Can't Remove TR/Dldr.Murlo.NN.3 [trojan] (http://abb.633f94d3.info/abb.gif)

Discussion in 'Malware Help (A Specialist Will Reply)' started by fanisss, Aug 4, 2008.

  1. fanisss

    fanisss Private E-2

    Hello all, unfortunately my first post is due to malware removal. First of all, I assume that I have the same problem with this thread http://forums.majorgeeks.com/showthread.php?t=165030 but I couldn't generalize the given solution for my case.

    I currently have 6 PCs with the same exactly problem and Avira Antivir Premium installed: After removing a bunch of infected files (Murlo.NN.3 as well as Parite.B and Almanche32.B) the PC seems clean. However, from time to time a URL is tried to been accessed (http://abb.633f94d3.info/abb.gif) which means that there is still something installed in the computer; that shouldnt. This file probably tries to download further infected files to the computer, but the antivirus successfully blocks it. In some of the PCs, some other files are also being detected such as C:\Documents and Settings\25\Local Settings\Temp\wmsetup.dll. Other files that have been initally removed and may give a hint are linkinfo.dll, rundll.exe, businesn.dll, as well as an altered hosts (system32\etc) file.

    If the antivirus remains installed, there seems to be no problem but because the PCs belong to an Internet Cafe with Deep Freeze running, we would like to remove the antiviruses. The problem began when we unlocked deep freeze due to maintenance reasons. I assume that the virus was installed through network shared folders. I had previously let by mistake all root hard drives shared; I now disabled the sharing of these drives. Is it still possible that a virus can be transmitted over the network if the PCs have no shared folders/drives?

    I attach the logs of one of the PCs; I guess that if a solution is found for one of them, all of the PCs will be able to be fixed.

    Thanks in advance for your time,
    Fanis
     

    Attached Files:

  2. fanisss

    fanisss Private E-2

    Edit by chaslang: Merge two thread together. Remove dup logs
     

    Attached Files:

    Last edited by a moderator: Aug 4, 2008
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Are you still having problems?
     
  4. fanisss

    fanisss Private E-2

    Thanks for your reply. Yes I still have the same problems I mentioned in my previous post.

    Sincerely,
    Fanis.
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    • Does it only happen with one particular browser?
    • Does it happen in safe boot mode?
    • Disable all browser addons! Does it still happen?
    If still having problems, I suggest you do the below and attach logs requested from each.
    What are all the below recent folders? Games??? Are you sure all of this stuff is clean and trust worthy?
    Code:
    2008-07-30 02:01 <DIR> d-a------ C:\Program Files\Touchstone
    2008-07-30 01:54 <DIR> d-a------ C:\Program Files\SpellForce
    2008-07-30 01:33 <DIR> d-a------ C:\Program Files\Sierra Entertainment
    2008-07-30 01:32 <DIR> d-a------ C:\Program Files\Puzzle Quest
    2008-07-30 01:20 <DIR> d-a------ C:\Program Files\Konami
    2008-07-30 00:36 <DIR> d-a------ C:\Program Files\Funcom
    2008-07-30 00:07 <DIR> d-a------ C:\Program Files\Assassin's Creed
    2008-07-29 23:57 <DIR> d-a------ C:\Program Files\Aspyr
    What are all the below recent folders? Games??? And why are they HIDDEN? Are you sure all of this stuff is clean and trust worthy?
    Code:
    2008-08-04 22:20:41 -------- d--h--w C:\Program Files\Steam
    2008-08-03 02:21:37 -------- d--h--w C:\Program Files\Valve
    2008-08-01 03:58:32 -------- d--h--w C:\Program Files\MOHAA
    2008-08-01 03:49:30 -------- d--h--w C:\Program Files\MAME
    2008-07-29 22:14:07 -------- d--ha-w C:\Program Files\id Software
    2008-07-29 21:19:59 -------- d--ha-w C:\Program Files\Electronic Arts
    2008-07-29 20:43:10 -------- d--h--w C:\Program Files\Codemasters
    2008-07-29 20:43:02 -------- d--h--w C:\Program Files\Microsoft Games
    2008-07-29 20:42:52 -------- d--h--w C:\Program Files\Firefly Studios
    2008-07-29 20:42:42 -------- d--h--w C:\Program Files\Starbreeze Studios
    2008-07-29 20:42:39 -------- d--h--w C:\Program Files\THQ
    2008-07-29 20:42:38 -------- d--h--w C:\Program Files\Monte Cristo
    2008-07-29 20:42:38 -------- d--h--w C:\Program Files\3DO
    2008-07-29 20:42:34 -------- d--h--w C:\Program Files\Atari
    2008-07-29 20:42:33 -------- d--h--w C:\Program Files\Activision
    2008-07-29 20:42:24 -------- d--h--w C:\Program Files\Ubisoft
    2008-07-29 20:42:24 -------- d--h--w C:\Program Files\NumLock
    2008-07-01 02:46:34 -------- d--h--w C:\Program Files\Warcraft III
    2008-06-09 00:15:21 -------- d--h--w C:\Program Files\mIRC
     
  6. fanisss

    fanisss Private E-2

    Sorry, I didnt explain my problem well. This URL is tried to be accessed while there is no activity at all in the PC, no browser running. I am notified from the antivirus only. The problem is that when the antivirus is not running, the URL is accessed and a variety of infected DLLs are downloaded, hooked into the registry, the hosts file is changing etc.

    In pure safe mode without networking it wont; as it doesn't in normal mode when the LAN connection is disabled. The trojan downloaded is only activated (as far as I understood) when the PC can reach the Internet.

    Regarding safe mode with networking, I am not really sure yet as the URL is accessed at random time intervals. The last 45 minutes that I left a PC in safe mode (where Antivir real-time protection is not enabled) no suspicious activity took place; as far as I can understand.
    Correct me if I am wrong, but I think given the aforementioned details, there is no issue regarding a specific browser. Moreover I believe that there is no add-on installed as both IE and Firefox were cleanly installed without any mods added-on.

    There are recently installed (in the fatal Deep Freeze unlock) games. I am as sure as I can be that they are clean (checked with Antivir & Nod - fully updated).

    Games as well, they are hidden for not a specific purpose (but I made them, not a malware).

    NOTE1: In this PC (in the others not) except the suspicous URL that is tried to be accessed, 2 files are detected/deleted and later on recreated.
    1. C:\Documents and Settings\25\Local Settings\Temporary Internet files\abb.gif (The file that the suspicious URL offers)
    2. C:\Documents and Settings\25\Local Settings\Temp\wmsetup.dll
    Both are characterized by Avira AntiVir Premium as being infected with TR/Dldr.Murlo.NN.3 [trojan].

    NOTE2: Just a hint (maybe): In the 2 PCs that I ran MGtools, I found the following entry on runkeys.txt which seems suspicious and I can't identify:
    sa.dat 5 Aug 2008 6 "SA.DAT"​
    under the "Showing Shared Tasks Folder". Is there a chance that it may be related somehow with the trojan?


    Thanks again for your effort. The scans will take a while so I will post the logs as soon as they are ready in a new reply.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    In your first message you mentioned have a Parite.B infection. If you had this infection, then you may still have it and it may have infected many if not all executable files on your PC and you may be looking at a reinstall. Removal of infections like this can sometime render a PC unreliable to unbootable. This can happen because the files that are infected may not be cleanable and this will result in them being deleted. If they are required system files, the PC will no longer boot or may boot but could have strange behavior.

    You need to install a real true bidirectional firewall too which may help. Please install one of the below ( only install one ):

     
    Last edited: Aug 6, 2008
  8. fanisss

    fanisss Private E-2

    Dear chaslang,

    Unfortunately I was unable to complete either of the 2 online scans you suggested earlier.

    Panda Active Scan freezed 3 times in 37%; after many hours of scanning. IE was still working but no particular file was being checked, neither I was able to cancel it or get the logs so far. BTW, it had detected so far 7 infected files, 2 suspicious and 6 vulnerabilities.

    Trend Micro HouseCall also froze (with Firefox as with IE did not even began scanning but rather froze in the "Installing & Update" step). It also detected 1 malware so far (before checking though "Windows" directory), characterizing it as PE_PARITE.A. I was unable to get further information (like which file was the infected one) or resolve the threat.

    Just to mention something about the "Parite" threats: I am almost certain that executables (as well as HTMLs and TXTs) infected by Parite.A/B are due to an infection on the servers around 1 year ago, which was successfully resolved; on the servers at least.

    Another problem is that yesterday, yet 2 more PCs that have been unlocked from Deep Freeze for maintenance (1 week ago, along with the already infected ones) started to show incidents of infection. As I perceive it, the virus was installed to most of the PCs - if not on all - at that day, but it is activated in a "random" way.

    Is it possible to proceed without the logs of the online scanners? Any alternative scanner/solution? Should I try more things such as running HouseCall with quick scan selected, or disabling Avira's AntiVir first?

    I also installed Comodo Personal Firewall and it is currently scanning my system for malwares. Will you need any logs from Comodo? Should I do/check something specific on it or just let it run on background?

    I really appreciate your effort and hope that we will find where the remainders of this malware reside.

    Fanis
     
  9. fanisss

    fanisss Private E-2

    OK, here is Comodo's log from the scan suggested during installation. No suspicious files, just mIRC and Remote Administrator's 2.1 components; which I have installed myself.

    I also found and attached a strange file on %temp% which may be Panda's Active Scan log file, as far as it had scanned before crushing. I don't know if it is of any help.

    Moreover, I configured Comodo Defense Security Level at "Paranoid", left Firewall level at the default "Safe Mode". I checked the processes list, nothing I dont know.. I also got some notifications about connecting to the Net Cafe's server, everything seems fine.

    Meanwhile, Antivir warned me again for trying to access infected files as well as the infamous URL, but Comodo did not show anything! Something strange that I see in my current active connections is the following:

    System TCP OUT is actively communicating with both of our servers at their 139 port from this PC's 1140 & 1267 ports.​

    However I think that is from file sharing because as I read and write files to the servers "Bytes In" and "Bytes Out" are increasing.

    Finally, I started again HouseCall with "Recommended Scan" option, but it's going to take a while (if it won't crush again). If any log/screenshot/further information might be useful to you, just ask me.

    Fanis
     

    Attached Files:

  10. fanisss

    fanisss Private E-2

    I managed to run ActiveScan by installing and using IE 7. The log is attached. I didn't try to clean anything at the end of the scan as it requred registration and I was not sure what I was supposed to do.

    I am trying to run also HouseCall, if I succeed I ll upload the log soon.

    Regards,
    Fanis
     

    Attached Files:

  11. fanisss

    fanisss Private E-2

    Sorry for all these posts, I just found something new. HouseCall is probably freezing because the "java" process eventually reaches 1GB of memory and thus the PC is stucking.

    However, I can overcome this by making 3-4 manual scans and set it to check a smaller range of folders each time.

    The interesting thing is that while scanning the Windows folder, it found a PE_PATCHED.DV infection on the file C:\windows\system32\actxprxy.dll.

    I used the online scanner at http://virusscan.jotti.org/ for this file, and only Ikarus Antivirus is detecting it as Trojan-Downloader.Win32.Small.ap; no other antivirus says something. I double-checked it by scanning only these DLLs from the PC infected so far, and all of them are infected. On the contrary, these DLLs from the non-infected PCs are not detected as malware.

    I hope this can tell you something more. For the time being, in another PC (not the one we are working on together) I replaced the infected file with a legitimate one, full scanned it again, and left it like this to see how will behave.

    Fanis
     
  12. fanisss

    fanisss Private E-2

    Dear Chaslang,

    Finally I didn't manage to run MircroTrend HouseCall. Even if I manually select only few folders for scan, it always scans the whole hard disk and eventually the system runs out of memory. However, except the malware it detected previously in the actxprxy.dll, it does not detect anything else.

    I also tried something else in order to get more hints about the virus: I ignored some of Avira's Antivir messages regarding the files it detects every once in a while in order to see what is really hapenning from comodo alerts.

    I attached some screenshots from Comodo's alerts that may tell something more about what the virus does. After ignoring the initial warnings from Antivir, QQ_Update.cab, wmsetup.dll, update[1].gif, and abb[1].gif were created in C:\windows\temp and C:\Documents and Settings\X\Local Settings\Temp (where X is local user, "NetworkService", and "LocalService").

    Despite these images, it also created a unxxx.bat that automatically removes C:\WINDOWS\TEMP\QQ_Update.cab (the file that is downloaded and does more of the stuff). Moreover, it tried to access cmd.exe and rundll32.exe.

    Finally, in the active connections of Commodo I saw that explorer.exe was connected through TCP on port 80 of 60.191.223.76. I did a tracert for this IP and it seems suspicious, maybe the source from where further trojans were downloaded.

    I really hope that these information will be useful to you.

    Sincerely,
    Fanis
     

    Attached Files:

  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You really should read this: Don't Bump! It Only Hurts You!!! I know you don't mean to be bumping but the end result on you getting an answer is still the same.


    I think the first thing we need to do us uninstall Deep Freeze because it may actually be getting in the way of removal. You will need to keep this uninstalled until we have fixed the problem. Obviously it did not protect you from this anyway and if may just be making it harder to fix.

    Now run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


    No goto Windows Update and install all updates for Windows. For now you can skip Windows XP SP3 if you do not want it; however you need the other updates. Even Panda and other scans are pointing out all the vulnerabilty issues that you have and they must be corrected.


    Is the below startup process something you installed?
    O4 - Global Startup: Icons.lnk = bats\icos.bat


    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines (some of them may not exist! Just ignore and continue) but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ÓõíäÝóåéò
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O4 - HKLM\..\Run: [BSplayer_WhenUSave_Installer] C:\Program Files\BSplayer_WhenUSave_Installer\BSplayer_WhenUSave_Installer.exe
    O21 - SSODL: DesktopWin - {DA191DE0-AA86-4ED0-4B87-292A3D48BE99} - C:\WINDOWS\AppPatch\DesktopWin.dll

    After clicking Fix, exit HJT.



    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    Last edited: Aug 8, 2008
  14. fanisss

    fanisss Private E-2

    Dear chaslang,

    I followed the whole procedure, the logs are attached. Just one note, I replaced even on this PC the actcprxy.dll with a legitimate one (I was too curious:)). The good thing is that in 3 PCs that I replaced also this file, things seem ok. They are running without antivirus for at least 40 hours now and nothing has been downloaded.

    However, there were PCs that showed malware indicators after 3-4 days of their infection, thus, I still have to wait in order to be sure whether they are clean or not.

    If I see anything strange hapenning on this PC I will tell you.

    Fanis

    PS: The startup process O4 - Global Startup: Icons.lnk = bats\icos.bat is something I installed, completely safe.
     

    Attached Files:

  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It looks like the CFScript.txt file may not have been created properly since it does not look like ComboFix even attempted any of the deletions. Many of those did not exist but they are often seen with the GamPass infection so I was just covering all the bases.


    If you are not having anymore problems then I would not worry about it now. I would just move on with the below final cleanup.

    Also, it does not look like you remove Windows Messenger as requested because I still see it running.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    3. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\combo-fix folder from combofix.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    9. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  16. fanisss

    fanisss Private E-2

    Dear chaslang,

    For the time being everything seems alright. When I removed windows messenger through the tool, it asked me for a restart which I didn't.

    Thanks for your effort and I hope that I wont see anything strange in the following days.

    Fanis.
     
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds