What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Trojan Horse BackDoor.Generic 12 AAVT

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
Hi,

Please do the following:

Please open a command window

Go to Start > run > type cmd > press enter

copy/paste the following into the open command window:

sigcheck c:\windows\system32\DRIVERS\raspppoe.sys>"%userprofile%\desktop\log.txt"


a file called log.txt will be created on your desktop - post the content of log.txt in your next reply

NEXT

go to Start >run

type in

maxlook -cleanup

press enter
Post #32
Not shure what happened with this Quote Go to Start > run > type cmd > press enter copy/paste the following into the open command window: QUOTE sigcheck c:\windows\system32\DRIVERS\raspppoe.sys>"%userprofile%\desktop\log.txt" a file called log.txt will be created on your desktop - post the content of log.txt in your next reply no log.txt was created on desktop
Post #34
OK
Here is the GMER log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-13 22:30:03
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwtdapog.sys


—- System - GMER 1.0.15 —-

SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF723B514]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF722A282]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF722A474]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF723BD00]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF723BFB8]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF723A3FA]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF723C422]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF723B7D8]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF7229F32]

—- Kernel code sections - GMER 1.0.15 —-

? Combo-Fix.sys The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF5841380, 0x2468FD, 0xE8000020]
? C:\ComboFix\catchme.sys The system cannot find the path specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\WINDOWS\explorer.exe[5500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C42F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\explorer.exe[5500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C42C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\explorer.exe[5500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C42CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\WINDOWS\explorer.exe[5500] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C42CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 ATMhelpr.SYS (Windows NT Font Driver Helper/Adobe Systems Incorporated)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 ATMhelpr.SYS (Windows NT Font Driver Helper/Adobe Systems Incorporated)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-
Post #35
Hi,

Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.




NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #36
Hi,

Please make sure you press enter after pasting in the command (sorry I omitted that the first time)

Please open a command window

Go to Start > run > type cmd > press enter

copy/paste the following into the open command window:

sigcheck c:\windows\system32\DRIVERS\raspppoe.sys>"%userprofile%\desktop\log.txt"


press enter

a file called log.txt will be created on your desktop - post the content of log.txt in your next reply
Post #37
Hi Here are the MABM and Kaspersky logs will try the other shortly Malwarebytes' Anti-Malware 1.44 Database version: 3736 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 2/13/2010 11:25:30 PM mbam-log-2010-02-13 (23-25-30).txt Scan type: Quick Scan Objects scanned: 128650 Time elapsed: 3 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Sunday, February 14, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, February 14, 2010 11:09:33 Records in database: 3498703 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Objects scanned: 123624 Threats found: 3 Infected objects found: 12 Suspicious objects found: 44 Scan duration: 03:42:33 File name / Threat / Threats count C:\Program Files\Qualcomm\Eudora\In.mbx Suspicious: Trojan-Spy.HTML.Fraud.gen 14 C:\Program Files\Qualcomm\Eudora\In.mbx Infected: Email-Worm.Win32.Mydoom.m 3 C:\Program Files\Qualcomm\Eudora\In.mbx Infected: Net-Worm.Win32.Mytob.c 1 C:\Program Files\Qualcomm\Eudora\In.mbx.001 Suspicious: Trojan-Spy.HTML.Fraud.gen 14 C:\Program Files\Qualcomm\Eudora\In.mbx.001 Infected: Email-Worm.Win32.Mydoom.m 3 C:\Program Files\Qualcomm\Eudora\In.mbx.001 Infected: Net-Worm.Win32.Mytob.c 1 C:\Program Files\Qualcomm\Eudora\In.mbx.002 Suspicious: Trojan-Spy.HTML.Fraud.gen 14 C:\Program Files\Qualcomm\Eudora\In.mbx.002 Infected: Email-Worm.Win32.Mydoom.m 3 C:\Program Files\Qualcomm\Eudora\In.mbx.002 Infected: Net-Worm.Win32.Mytob.c 1 C:\Program Files\Qualcomm\Eudora\Out.mbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1 C:\Program Files\Qualcomm\Eudora\Out.mbx.001 Suspicious: Trojan-Spy.HTML.Fraud.gen 1 Selected area has been scanned.
Post #38
I copied the cmd box as it appears after entering the command and hitting enter and include it below. again no file was saved to desktop. Microsoft Windows XP [Version 5.1.2600] © Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\Owner>sigcheck c:\windows\system32\DRIVERS\raspppoe.sy s>"%userprofile%\desktop\log.txt" Sigcheck v1.65 - File version and signature viewer Copyright © 2004-2010 Mark Russinovich Sysinternals - www.sysinternals.com C:\Documents and Settings\Owner>
Post #39 last edited
OK

I'm thinking that means that the file still remains unsigned and we should replace it again just to be certain:


Please do the following:

navigate to the following file:

c:\windows\system32\DRIVERS\raspppoe.sys


right click on raspppoe.sys > choose to rename it - rename it to raspppoe.sys.old

click so your cursor is beside the renamed file - wait five seconds and hit F5.

WFP should kick in and recreate a new raspppoe.sys

Please report back if it does:


re-run the previous command in a command window and see if you get a report this time.



NEXT

The files found by Kaspersky are in your email. Both the inbox and the outbox. It can't pinpoint which particular emails are infected, so delete anything you don't need, anything from anyone you don't know, anything with attachments such as videos or jokes.


NEXT

Run a fresh DDS and Attach.txt and advise how your computer is running now and if there are any outstanding issues.
Post #41
Hi,

It should have created a new one in the folder after pressing F5….

do a search for it in the system32/drivers folder - if it did not replace the file - rename the old one back to raspppoe.sys


let's do a search for them on your system and we'll replace it manually

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
*raspppoe*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #42
OK I am not sure we are doing the same thing so here is what I did went to "windows explorer" to … C drive…to….windows…to…system32…to…drivers…and it opened a page showing all drivers, no drivers had anything after there name for example raspppoe no .sys. when I renamed it to raspppoe.sys.old and clicked beside it and held the button down wated 5 seconds then hit F5 then released mouse button. If I did something wrong tell me. if this was correct then when i rename the file back to raspppoe.sys do I use raspppoe or raspppoe.sys?
Post #44
OK,

show the file extensions, that will make it easier


go to Start > my computer > Tools > folder options > view

scroll down to "Hide extensions for known file types" and uncheck the box beside it. Click OK

now go back to the raspppoe file in the C:\ > windows > system32 > drivers > folder …… it should just say raspppoe.sys.old

if is says anything else > change it to raspppoe.sys.old

now click your mouse in the space beside that file so the cursor is right beside it. Now wait 5 seconds > press F5

If a new raspppoe.sys doesn't create…rename the old one back so it just says raspppoe.sys

If you had to change the file back - run system look

if a new file created - you don't need to.
Post #45 last edited
sorry we cross posted… so it looks like a new file did create yes? OK - run the signature check in the command window from before > see if a log creates

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI