[Resolved] System Guard 2009

Got a pc running XP and it is infected with System Guard 2009.
This little EDIT does not want to go away.

I ran ATF Cleaner first.

I removed the directory it had created.

I ran regedit and removed all instances of "System Guard 2009".


Then I tried to install the Malwarebytes AntiMalware program but it won't install. After answering the prompt for which language to use, it dies. Doesn't install. I've tested this on my pc, and it works fine, so I'm thinking that the System Guard 2009 is somehow preventing the install. ??????

I've even booted up in Safe Mode and tried to install but same results.

OB1, please help.

Hello.

I edited your topic slightly, please do not swear over here. I know this infection may be difficult/annoying but please do not use that language over here. Thanks.

Download and run MalwareBytes Anti-Malware

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

For complete or visual instructions on installing and running Malwarebytes Anti-Malware please read this link

Now download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
• Open the OTScanIt2 folder and double-click on OTScanIt2.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
• Do not change any settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.
• Close Notepad (saving the change if necessry).

Use the Add Reply button and Attach the scan back here (do not copy/paste it as it will be too big to fit into the post). It will be located in the OTScanIt2 folder and named OTScanIt.txt.

With Regards,
Extremeboy

Extremeboy, didn't you read my post? You give me instructions for running installing and running Anti-Malware , but like I stated in the post, it will not install!! After if asks what language to use, it disappears, it goes away, it does not continue with the install!!! I don't know how much clearer to put this.

Hello. Sorry about that. That was my fault. I didn't clearly read your post then. I apologize. Please post the OTScanIT2 logs for me. With Regards, Extremeboy

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 days the topic will need to be closed.

Thanks for understanding.

With Regards,
Extremeboy

sorry man. it's a work pc and I've been away all weekend. Will get it done asap and post my results today.

That's fine. I just needed to know if you were still there. If not then I would close the topic. Now that I know you are still with us, I will let this topic be as it is With Regards, Extremeboy

Here's the OST scan.

—-Edit Out—- I am reviewing the OTScanIT2 log right now. Give me a few minutes. Thanks. With Regards, Extremeboy

Hello.

I indeed see presence of "System Guard 2009" on your machine, however not only that I see some other baddies in the OTScanIT2 log that are far more dangerous then this rogue program and unfortunately one of this infection is known as a rootkit/backdoor.

I did not want to run any "big-tools" until I see what's going on with the machine, which the OTscanIt2 log provided me with. Some members would like to reinstall/format now.

[external image: Posted Image]Backdoor Threat

IMPORTANT NOTE: Unfortunatly One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. If you want to continue do the steps below please.

****************************

Download and Run ComboFix

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

Refer to the page below for further instructions on running ComboFix. This includes installing the Recovery Console. Note that you do not need your Windows XP disk to install it.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a open a report for you. Post back with it. It is at C:\ComboFix.txt.

Do not mouseclick the ComboFix window while it's running. That may cause it to stall.

Download and Run Scan with GMER

We will use GMER to scan for rootkits.

• Download gmer.zip and save to your desktop.
  Alternate Download Site 1
• Unzip/extract the file to its own folder. (Click here for information on how to do this if not sure. Win 2000 users click here.
• When you have done this, disconnect from the Internet and close all running programs.
  There is a small chance this application may crash your computer so save any work you have open.

• Double-click on Gmer.exe to start the program.
• Allow the gmer.sys driver to load if asked.
• If it gives you a warning at program start about rootkit activity and asks if you want to run a scan…click NO.
• Click the >>>
• Click on Settings, then check the first five settings:
  • System Protection and Tracing
  • Processes
  • Save created processes to the log
  • Drivers
  • Save loaded drivers to the log
• You will be prompted to restart your computer. Please do so.

• After the reboot, run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for Show All.
  • Click on the Scan and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan. You will know that the scan is done when the Stop buttons turns back to Scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose New>Text document. Once the file is created, open it and right-click again and choose Paste. Save the file as gmer.txt and copy the information in your next reply.
  If GMER doesn't work in Normal Mode try running it in Safe Mode
  
  Important!:Please do not select the Show all checkbox during the scan..
  
  Post back with:
  -Combofix log
  -GMER log
  
  With Regards,
  Extremeboy

Wow! Thanks for the info man. Have removed the pc from the net. Will set him up with a spare for now.

Hello.

Okay then. Glad I could offer some knowledge. Below are some prevention tips.

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

• So How did I get infected?
• Miekies' prevention suggestions
• Hardening Windows Security - Part 1 & Part 2.

• Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.

Disable Autorun on Flash-Drive/Removable Drives

When is AUTORUN.INF really an AUTORUN.INF?

USB worms work by creating a file called AUTORUN.INF on the root of USB drives. These INF files then use Autorun or Autoplay (not the same thing!) to execute themselves either when the stick is inserted, or more commonly, when the user double-clicks on the USB drive icon from My Computer (Windows Explorer)…

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. Read USB-Based Malware Attacks and Please disable Autorun asap!.

If using Windows Vista, please refer to:
"Disable AutoPlay in Windows Vista"
"Preventing AutoPlay with Local Group Policy Editor or AutoPlay options panel"

Note: When Autorun is disabled, double-clicking a drive which has autorun.inf in its root directory may still activate Autorun so be careful.

Vist the WindowsUpdate Site Regularly

I recommend you regularly visit the Windows Update Site!

• Lots of Hacking/Trojans use the methods found (plugged by the updates) that have not been stopped by people not updating.
• Update ALL Critical updates and any other Windows updates for services/programs that you use.
• If you wish to turn on automatic updates then you will find here is a nice little article about turning on automatic updates.
• Note that it will download them for you, but you still have to actually click install.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Update all programs regularly - Make sure you update all the programs you have installed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.
Finally, and definitely the MOST IMPORTANT step, click on the following tutorial and follow each step listed there:

Simple and easy ways to keep your computer safe and secure on the Internet

I will close this topic if you have no more questions. Let me know if you have any comments or questions.

With Regards,
Extremeboy

I feel like I should run this on all of our pc's now. Where in the "hieroglyphics" of this ost txt file, does it show this backdoor trojan? That way I can check my own scans without having to deliver each one here.

Hello.

Where in the "hieroglyphics" of this ost txt file, does it show this backdoor trojan?

That way I can check my own scans without having to deliver each one here.

Infections can change their name quite frequently so you may not always get the same file name. For example there is a well know rootkit infection that has 3 different names.

1) Tdss***.exe/.sys
2) gaopdx***.exe/.sys
3) UAC*****.exe/.sys

****=random characters that change everytime almost.

That is why it's very difficult to tell whether they are bad/good. Also analyzing logs require some training, it's not something you can figure yourself right off the bat. Analyzing that log also requires a special tool to help us see better the file name and locations. I suggest you post here or another forum when you believe you have an infection and not try fixing stuff yourself as that can lead to disastrous problems..

Just for the sake, since you asked some of them include the following:

%AllUsersProfile%\Application Data\winlogon.exe
%SystemRoot%\sysexplorer.exe

etc… Those are just the main ones that are rootkit/backdoor but there are more relating to other infections that I will not go into.

Good Luck

With Regards,
Extremeboy

Hello.

Are you still there?

If you are please follow the instructions in my previous post.

If you still need help, follow the instructions I have given in my response. If you have since had your problem solved, we would appreciate you letting us know so we can close the topic.

Please reply back telling us so. If you don't reply within 5-7 days the topic will need to be closed.

Thanks for understanding.

With Regards,
Extremeboy