Anyone with experience able to check if this file is malicious?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Aeril, Jun 9, 2011.

  1. Aeril

    Aeril Private E-2

    I've ran a file which ended up not doing what it was supposed to. I was already weary of the file to begin with so I've taken precautions of denying all outgoing traffic with my firewall as I think this file is a keylogger. Using processmonitor i see that it opens itsself, then creates a new file names tmpopen, runs that, then they both close, but they leave the created form open. (they close within a second). The activity in process monitor is also not normal, it accesses almost all my running processes.

    Thanks in advanced.
     

    Attached Files:

    Aeril, Jun 9, 2011
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Click on the following link and use the below steps to scan a file: Virustotal

    Click the Browse... button.
    Navigate to the file FileToBeScanned

    Where FileToBeScanned is the actual file to be scanned. Like C:\WINDOWS\System32\vdmt16.sys
     
    TimW, Jun 9, 2011
    #2
  3. Aeril

    Aeril Private E-2

    Hi TimW, thanks for the quick reply.
    I've scanned the file with virustotal, and finished with 2/42. Is it possible that if it were to create a seperate process (named tmpopen.exe) and do the malicious work there, that anti-virus's wouldn't be able to detect it?
     
    Aeril, Jun 9, 2011
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It's possible that some Av's wouldn't recognize it. Your best bet would be to go to the malware forum, do the Read and Run First instructions and then start a thread there with the requested logs attached so we can see what is going on.
     
    TimW, Jun 9, 2011
    #4
  5. Aeril

    Aeril Private E-2

    Alright, is there a way you could move this thread to that section so I don't have to re-create it? Even though it's only one thread, I like to keep forums clean from whatever i do haha
     
    Aeril, Jun 9, 2011
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Jun 9, 2011
    #6
  7. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Do you use MapleStory? ;) I have examined the files (the .exe and the .dll) and the text file that came with them and this is what I conclude it relates to.
     
    Kestrel13!, Jun 9, 2011
    #7
  8. Aeril

    Aeril Private E-2

    I only play when there are exploits released haha :p It turns out it was indeed a keylogger or something of the sort, added itsself to startup and such. I think it's removed now. Here's my logs. SuperAntiSpyware detected nothing.
     

    Attached Files:

    Aeril, Jun 9, 2011
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    What identified it as a keylogger? ?

    uninstall the below garbage which WILL invite in other nasties....
    TimW will review the rest of your logs tomorrow.
     
    Kestrel13!, Jun 9, 2011
    #9
  10. Aeril

    Aeril Private E-2

    Well it wasnt a keylogger specifically, if i recall correctly, malwarebytes detected it as a backdoor trojan or something.

    Just realised I posted the wrong mbam log, I did scans 3 times (each time when the computer restarted after a scan) because when mb would remove the files, they would reinstall on startup.

    Here are the other 2
     

    Attached Files:

    Aeril, Jun 9, 2011
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I don't think that what MBAM found was in any way connected to the files I checked. I could be wrong... but I have used Maplestory and I recognized the files...and upon looking at them it confirmed what I thought...
     
    Kestrel13!, Jun 9, 2011
    #11
  12. Aeril

    Aeril Private E-2

    While using process monitor to watch what the file did when it was executed, it would access those directories but I never saw those files there when I went to go check it out myself.
     
    Aeril, Jun 9, 2011
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware in your logs. What malware issues are you still having, if any?

    I am going to assume you have remove that Messenger plus garbage.
     
    TimW, Jun 10, 2011
    #13
  14. Aeril

    Aeril Private E-2

    It is gone now I believe. The logs of mbam (that i posted just before this post, not my initial post) shows the files that it successfully removed, but they would return on startup. After running combofix it found a log file starting with my computers user name (presumably for the trojan) and also removed scvhost.exe (assuming that it was the trojan disguised), after which my problems were gone. I ran an additional mbam scan after restarting and it found 0 threads.

    Thank's for your help.
     
    Aeril, Jun 10, 2011
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0

    Help Support MajorGeeks
    Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     
    TimW, Jun 10, 2011
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds