
C:\Documents and Settings\All Users\Application Data\Ask
Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"PC Health Status"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"PC Health Status"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PC Health Status"=-
[HKEY_USERS\S-1-5-21-790525478-1078145449-725345543-1004\Software\Microsoft\Windows\CurrentVersion\run]
"PC Health Status"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6D0DA9FC-64FA-458B-9D32-9ED32032D3DD}]

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.



Run CCleaner (Not the registry side of things, just the cleaner) to be rid of temp files.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

[Quackling]

Okay, First off, I had an alert from Ad Aware about:
Win32.TrojanDropper.Daws, with a filename of 9df63b0b.exe(4512)

Ran TDSSKiller and had it delete the indicated problem. It ran without incident.

I uninstalled my AVG when I originally started the Read & Run Me. Didn't reinstall it, since I'm doing nothing else with this machine until it is fixed.

I shut down my AdAware to run analyse.exe, and it ran without incident.

When I ran ComboFix, it started okay, then gave me a message that said ComboFix has expired, and asked to run in reduced functionality mode. Yes/No? I cliked Yes and all seemed fine until it restarted the computer, at which point AdAware restarted. I shut it down again; hopefully it didn't cause any problems.

My symptoms seem to be gone. But as I said, I haven't been using this machine. I'll keep an eye on it...


And then today...

I noticed my wife's laptop gave the same error message that this machine did earlier, about Internet Explorer using a large amount of memory. It doesn't have any other symptoms, so hopefully I'm just being paranoid. I don't know if anything has crossed through my network, but I'm concerned so I'm going to run it through the Run & Read Me.

[Kestrel13!]

Download a fresh version of Combofix, let it overwrite the old copy.


Now we need to use ComboFix by sUBs

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

KILLALL::

DirLook::
c:\documents and settings\Russ\Application Data\Sigi
c:\documents and settings\Russ\Application Data\Caky
File::
c:\documents and settings\Russ\Application Data\9DF63B0B.exe
c:\documents and settings\NetworkService\Application Data\5CF06878.exe
c:\documents and settings\NetworkService\Application Data\9DF63B0B.exe
c:\documents and settings\NetworkService\Application Data\DDA3363F.exe
c:\documents and settings\NetworkService\Application Data\FBAD0180.exe

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  
  
  
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.



Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

[Quackling]

Alright, Re-downloaded ComboFix and ran it. Thought I had shut off my AVG, but it popped up in the middle with a warning. So after it finished, I uninstalled AVG again, then ran ComboFix again. Uploading both logs, just in case. The second one is CFlog2.txt

No problems with MGtools. Logs attached.

Thank you again for your help, and having this site up!

[Kestrel13!]

Everything looks good now. Ready for final steps?

[Quackling]

Um... Yes?

[Kestrel13!]

Um... Yes?

Well here ya go! Cheers!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!