Trend Micro quarantines BKDR_BIFROSE.CWS

Discussion in 'Malware Help (A Specialist Will Reply)' started by will_k, Feb 21, 2010.

  1. will_k

    will_k Private E-2

    Hello and thanks for viewing this thread. Trend Micro has been constantly alerting me to the threat BKDR_BIFROSE.CWS. I performed the preliminary work earlier this evening. Here are the logs for superantispyare, malwarebytes, combofix, & rootrepeal

    Thanks for any help/guidance!
     

    Attached Files:

  2. will_k

    will_k Private E-2

    And here is the .zip for MG
     

    Attached Files:

  3. will_k

    will_k Private E-2

    I think this one got resolved by some software smackdown. At least Trend Micro shut the f*** up and I know it's running, so that's a good sign. Thanks for the comprehensive anti-malware procedures
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you tell me the exact path to the file that Trend Micro was screaming about?

    Please move ComboFix directly on your desktop, not here:
    Running from: c:\documents and settings\Lorenzen lab\My Documents\Downloads\ComboFix.exe

    It should be here:
    Running from: c:\documents and settings\Lorenzen lab\Desktop\ComboFix.exe

    Now please put MGTools.exe directly on the C:\ drive, again, not running from here:
    C:\Documents and Settings\Lorenzen lab\My Documents\Downloads\MGtools.exe


    Please use add/remove programs to uninstall:
    J2SE Runtime Environment 5.0 Update 10"
    J2SE Runtime Environment 5.0 Update 2"
    J2SE Runtime Environment 5.0 Update 5"
    J2SE Runtime Environment 5.0 Update 6"
    J2SE Runtime Environment 5.0 Update 9
    Java 2 Runtime Environment, SE v1.4.2_03"
    Java 2 Runtime Environment, SE v1.4.2_05"
    Java 2 Runtime Environment, SE v1.4.2_06"
    Java(TM) 6 Update 5"
    Java(TM) SE Runtime Environment 6 Update 1
    Viewpoint Manager

    Use windows explorer to find and then right click on this file and choose properties, tell me if it is signed:
    C:\WINDOWS\SYSTEM32\DRIVERS\nanvdlm.sys

    Now use windows explorer to find and delete:
    C:\WINDOWS\Temp\hlktmp
    C:\Documents and Settings\Lorenzen lab\Local Settings\temp\2B.TMP

    Now download and install:
    Java Runtime 6

    Tell me what issues you may still be having.
     
  5. will_k

    will_k Private E-2

    Hey Tim, thanks for the reply.

    Here's my replies (in order)

    path: BKDR_BIFROSE.CWS from C:\WINDOWS\system32\Startup.scr
    Last night, I used trojan remover to delete this file and TM piped down.

    Removed all the java etc as per your advice, reinstalled java 6

    C:\WINDOWS\SYSTEM32\DRIVERS\nanvdlm.sys
    could not be found when I ran a search

    C:\WINDOWS\Temp\hlktmp
    was found, tried using trojan remover to delete. When windows restarted trojan remover said it couldn't delete it. The file is still present. BTW- I've used trojan remover for the aforementioned files because hitting "delete" won't allow me. Do you have other suggestions?

    C:\Documents and Settings\Lorenzen lab\Local Settings\temp\2B.TMP
    could not be found when I ran a search

    Maybe combofix took care of some of these issues. Could you take a look and see what you think. Combofix and MG tools were moved to the desktop. Here's combofix, see attachment for mgtools.

    Thanks!
     

    Attached Files:

    Last edited by a moderator: Feb 22, 2010
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please re-read my post #4. I asked you to put Combo on your desktop, but not MGTools.exe. That should be directly on the root drive as in C:\MGTools.exe. But regardless, your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to tahe cleaning procedures ian step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore ato create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds