6 Hidden objects

Dear Major Geeks,

After a full scan with Avira there are 6 hidden objects in the scan report and I am not sure if these are malware or not. Would yo please help me identify these objects.

Thanks,

Mike.

 

Hi mfozaydin,

Can you attach the log from Avira that shows these hidden objects? (How to attach items to your post)

 

Here it is.

 

Yes these look like TDL rootkit associated files

http://www.bleepingcomputer.com/startups/tdssserv.sys-23624.html
http://www.threatexpert.com/files/tdssserv.sys.html

If Avira can't remove them, I would recommend doing a full malware removal by reading and completing as much of this as possible: READ & RUN ME FIRST Malware Removal Guide
Post the rest of the logs and we'll help you remove all traces of infection.

 

Hi, Thisisu

I am attaching all the logs after the scans. Please let me know how I should proceed.

Thanks.

 

From Add/Remove Programs (via Control Panel), please uninstall the below:

• Ask Toolbar

By the way, what is this program? MCU It's also in Add/Remove.

Please download Disable/Remove Windows Messenger by Doug Knox to your desktop.
See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double-click MessengerDisable.exe
• Place a check-mark in Uninstall Windows Messenger
• Click Apply
• Click Exit

http://img38.imageshack.us/img38/7284/yse.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Shut down your protection software now to avoid possible conflicts.
Note: This is actually Trend Micro HiJackThis - v2.0.4
Choose Do a system scan only and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]DirLook::[/COLOR]
C:\Application Data
[COLOR="DarkRed"]FireFox::[/COLOR]
FF - ProfilePath - c:\documents and settings\M.Fevzi Ozaydin\Application Data\Mozilla\Firefox\Profiles\6ba90qyz.default\
FF - prefs.js: keyword.URL - hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\asodymy.pif
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\furafawa.bin
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\inipoqoxo.com
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\lozynewev.db
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\ocygivima.dl
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\qyxucinahy._dl
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\zufice._dl
c:\program files\Common Files\bupocyhawo.scr
c:\program files\Common Files\ziqiqosir.dll
c:\program files\Common Files\ehelu.bin
[COLOR="DarkRed"]Folder::[/COLOR]
C:\Documents and Settings\M.Fevzi Ozaydin\Application Data\AskToolbar
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\AskToolbar
C:\Documents and Settings\All Users\Uniblue
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\temp\7zO4ACADD6B
C:\Program Files\Ask.com
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\Application Data\Kiwee Toolbar
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{1645A33F-0A96-4315-904E-29E188E7720E}]
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (How to attach items to your post)

http://img40.imageshack.us/img40/6925/getlogs.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

Thisisu,

1) I uninstalled the Ask Toolbar but it is a part of Avira so it also disabled my Avira Web Guard so should I leave it like this?

2) I couldn't find anything named MCU in Add/Remove Programs so what should I do?

3) I ran everything accordingly ad am attaching the logs.

Thanks.

 

For now, yes leave it like this.

Any idea what it refers to? I can give you a fix later on to remove it we find out it is causing any trouble. Right now we have to attend to a much bigger problem:

YOU HAVE AN INFECTED MASTER BOOT RECORD (MBR)!​

_________________________________________________________________​

WARNING​

MBR infections are only worsening and sometimes (rarely) make the computer unbootable after attempting to correct it. We recommend that you back up your data before hand. Then continue with the below if you wish to attempt to remove this infection:
_________________________________________________________________​

Do you have your Windows XP CD? We need it to restore a clean MBR.
If you do not have your Windows XP CD, you can create one with the Recovery Console (which is really all we need), here: Download Windows XP Recovery Console

Then see if you can boot from this CD and get into the Recovery Console. See the second section in the below link where it says "How to use the Recovery Console"

http://support.microsoft.com/kb/307654

If you can get to the command prompt of the Recovery Console, type fixmbr and hit enter. After it finishes type exit to reboot and remove the CD to allow Windows to boot normally.

If you were able to run fixmbr, rerun MBRCheck and attach a new log. Also tell me how things are working.

 

Thisisu,

1) I will fix the mbr but in the mean time as I am trying to follow this clean up procedure another thing just occurred. I just lost the volume icon and I have no sound on my laptop when playing music or a movie but I can stream radio.

2) MCU can be related to some plug-in that Firefox blocked a while ago before I updated to the current version.

3) My keyboard is also acting strange, some letters are not typing at first.

Please help.

Thanks.

 

What clean-up procedure are you referring to?

Let's get a clean MBR first and then we'll review your other issues.

 

Thisisu,

I performed the fixmbr and was able to reboot. I also did the MBRCheck again and am attaching the new log.
I meant this clean up procedure that you and I have been working on.

Thanks.

 

Good, this MBR is clean.

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop.
• Now run ComboFix.exe by double-clicking it.
• Follow the prompts, update if asked to, and attach its latest log. (How to attach items to your post)

http://img651.imageshack.us/img651/733/mgtools.png Now download a new MGtools to the root of your C:\ drive. Overwrite the existing one if prompted.
Refer to the following: Using MGtools
Attach MGlogs.zip after the scan is complete. (How to attach items to your post)

 

Thisisu,

I had to actually uninstall the Avira Anti-Virus to run the MGLogs.exe file this time. I am attaching the two new logs.

Thanks.

 

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]DDS::[/COLOR]
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
[COLOR="DarkRed"]File::[/COLOR]
C:\Documents and Settings\M.Fevzi Ozaydin\Local Settings\temp\AskSLib.dll
C:\setup.exe
C:\WINDOWS\azyt.com
[COLOR="DarkRed"]FileLook::[/COLOR]
C:\WINDOWS\system32\netprovcredman.dll
C:\layout.bin
C:\WINDOWS\system32\DRIVERS\snp2sxp.sys

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

http://img685.imageshack.us/img685/3557/tdsskiller.gif Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)

http://img40.imageshack.us/img40/6925/getlogs.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

Dear Thisisu,

I am attaching all the logs that you requested. The computer is running OK except for the things that I mentioned to you earlier:

1) My volume icon disappeared and I can't put it back. Since I don't have the XP CD I don't have access to sndvol32.exe file.

2)When I watch a video, for example; in YouTube there is no sound but I can stream a radio station and it is OK.

3) My keyboard is also acting strange some letters won't type at first, I have to press really hard.

4) I also had to uninstall the Avira Anti-Virus to run the MGLogs so I don't have it any longer.

Best regards.

 

Your logs are looking pretty good now.

I'm not sure why this happened. In any case, the file is already in your logs. It is in C:\Windows\system32 and C:\WINDOWS\system32\dllcache

Does using another keyboard solve this problem? This does not sound like a malware related problem.

• Was Avira reporting MGtools.exe as bad?
• Was AV Guard deleting/quarantining it when you tried to download/run it?

You will be able to reinstall it after I give you the final procedures (when your logs are clean).

Delete this file using Explorer: C:\layout.bin


http://img38.imageshack.us/img38/7284/yse.gif Run C:\MGtools\analyse.exe by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Shut down your protection software now to avoid possible conflicts.
Note: This is actually Trend Micro HiJackThis - v2.0.4
Choose Do a system scan only and select the following lines but do not click fix until you exit all explorer windows and all browser sessions including the one you are reading in right now:

After clicking Fix, exit out of Trend Micro HiJackThis - v2.0.4

http://img40.imageshack.us/img40/6925/getlogs.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

 

Thisisu,

1) Here is the new zip file.

2) I am still having the sound problem. I have no sound in a music video but television and radio streaming are OK. What is your take on this?

3) Yes, the sndvol32.exe file is there but I cant still replace the Volume Icon back. Could it be corrupted by malware and may be I should replace it?

Thanks.

 

These logs are clean

What type of file is the music video you are trying to play. What file extension is it? .wma, .mp4, .avi, .mpg, .mpeg ?

Yes it could have gotten corrupted.

Read the following: http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q319095

Since you do not have a Windows XP CD, you can download this file: SndVol32.exe and extract it to the directories I specified above. Back up the original files first (copy them to your desktop or simply rename them with something like sndvol32.ex_). Just in case..

Also you can try merging this .reg file into the windows registry: Restore Volume/Net Icon to Notification Area

Let me know which one of these works if any of them fix your sound issue.

You're welcome!

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Thisisu,

1) I really appreciate all the help. My laptop seems to be running OK, volume icon is restored and the sound is back on again.

2) When I re-install the Avira Anti Virus should I choose the Web Guard option by Ask.com or not since you had me disable it during the clan up procedure.:confused

3) What should I do with the files I saved on Desktop such as Messenger Disable, AutoRunDisable, NetVol, etc.

Best regards.

 

I'm glad to hear that. What eventually fixed it?

I should not have asked you to remove Ask Toolbar. I did not realize that it would break certain features of Avira. Go ahead and reinstall Avira with the Web Guard option.

You can now delete all of these.

 

Thisisu,

1) I think my sndvol32.exe file was corrupted somehow and replacing it solved the problem.

2) One last thing that I would like to ask you, when I open System Configuration Utility under the Startup Menu Bar i see lots of items and I don't know if all of them should be checked or not. Also in Windows Task Manager there are lots of processes running and I don't even know what they are. Would you help me with this or direct me to where I can get some understanding of it.

Thanks again. :major

 

Sure, this should help: Dealing with Startup Processes

 

Thisisu,

I have just noticed that the file TDSSserv.sys (part of six hidden objects) is still in my registry. Its exact location is HKEY_LOCAL_MACHINE\SYSTEM\CNTROLSET0003\SERVICES

is this OK?

Thanks.

 

I have a feeling it's a broken registry entry but go ahead and do the following:

Please download SystemLook by jpshortstuff to your desktop.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :regfind
  tdss
  :service
  tdss
  :process
  tdss
  :filefind
  tdss
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (How to attach items to your post)
  Note: The log be found on your desktop entitled SystemLook.txt

 

Thisisu,

Here is the log file.

Thanks.

 

Can you find out if it is also in Device Manager?
Start > run > devmgmt.msc
Now click View > Show hidden devices
Is anything related to TDSS listed under the Non-plug and Play Drivers section of Device Manager?

http://img51.imageshack.us/img51/9017/regedit.gif Copy the bold text below to Notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "All files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

If it was successful, reboot and perform the SystemLook steps in the above post again.

 

Thisisu,

1) It is not in Device Manager

2) It was successful and I ran the SystemLook again. See attached.

3) When I looked at the Device Manager to search for the TDSS file I noticed 2 yellow warning signs: One is next to LogMeIn Kernel Information Provider and the other one is next to Scutum50 NDIS Protocol Driver.

Thanks.

 

I did not catch this earlier, but you never ran SAS or MBAM!

Go back to the Windows XP Malware Removal/Cleaning Procedure and complete both of those scans.

 

Thisisu,

I ran them both right before the clean up procedure started when I noticed 6 hidden objects but anyway here are the new ones.

ps) I uninstalled LogMeIn a while ago.

Thanks.

 

http://img87.imageshack.us/img87/5562/gmer.gif Now we need to run GMER.
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)

 

Here it is.

 

Go back to the READ & RUN ME FIRST Malware Removal Guide and complete step #6 involving defogger.exe.

Once you have done that, continue to the below:

http://img6.imageshack.us/img6/2163/avengerh.gif Please download The Avenger by Swandog46 to your desktop.

• See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif
• Open avenger.zip and extract avenger.exe to your desktop
• Run avenger.exe by double-clicking on it.
• Click OK at the warning to continue to use The Avenger.
  Note: Do not change any of the check box options!
• Shut down your protection software now to avoid possible conflicts.
• Copy everything in the code box below, and paste it into the Input script here: text-field.
  
  Code:

  [COLOR="DarkRed"]Files to delete:[/COLOR]
  C:\Windows\System32\drivers\tdssserv.sys
  C:\Windows\system32\drivers\TDSSmhct.sys
  C:\Windows\system32\TDSSxfum.dll
  C:\Windows\system32\TDSSlxwp.dll
  C:\Windows\system32\TDSSsihc.log
  C:\Windows\system32\TDSSrhym.dll
  C:\Windows\system32\TDSStkdu.log
  C:\Windows\system32\TDSSbubx.log
  [COLOR="DarkRed"]Registry keys to delete:[/COLOR]
  HKLM\SYSTEM\ControlSet003\Services\TDSSserv.sys
  [COLOR="DarkRed"]Drivers to disable:[/COLOR]
  tdssserv
  tdssmhct
  

• Now click the http://img651.imageshack.us/img651/7710/avengerexec.png button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when The Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.
• Attach avenger.txt to your next message. (How to attach items to your post)

http://img839.imageshack.us/img839/3005/combofixicon.gif Now rerun ComboFix
If you need a new copy of it, you can redownload it from here: ComboFix.exe
Attach ComboFix.txt when it is finished. (How to attach items to your post)

http://img87.imageshack.us/img87/5562/gmer.gif Now we need to run GMER.
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)

 

Thisisu,

This is not working. I ran the defogger first (which I don't have any CD Emulation software) then I ran the Avenger and I can't reboot I get the Blue Death Screen so I chose the "Start Last Good Configuration" setting to be able to reboot my laptop. I did not do anything further at this point.

Attached is the defogger log.

Thanks.

 

I want to see what the blue screen said so if you can, do the following:

Find this folder: C:\Windows\Minidump
open this folder
inside, there may be some .dmp files
these are the crash logs from when you get a BSOD
please .zip any files in this folder using WinZip or 7Zip and attach that .zip file to your next post so I can analyze them.

Also, can you check to see if a Avenger.txt was ever created?

 

1) I did not get a log from Avenger since I couldn't reboot.

2) Here is the dump .zip file.

Thanks.

 

This may be a new TDL4 variant. The latest TDSSKiller (v2.5.22.0) does not detect it. In any case, the following malicious driver is listed in the BSOD log you attached.

hvyajxbr.sys

This driver is not in any of your other logs we have gathered so far.

I've been reading that the latest TDL4 variants are not showing any signs of obvious infection like before, such as redirects, pop-ups, and a slow PC.

I wish I could, but I cannot assure you that you will not receive another BSOD by trying to completely remove all traces of infection. It's sometimes apart of how the infection works -- attempting to remove malware (especially when a driver is involved) can cause BSODs. I can't even assure you that "Reboot to last known good configuration" will work next time if it happens again.

The choice is up to you, you obviously do not have to complete these steps.

If you decide you want to continue investigating further, considering the risks I mentioned, proceed with the below:

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
hvyajxbr
TDSSserv
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\system32\drivers\hvyajxbr.sys

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

 

Thisisu,

1) I am very hesitant about this wouldn't you? This is my only PC and I can not afford to lose it right now. Do you have any idea how this malicious driver is affecting my laptop?

2) Would you at least help me at this point with what I asked you before:

"3) When I looked at the Device Manager to search for the TDSS file I noticed 2 yellow warning signs: One is next to LogMeIn Kernel Information Provider and the other one is next to Scutum50 NDIS Protocol Driver."

ps) I uninstalled LogMeIn a while ago but there is still some left over files I see.

Thanks.

 

I will answer as much as I can tomorrow evening. I will try to go into detail and don't have the time to do that right now. Hold off on running the CFScript.

 

I understand the stress and anxiety involved when a PC is not available to use due to it having problems a little too well. :-o

Yes I do, but I would like to quote Grinler, a highly respected malware analyst as he sums it up better than I can.

If you would like to read more about TDSS, see the below links:

• https://www.infosecisland.com/blogview/9700-Windows-Remains-Vulnerable-to-TDL4-Rootkit.html
• http://www.securelist.com/en/analysis/204792044/Bootkit_the_challenge_of_2008
• http://www.securelist.com/en/analysis/204792131/TDSS
• http://www.eset.com/resources/white-papers/TDL3-Analysis.pdf
• http://www.drweb.com/static/BackDoor.Tdss.565_(aka TDL3)_en.pdf
• http://virusvn.com/download/video-tutorial/tdl3_analysis_paper.pdf

Special thanks to quietman7 for providing the above links.

If you are asking about more information on the drivers, the first one as you probably guessed is related to LogMeIn. Here is a sample of it from your latest ComboFix log.

The Scutum50 driver is related to Printing Communications Assoc., Inc.
Sources:

• http://www.systemlookup.com/Drivers/4098-Scutum50_sys.html
• http://www.runscanner.net/file/Scutum50.sys.html

It is also in your ComboFix logs as:

The warning signs / exclamation marks in Device Manager are not bad like malware. In your case, it just means that the driver is not fully functioning because most of the files associated it were removed whenever the applications associated with them were uninstalled. They are only remnants of non-malicious software.


Please download SystemLook by jpshortstuff to your desktop.

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  
  Code:

  :regfind
  c_592355
  hvyajxbr
  :service
  hvyajxbr
  :filefind
  c_592355
  hvyajxbr
  atapi.sys
  

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply. (How to attach items to your post)
  Note: The log be found on your desktop entitled SystemLook.txt

 

Thisisu,

First, Thank you for the information on the TDSS and the drivers. I ran the System Look again and am attaching the new log.

Second, After we get done with the TDSS I really appreciate if you could help me get rid of LogMeIn and the Scutum50 from my system.

Thanks again.

 

You're welcome.
The new log is actually very interesting as it reveals a malicious service not seen in any previous log (I highlighted it in red):

I don't mind helping you with that.

Do you want me to prepare a fix to try to remove this detected service?

 

Yes, but please don't forget that this is my only PC and I can't afford to lose it.

Question: Was this new malicious service related to hvyajxbr.sys or not? Was it already in the system and never detected before or ?:confused

Thanks.

 

Print this out before doing anything else: ERUNT - The Emergency Recovery Utility NT
Refer to this in case your PC does not boot after this fix. ERUNT is installed before ComboFix starts scanning.

Yes -- look at the Image Path in what I quoted. hvyajxbr.sys was what I found in the BSOD log.

Both hvyajxbr.sys and bljcl were not detected prior to you getting the BSOD.

Going to start slow:

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
bljcl
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\system32\drivers\hvyajxbr.sys

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

http://img651.imageshack.us/img651/733/mgtools.png Now download a new MGtools to the root of your C:\ drive (not to your desktop!).
Refer to the following: Using MGtools
Attach MGlogs.zip to your next message. (How to attach items to your post)

 

Thisisu,

1) Before I do this just allow me to get some understanding of this ERUNT program download, installation and usage in case of my PC doesn't reboot normally. This is serious stuff for me which I haven't experienced before and as I mentioned to you earlier this is my only PC.

2) In the mean time, is it possible that you could help me fix the LogMeIn and Scutum50 problems.

Thanks.

 

That is not the purpose of this forum, and what you consider a problem isn't actually a problem.

 

"I don't mind helping you with that."

No problem, I will seek help on this in Drivers forum. The reason I asked was because of you mentioned before that you wouldn't mind helping me on this.

Thanks.

 

I was referring to what you said here:

 

Thisisu,

Hi again, it has been a while since we had corresponded last time regarding this malware. Here is what happened: I mentioned to you earlier that I needed to figure out the effective use of ERUNT because I wasn't familiar with it and neither were most of the friends I asked but when I ran my usual monthly clean up SpyBot detected the "hvyajxbr.sys" which wasn't the case before and removed it. I did not delete it from the "recovery" yet before I asked you. But on the other hand the "bljcl" still exists in the registry so I was wondering if this would give us an idea that using the Combofix to "killall" may or may not cause my pc not being able to reboot as it happened earlier.

Thanks.

 

Hi mfozaydin,

Yes last time we talked I was trying to convey to you that it is somewhat risky removing malware. Although we rarely ever have problems; the below is from the Read and Run Me First thread:

Also, The KillAll:: command is basically there to kill all processes on your PC while ComboFix executes itself. This is to prevent potential malicious processes from interrupting/hindering ComboFix from running properly.

Since Spybot was able to remove hvyajxbr.sys, ComboFix is basically only being told to remove the driver/service it is/was associated with.

 

Since it has been over a month -- There is probably a more effective way of removing the rest of the malware from your PC (tools have been updated, better detection and removal methods, etc).