"HKEY_LOCAL_MACHINE" Trojan - Please Help!

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by circadian squid, Jul 8, 2009.

  1. circadian squid

    circadian squid Private E-2

    Dear Sir / Madam,

    My laptop became infected on 07/06/09 with a Trojan. I have run my anti-virus and anti-Malware software which typically identifies ~22 Trojans each time. It quarantines & deletes all but 2 which it states will be deleted on reboot. The problem: standard reboot is disabled and the screen goes to black before the initial login screen. I was able to successfully login through SafeMode with a manual / forced shutdown and reboot. In SafeMode, all audio features are disabled and multiple Microsoft Windows error boxes (around 14 each time) automatically pop up stating various applications have stopped working. e.g.:

    "mkvknro.exe has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available"

    "Dr. Web scanner for Windows has stopped working . . . "

    "Gbohotjhaz eqepo has stopped working . . . " etc.

    Basically I am prevented from standard login, audio is disabled, and I am stuck at this point as all of my antivirus and malware programs quarantine all but 2 trojans which are to be deleted on reboot, however, standard reboot is disabled. Any assistance that can be provided would be extremely helpful and sincerely appreciated. I will include the full Malwarebytes' Anti-Malware 1.34 scan log below:

    Malwarebytes' Anti-Malware 1.34
    Database version: 1749
    Windows 6.0.6000

    7/6/2009 7:12:53 PM
    mbam-log-2009-07-06 (19-12-53).txt

    Scan type: Quick Scan
    Objects scanned: 65026
    Time elapsed: 13 minute(s), 4 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 0
    Registry Keys Infected: 6
    Registry Values Infected: 2
    Registry Data Items Infected: 3
    Folders Infected: 0
    Files Infected: 10

    Memory Processes Infected:
    C:\Windows\Fonts\services.exe (Heuristics.Reserved.Word.Exploit) -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Zlob.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\xml.xml (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\xml.xml.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\glaide32 (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\glaide32 (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{d76ab2a1-00f3-42bd-f434-00bbc39c8953} (Trojan.Zlob.H) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cognac (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Windows\System32\gsf83iujid.dll (Trojan.Zlob.H) -> Delete on reboot.
    C:\Windows\System32\msxml71.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Windows\System32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Windows\System32\drivers\glaide32.sys (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\Brian Curtis\AppData\Local\Temp\csrss.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\Brian Curtis\AppData\Local\Temp\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\Brian Curtis\AppData\Local\Temp\winlogon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Users\Brian Curtis\AppData\Local\Temp\j.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\Brian Curtis\AppData\Local\Temp\taskmgr.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Windows\Fonts\services.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
     
    circadian squid, Jul 8, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Welcome to Major Geeks!

    Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.

    • If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First. If TDSSserv is not found, just continue on with the READ & RUN ME.
    READ & RUN ME FIRST. Malware Removal Guide

    • If something does not run, write down the info to explain to us later but keep on going.
    • Do not assume that because one step does not work that they all will not.
    • After completing the READ & RUN ME and attaching your logs, make sure that you tell us what problems still remain ( if any still do )!
    Helpful Notes:

    1. If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode, you can run the steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:

    2. If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
    3. If you cannot seem to login to an infected user account, try using a different user account (if you have one) in either normal or safe boot mode and running only SUPERAntiSpyware and Malwarebytes while logged into this other user account. Then reboot and see if you can log into the problem user account. If you can then run SUPERAntiSpyware, Malwarebytes, ComboFix and MGtools on the infected account as requested in the instructions.
    4. To avoid additional delay in getting a response, it is strongly advised that after completing the READ & RUN ME you also read this sticky:

    Any additional post is a bump which will add more delay. Once you attach the logs, your thread will be in the work queue and as stated our system works the oldest threads FIRST.
    ​
     
    TimW, Jul 10, 2009
    #2
  3. circadian squid

    circadian squid Private E-2

    TimW,

    Thank you very much for the prompt reply and this information. I apologize for not initially following the procedures outlined in the "READ & RUN ME FIRST" section. I have completed the process and did run into a few road-blocks with a few of the downloads and logs. This is likely due to my limitation of being in Safe Mode through all steps prior to running Combo Fix. Upon reboot following Combo Fix my laptop now is able to login through Normal mode and my system appears to be virus-free.

    The Malwarebytes log is substantially larger this time around compared to my initial post. I kept record of all notices and errors throughout the READ & RUN ME FIRST steps which I will copy / paste below:

    "Updating Sun Java:

    1) Would not allow Java(TM) SE Runtime Environment 6 to be uninstalled

    error: "Windows Installer" "The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance."

    2) Upon attempting to run/install the latest Java: Error Screen: "The Windows Installer service is not accessible in Safe Mode. Please try again when your computer is not in Safe Mode or you can use System Restore to return your machine to a previous good state."

    MSconfig for Normal Startup Mode

    1) In the General tab, "Normal Startup" was selected. Re-selected, clicked Apply & OK to reboot PC. Upon reboot, same black screen preventing login in normal mode. Had to manually shut down, restart & enter Safe Mode.

    Enable viewing of hidden files, system files and file extensions

    1) There is no "Organize" option after selecting "Explore" after right-clicking the Start menu as directed in the "Ho to view hidden, system files & folders!" post by chaslang. I am unaware if this is unique to my being in Safe Mode, but would assume this is the cause of my difficulty. I researched online how to potentially enable hidden files in Safe Mode and was unsuccessful. Other options for Vista include accessing "Folder Options" through 'start--control panel--apearance and personalization (named simply "personalization" in my Vista version)--folder options. Unfortunately there is no a "Folder Options" listed in my personalization folder.

    Step 3: Installing Tools & Running Scans - SUPERAntiSpyware

    1) I can run the SAS.exe file which then takes me to a "Windows Installer" popup with "Windos Installer. V.4.00.6000.0" at the top, a listing of text and an OK button at the bottom. When I click OK the box disappears, however, there is no icon created on the desktop and the program also does not appear through start--all programs either. As a huge feature of this trojan is multiple "Windows Explorer" error notices indicating Windows Explorer has stopped working, immediately followed by a notice that Windows Explorer is restarting (this happens around 14-15 times) I would assume it is preventing SUPERAntiSpyware from becoming functional. I have not found a solution to this problem on the MajorGeeks forum. It allows the .ee file to run, but fails to create a desktop icon & the program cannot be located. Unfortunately this prevented me from moving forward with this step to run the program and generate a log report. Suggestions?

    MalWare:

    1) Following scan, ensured everything was checked, clicked remove selected, an info box popped up stating: "Regedit has been disabled and will affect the quarantining process. Malwarebytes' ANti-Malware will not enable Regedit." I clicked "OK" and quarantining resumed.

    2) **PLEASE REVIEW PRINTSCREEN ATTACHMENT NOTICE GIVEN OF TROJANS THAT COULD NOT BE REMOVED** - - clicked "YES" on this notice to restart computer, restart in normal mode was once again disabled. manually shut down & entered Safe Mode.

    **SYSTEM REBOOTED SUCCESSFULLY IN NORMAL MODE FOLLOWING COMBO FIX SCAN**

    RootRepeal:

    1) Downloaded the .rar file, extracted with WinRAR to desktop. Upon attemting to open program I received a "RootRepeal Error" message reading "Attempt to read from address: 0x00e5a000" - - I clicked OK & a notice that RootRepeal has stopped working appears. I have tried this numerous times, using the .zip download as well but still receive this error. "
    ______

    After reviewing the attached logs and printscreen, please let me know if additional actions would be desired (i.e. attempting the initially erroneous scans and downloads now that Normal login is no longer restricted) and I will perform these promptly. Thank you once again for all of your help as it is sincerely appreciated.
     

    Attached Files:

    circadian squid, Jul 12, 2009
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The first thing you need to do after disconnecting from the internet ( pull the cable) is to contact your banks and credit card companies and alert them that your private info may have been stolen.

    Then use a different computer to change all of your passwords

    You did not attach the combo log.

    Now download The Avenger by Swandog469, and save it to your Desktop.

    * Extract+ avenger.exe from the Zip file and save it to your desktop

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    * Run avenger.exe by double-clicking on it.
    * -Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:


    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    -
    Now run Ccleaner to clean out only temp files and nothing else!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\Avenger.txt
    * C:\MGlogs.zip
     
    TimW, Jul 14, 2009
    #4
  5. circadian squid

    circadian squid Private E-2

    Thank you once again for all of your help. The requested logs are attached.

    On a side note: I have been checking my financial accounts due to this recent trojan and have not noticed any suspicious activity. I will call and cancel all credit cards & I have already changed my passwords on a separate PC. My only question is regarding my actual checking account number & PIN at my credit union. I ensured not to log into any financial accounts through the duration of the virus. Do you recommend going to the lengths of closing this checking account and starting a completely separate one due to this situation? Any advice you can give would be much appreciated.

    Thanks again & please let me know if any further steps are necessary.

    Brian
     

    Attached Files:

    circadian squid, Jul 15, 2009
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    As long as you have changed password, you should be fine. I don't know how much you use your computer for online banking, but the infection was a password stealer.

    We still have work to do:

    Please use add/remove programs to uninstall:
    Java(TM) SE Runtime Environment 6

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):
    Now,

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
C:\1354487696
C:\mkvknro.exe
C:\xxqkc.exe
C:\Windows\Ljewoboxebod.dat
C:\Windows\okuhofusocacezaf.dll
C:\Windows\Vzopuqolezib.bin
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
C:\Windows\System32\wafojomi
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner to clean out only temp files and nothing else!

    Now download and install:
    Java Runtime 6

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip
     
    TimW, Jul 18, 2009
    #6
  7. circadian squid

    circadian squid Private E-2

    The requested logs are attached. Thanks once again for your help and please let me know if any further action may be required.
     

    Attached Files:

    circadian squid, Jul 23, 2009
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Some of the files were not removed by Combo, so let's try again.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
C:\xxqkc.exe 
C:\mkvknro.exe
C:\Windows\Ljewoboxebod.dat
C:\Windows\okuhofusocacezaf.dll
C:\Windows\Vzopuqolezib.bin
C:\Users\Brian Curtis\AppData\Local\temp\MARCA02.tmp
C:\Users\Brian Curtis\AppData\Local\temp\mard1d0.tmp  
C:\Users\Brian Curtis\AppData\Local\temp\marf65f.tmp  
C:\Users\Brian Curtis\AppData\Local\temp\marf71b.tmp 

Folder::
C:\Users\Brian Curtis\AppData\Local\temp\MARCA02.tmp
C:\Users\Brian Curtis\AppData\Local\temp\mard1d0.tmp  
C:\Users\Brian Curtis\AppData\Local\temp\marf65f.tmp  
C:\Users\Brian Curtis\AppData\Local\temp\marf71b.tmp
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip
     
    TimW, Jul 26, 2009
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds