MSConfig Has Entries Pointing to Non-Existent Files

Discussion in 'Malware Help (A Specialist Will Reply)' started by quidergo, Mar 9, 2009.

  1. quidergo

    quidergo Private E-2

    I am trying to follow the "READ & RUN ME FIRST. Malware Removal Guide" procedures, but I am having a problem getting free of MSConfig. I have half a dozen startups that I have unchecked in MSConfig, but now I find that those stopped startups point to registry entries that do not exist. What should I do? Can I continue without "cleaning up" MSConfig? If not, then how do I clean up MSConfig?
     
    quidergo, Mar 9, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are not supposed to "clean up" msconfig....you are supposed to make sure it is in normal start up mode. Then continue with the instructions and attach the requested logs:
    SAS
    MBAM
    Combo
    C:\MGLogs.zip
     
    TimW, Mar 11, 2009
    #2
  3. quidergo

    quidergo Private E-2

    TimW,

    Thanks for straightening me out on that.

    When I received your reply, I had just found Startup Inspector and was using it to clean up the dead entries in MSConfig, so now I booting in normal startup mode with a clean MSConfig.

    I will open a new thread when I have the logs ready.

    QuidErgo
     
    quidergo, Mar 11, 2009
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just stay in this thread.
     
    TimW, Mar 11, 2009
    #4
  5. quidergo

    quidergo Private E-2

    Okay, I will stay in this thread. Three of my logs are attached. Here is why I am doing this:

    On 18 Feb, Avira AntiVir Personal found TR/Crypt.XPACK.Gen and SpyBot Search & Destroy found Win32.Bitar.a. They were removed.

    On 5 March, Malwarebytes Anti-Malware found Trojan.Vundo. One of the files that it was in was C:\Windows\System32\wextract.exe. I had an XPSP2 stream CD (a couple of years od) containing of wextract.exe I copied it to my hard drive, and MAM found Vundo in that file also. I have run MAM in the past and it never found Vundo in anything, so I can't help wondering if it was a false positive.

    I ran later scans and Vundo appeared again on 10 Mar on a backup disk in the following:
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355575.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355576.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355577.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355578.EXE (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355579.EXE (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355580.EXE (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355581.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355582.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355583.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    Y:\System Volume Information\_restore{987E0331-0F01-427C-A58A-7A2E4AABF84D}\RP900\A0355584.exe (Trojan.Vundo) -> Quarantined and deleted successfully.

    Similar occurrence on 6 March, but mostly on the C drive.

    What's happening here? Logs are attached and fourth log will follow. Am I okay now?
     

    Attached Files:

    quidergo, Mar 12, 2009
    #5
  6. quidergo

    quidergo Private E-2

    See my previous post. SAS log is attached.
     

    Attached Files:

    quidergo, Mar 12, 2009
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Everything you listed is in your system restore folders...and will not be removed until you toggle system restore, which we will do in a sec.

    There is one service running that I don't recognize:
    S3 JMUAZT;JMUAZT;c:\docume~1\roy\LOCALS~1\Temp\JMUAZT.exe --> c:\docume~1\roy\LOCALS~1\Temp\JMUAZT.exe

    So lets first delete the file by using windows explorer to find and remove:
    c:\documents and settings\roy\LOCAL settings\Temp\JMUAZT.exe

    Open notepad and copy and paste the following text in the quote box into the window:
    Save this as fix.bat
    Choose to save as all files.
    Doubleclick fix.bat and let the program run.
    A small black dos window will flash, this is normal.

    Now...your logs are clean, so we will do our final clean up:

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Mar 14, 2009
    #7
  8. quidergo

    quidergo Private E-2

    TimW,

    Thanks for analyzing my logs and for sending me final instructions. One problem is that c:\documents and settings\roy\LOCAL settings\Temp does not now contain JMUAZT.exe, so I cannot delete it. I am showing hidden files and am not hiding protected OS files.

    JMUAZT is not running, although it is listed as "Manual" in Administrative Tools - Services. It is in three locations in the Registry:
    HKLM\System\ControlSet001\Services
    HKLM\System\ControlSet005\Services
    HKLM\System\CurrentControlSet\Services

    Is this something that I should be worried about? I will hold off on doing the final instructions until I hear back from you.
     
    quidergo, Mar 14, 2009
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Is that the exact way it is spelled in services? And give me the full reg key path.
     
    TimW, Mar 16, 2009
    #9
  10. quidergo

    quidergo Private E-2

    It appears in Services as JMUAZT. It is not started and has "Startup Type" listed as "Manual" with "Log On As" listed as "Local System." When I look at its Properties, "Path to executable" is "C:\DOCUME~1\roy\LOCALS~1\Temp\JMUAZT.exe" and "Service status" is "Stopped." "Dependencies" tab shows nothing.

    Full Reg key paths are:
    HKLM\System\ControlSet001\Services\JMUAZT
    HKLM\System\ControlSet005\Services\JMUAZT
    HKLM\System\CurrentControlSet\Services\JMUAZT

    Although JMUAZT.exe has disappeared from my hard drive, it is still in c:\documents and settings\roy\LOCAL settings\Temp on a backup drive.
     
    quidergo, Mar 16, 2009
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What backup drive and can you delete it?

    The reg keys we can try to remove:
    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.
     
    TimW, Mar 18, 2009
    #11
  12. quidergo

    quidergo Private E-2

    The backup drive is an external USB hard drive containing a full C drive backup updated by Retrospect. I can easily delete the file using Windows Explorer.

    I created the fixME.reg file, but when I double-clicked, it opened in Notepad. I then realized that I had probably changed the association of reg files to open in Notepad so that I had to make a conscious effort to run one. I thought I made this change using the PC Magazine Registry Robot utility, but when I when I went into Registry Robot, I got a message that the specific Registry location was not found.

    Here is the information from Registry Robot about the key: "In Registry key HKCR\[VAR]\shell (where [VAR] is replaced by "", found at HKCR\.reg\\), add or change the value named (Default), changing its current data of (none) to edit,merge,print."

    I believe that I can still run fixMe.reg by right-clicking on it and selecting Open With and then Registry Editor.

    Should I go ahead and do this and also delete JMUAZT.exe from the backup HD?

    Also, I want to delete the old system restore points on that backup drive. Where are they located so that I can manually delete them?
     
    quidergo, Mar 18, 2009
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes or you can also run the Registry Editor and click File and Import and then navigate to the file and import it.


    Yes.

    You cannot delete System Restore points that way. You have to disable System Restore and they are automatically deleted. Then you renable System Restore.
     
    chaslang, Mar 21, 2009
    #13
  14. quidergo

    quidergo Private E-2

    OK. I completed everything, and I turned off System Restore, rebooted, and turned it back on.

    One last question. After running the JMUAZT.EXE registry cleanup I did another search in Regedit and found the following:

    HKLM\SYSTEM\ControlSet005\Enum\Root\LEGACY_JMUAZT contains the following:
    (Default) REG_SZ (value not set)
    NextInstance REG_DWORD 0x00000001 (1)

    HKLM\SYSTEM\ControlSet005\Enum\Root\LEGACY_JMUAZT\0000 contains the following:
    (Default) REG_SZ (value not set)
    Class REG_SZ LegacyDriver
    ClassGUID REG_SZ {8ECC055D-047F-11D1-A537-0000F8753ED1}
    ConfigFlags REG_DWORD 0x00000000 (0)
    DeviceDesc REG_SZ JMUAZT
    Legacy REG_DWORD 0x00000001 (1)
    Service REG_SZ JMUAZT

    I think I missed this the first time because I searched for JMUAZT.EXE. This time I only searched for JMUAZT. I would like to delete these two Registry keys in Regedit. Should I?
     
    quidergo, Mar 21, 2009
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You cannot delete LEGACY keys that way. You can use either a ComboFix script or an Avenger script to remove this. ComboFix could be the better choice since it is also the program that showed this driver in your log. If you already removed ComboFix, you will have to download it to your Desktop again.



    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the new c:\combofix.txt log
     
    chaslang, Mar 24, 2009
    #15
  16. quidergo

    quidergo Private E-2

    I had to download ComboFix and MGTools again.

    I stopped my antivirus and antispyware before running ComboFix, but I forgot about TeaTimer and did not stop that until just before running MGTools. I used Process Explorer to kill TeaTimer. I hope that did not invalidate the process.

    I installed MGTools after running ComboFix. Then I ran GetLogs.bat after that. I think there may have been some redundancy there. Again, I hope that was not a screwup on my part.

    I have attached both combofix.txt and mglogs.zip.

    The Registry does not contain any more references to JMUAZT.

    Do I need to do anything else, or am I ok now?

    By the way, what exactly, is a LEGACY key?
     

    Attached Files:

    quidergo, Mar 24, 2009
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean now. You just need to complete the final steps TimW gave you back in message # 7.

    The are special keys related to drivers and services where the normal permissions are setup to allow only the System ( Windows itself ) permission to access them. While I could have had you edit the security settings to change permissions so that you could edit the keys, I felt it would be safer to just use ComboFix.
     
    chaslang, Mar 28, 2009
    #17

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds