Trojan horse downloader.agent 5K, 5L and Dyfica help please

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by ianc, Dec 27, 2004.

  1. ianc

    ianc Private E-2

    Hi there, I have some virus/trojans I need help in removing please. I apologize for the length of this post, but I wanted
    to include all the info I could. :)

    I have read the "read me first...." thread and followed the instructions. Results are listed below, under symptons
    and system specs.

    On a normal scheduled daily scan, AVG found the following:

    trojan horse downloader.agent.5K
    trojan horse downloader.agent.5L
    trojan horse downloader.dyfica.3.e

    As well, my homepage was changed to about:blank.
    50+ urls added in a folder to my IE faves.
    Numerous add pop-ups, notably adds for virus scanners.

    System specs:

    AMD Barton 2500 @ 2.2
    512mb pc3200 ram
    1-30gb + 1-40gb hdd
    xp pro sp1

    internet is dsl high speed thru a linksys wired router. Also connected to router is a second computer.
    I have an up to date purchased Zone Alarm Pro firewall and AVG free edition. Both run at all times. I run
    Ad-Aware and Spybot S&D regularly.

    "read me first...." results

    prep work:

    1. System restore disabled.
    2. "network security service" disabled, other two were not present (similar but not exact)
    3. File viewing enabled.
    4. Tools installed and updated as required.


    Scanning and Cleaning:

    1. Trend Micro scan, tried previously in normal mode, crashes IE. Didn't used to till last week when AVG detected the above
    trojans. Ran scan in safe mode and detected the following:

    "TROJ HIDEPROC B", listed three times, says uncleanable but I was able to delete them.

    Symantec scan in safe mode: One infected file found, but IE crashed before the type was listed. Three re-boots in safe
    mode with networking with the same result. Running Symantec in normal mode and it found 17 instances of two files,
    "PWS.HOOKER.TROJAN" and "TROJAN.BYTE.VERIFY".

    Ran Ad-Aware se in safe mode: 16 new critical objects found. 4 registry keys, 7 registry values and 5 files. The reg keys
    and values were all associated with coolwebsearch. The remaining file was DyFuCa located in c:/temp.optimize.exe. All 16
    objects were moved to quarantine folder. I deleted the quarantine archive folder. In normal mode, a full scan will be
    done and results shown, but Ad-Aware will close when I attempt to delete them. All the files found were related to cws,
    yet cwshredder says my system is clean.

    McAfee stinger: Scan found 263313 clean files, no viruses/trojans found.

    A-Squared scan found four malware files, all in mirc32.exe. I'd rather not delete theses files as I use mirc everyday,
    but I'll delete them and try re-installing mirc later when my problems are solved.

    After all this was done, I re-booted in normal mode to check the results. My homepage was restored, but within the hour
    had reverted to about:blank again. I decided to run thru the procedures a second time. This time Symantec only detected
    one file, "pws.hooker trojan" located in "c:/program files/teamspeak2_rc2/keypress.dll" This is an online voice program
    I use to play team games. Spybot S&D was clean. Spyware blaster lists several instances of about:blank being the system
    home page.

    Ad-Aware now finds 20 critical objects. all cww related yet cwshredder says I am clean.

    I can't seem to connect to the internet in safe mode anymore, but this may be a problem with the router. It can be
    twitchy at times. Trend micro closes IE in normal mode when I try to scan.

    I have run hjt as per the sticky thread and fixed several items that were obviously about:blank related, but on re-boot
    they come back. My latest log is available.

    Any help is appreciated....thanks. :)
     
    ianc, Dec 27, 2004
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member



    MIRC32 - MIRC32.exe - Process Information

    Process File: MIRC32 or MIRC32.exe
    Process Name: Backdoor.IRC.Spybuzz

    Description:
    MIRC32.exe is a process which is registered as the Backdoor.IRC.Spybuzz Trojan. This Trojan allows attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. Please see additional details regarding this process



    So why do you want to keep this and why do you use it?
     
    chaslang, Dec 27, 2004
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

    Now post a HijackThis as a .txt file attachment to your message. All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

    To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
     
    chaslang, Dec 27, 2004
    #3
  4. ianc

    ianc Private E-2

    Hello and thanks,

    mirc is aka internet relay chat, an online method of communication. A chatroom so to speak. mirc32.exe is the applications executable file. I use it daily to chat with friends.

    http://www.mirc.com/

    I'm guessing the mirc32.exe malware files are named similarly to avoid detection/deletion. Anyhoo, will remove as required.

    hjt log attached.

    ianc
     

    Attached Files:

    ianc, Dec 27, 2004
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not follow ALL the steps of the READ ME FIRST. Step 2 of
    Getting Prepared; Steps to be sure your system is ready to be scanned:

    2: Network Security, Workstation Netlogon Services & Remote Procedure Call (RPC) Helper (Windows XP, 2K, NT); Only do this step if you have the about:blank or home search hijack. You need to check to see if any of the following three Windows services are running:

    • Network Security Service
    • Workstation Netlogon Service
    • Remote Procedure Call (RPC) Helper
    You have the Network Security Service running and you have the HSA hijack. Why did you skip that step and why didn't you run HSremove and About:Buster?
     
    chaslang, Dec 27, 2004
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    After Stopping ad Disabling the Network Security Service as per the tutorial, do the below.

    Run HSremove
    Run About:Buster     and say yes to secondary scan! Save the log to a file called ab1.txt
    Run About:Buster again and say yes to secondary scan! Save the log to a file called ab2.txt

    Make sure you have system restore disabled and viewing of hidden files enabled.

    Please bring up Task Manager by hitting CTRL-ALT-DEL and click the Processes tab. Look for the below process(es) and if found, End them:
    C:\WINDOWS\iplx.exe
    WinServAd.exe

    Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\hgxqh.dll/sp.html#37049
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {5D04D4AD-FEBB-3BE2-CE5A-DA41BFA2F067} - C:\WINDOWS\ievx.dll
    O4 - HKLM\..\Run: [Windows ServeAd] C:\Program Files\Windows ServeAd\WinServAd.exe
    O4 - HKLM\..\Run: [d3em32.exe] C:\WINDOWS\system32\d3em32.exe
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)
    O23 - Service: Network Security Service - Unknown - C:\WINDOWS\iplx.exe

    Boot into safe mode and use Windows Explorer to delete:
    C:\WINDOWS\system32\hgxqh.dll
    C:\WINDOWS\ievx.dll
    C:\WINDOWS\iplx.exe
    C:\Program Files\Windows ServeAd <--- the whole folder
    C:\WINDOWS\system32\d3em32.exe

    Now reboot in normal mode and post a new HJT log. And tell us how things are working.
    These hijacks can be very stubborn and quite often come back as soon as a browser is opened. It some times takes very detailed procedures to remove.
     
    chaslang, Dec 28, 2004
    #6
  7. ianc

    ianc Private E-2

    Hmmmm...."network security service" was disabled as per my 1st post. The other two items were similar but not exact, so I left them. I did run HSremove and about:buster before my first post as well. My apologies if I didn't list them. About:buster removed 7 data streams yeaterday. I shall confirm system restore is off and that "network security service" is disabled and then go thru the instructions from your last post.
     
    ianc, Dec 28, 2004
    #7
  8. ianc

    ianc Private E-2

    Dohhhh..

    network security service was stopped but not disabled. Now fixed.
     
    ianc, Dec 28, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay! Finish the other steps I posted.
     
    chaslang, Dec 28, 2004
    #9
  10. ianc

    ianc Private E-2

    Well ok then....

    disabled network security service
    ran HSRemove - 8 items removed
    ran About:Buster - 6 data streams removed 1st time, 2 data streams 2nd time and clean run the 3rd time.

    iplx.exe and winservad.exe were not in task manager.

    Ran hjs and removed items as directed.

    Re-booted in safe mode for file deletion:
    /system32/hgxqh not found
    /ievx.dll not found
    /iplx.exe found in prefetch folder and deleted
    /windows servead folder found and deleted
    /d3em32.exe found in prefetch folder and deleted

    Rebooted in normal mode and ran hjt, log attached.

    I seem to have a clean system. My homepage is back to normal, no new urls in fave folder. I can now connect to trend micro in normal mode and not crash IE.

    WOOOHOOO!!!! :) Mucho thanks.

    Couple of questions now though. Regarding the mirc32.exe, was it renamed malware and is irc chat safe/not safe to use.

    The various antispy progs I now have running in the background, are they all ok to be running at the same time without conflicts. Apps such as TCactive, Asquared, spysubtract and the usaul zone alarm and AVG
     

    Attached Files:

    ianc, Dec 28, 2004
    #10
  11. ianc

    ianc Private E-2

    Well ok....maybe not then.

    I can no longer access windows explorer while in normal mode, only in safe mode. Normally I access windows explorer thru start/my computer. When I do that now, I get a blank screen and the swivelling flashlight icon. After about 30 seconds I get the pop-up with the message about this program not responding. In safe mode, it comes up with no probs.

    Can this be related to any of the virus/trojab probs we just cleaned up or is it just co-incidental? Either way, would someone be so kind as to suggest how I might get windows explorer back. Thanks.
     
    ianc, Dec 28, 2004
    #11
  12. ianc

    ianc Private E-2

    Spoke to soon it would seem. Now windows explorer pops right up again. :)
     
    ianc, Dec 28, 2004
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You HJT log was clean. I am not familiar with Irc chat. All I know is that mirc32.exe is a trojan according to many sources. Whether there is a similarly named valid application that remains to be seen. Perhaps you need to do some Google/Ecite searching on mirc32.exe and checkout what you find.

    Here are a couple of links:
    http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.spybuzz.html
    http://www.liutilities.com/products/wintaskspro/processlibrary/MIRC32/
    http://www.sophos.com/virusinfo/analyses/trojmirchacka.html <--- see the Description Tab
    http://computercops.biz/startuplist-4457.html
    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?vname=bkdr_ircflood.y&vsect=t
     
    chaslang, Dec 28, 2004
    #13
  14. ianc

    ianc Private E-2

    Thanks for the help chaslang. Appreciate it. Will keep irc un-installed till I can find some more info as you suggest.
     
    ianc, Dec 28, 2004
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your welcome. You may find out that what you had is a valid application and that various forms of malware either use the same file name or actually take advantage of security holes to create problems. You may want to ask questions about the actually program name over in the Software Forum and see what everyone there knows about it.
     
    chaslang, Dec 28, 2004
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds