63 replies to this topic

[LDTate]

That bad boy has to be coming from somewhere.


Click HERE to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

[Prolatariat_]

* DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found " ________________________________________________ 1,115 items found: 1,115 files, 0 directories. Total of file sizes: 210,062,663 bytes 200.33 M Administrator Account = True --------------------End log--------------------- There was nothing listed in the lower pane.

Edited by Prolatariat_, 09 November 2005 - 05:26 PM.

[LDTate]

• Download FindIt NT-2K-XP.
• Unzip the contents of FindIt NT-2K-XP.zip to a convenient location.
• Navigate to the FindIt NT-2K-XP directory.
• Double-click on FindNarrator.bat and wait for it to run.
• It should open a Notepad window with the FindVX2 log.
• Post the contents of FindNarrator.txt into your next post.

[Prolatariat_]

Ewido just came up with a message that it had picked up a virus again (the same one it previously picked up): msconfig32.exe C:\WINDOWS\system32 Infection: Backdoor.Codbot.at

[LDTate]

4. To delete the value from the registry Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document, "How to make a backup of the Windows registry," for instructions. Click Start > Run. Type regedit Then click OK. Navigate to the subkeys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Network\[RANDOM FILE NAME] In the right pane, delete the value: "[DEFAULT]" = "Service" Navigate to and delete the registry subkeys: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\[RANDOM FILE NAME] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DHCP Client HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DHCP Client HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP_CLIENT HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP Client Exit the Registry Editor.

[Prolatariat_]

---------------- FindNarrator NT-2K-XP ---------------- Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ***** Operating System ***** Microsoft Windows XP Home Edition 5.1 Service Pack 1 (Build 2600) ********* Date/Time ******** Thursday, November 10, 2005 (11/10/2005) 12:51 PM, New Zealand Standard Time *********** Path *********** FindNarrator.bat is running from: C:\Documents and Settings\Owner\Desktop\FindIt NT-2K-XP\FindIt NT-2K-XP ---------------- Strings.exe Qoologic Results ---------------- ---------------- Strings.exe Aspack Results ---------------- ---------------- Active Setup Installed Components ---------------- ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{02f78298-8af6-495c-9ecb-b6ae68678186} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608555} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{839117ee-2132-4bae-a56a-42b50204c9b9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{ACC563BC-4266-43f0-B6ED-9D38C4202C7E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} ---------------- Context Menu Handlers ---------------- REGEDIT4 [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ewido] @="{57BD36D7-CE32-4600-9B1C-1A0C47EFC02E}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files] @="{750fdf0e-2a26-11d1-a3ea-080036587f03}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With] @="{09799AFB-AD67-11d1-ABCD-00C04FC30936}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu] @="{A470F8CF-A1E8-4f65-8335-227475AA5C46}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR] @="{B41DB860-8EE4-11D2-9906-E49FADC173CA}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}] @="Start Menu Pin" ---------------- Run Key ---------------- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Hcontrol"="C:\\WINDOWS\\ATK0100\\Hcontrol.exe" "AGRSMMSG"="AGRSMMSG.exe" "SoundMan"="SOUNDMAN.EXE" "ASUS Live Update"="C:\\Program Files\\ASUS\\ASUS Live Update\\ALU.exe" "Power_Gear"="C:\\Progra~1\\ASUS\\Power4 Gear\\BatteryLife.exe 1" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "SiS Tray"="C:\\WINDOWS\\System32\\sistray.EXE" "SiS KHooker"="C:\\WINDOWS\\System32\\khooker.exe" "pccguide.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\pccguide.exe\"" "PCCClient.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\PCCClient.exe\"" "Pop3trap.exe"="\"c:\\Program Files\\Trend Micro\\PC-cillin 2002\\Pop3trap.exe\"" "EPSON Stylus C45 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I3T1.EXE /P23 \"EPSON Stylus C45 Series\" /O6 \"USB001\" /M \"Stylus C45\"" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" ---------------- FindNarrator NT-2K-XP ---------------- 

[LDTate]

Nothing there. Run that registry fix I posted and see if those entries are there.

[Prolatariat_]

I found 4 of the 6 entries, but havn't deleted them yet: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msdirectx HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp

[LDTate]

Right click on each of them ( msdirectx and all the Dhcp) and use Export each to the desktop.

Now delete all 4 ( msdirectx and all the Dhcp).

Exit the registry.

Open C:\windows\System32\msdirectx <--Delete this file if listed.
Note: If you can't delete it use Killbox.


Download Pocket Killbox version 2.0.0.175
http://www.atribune....ads/KillBox.exe
If you already have Killbox first ensure it is this version !.

Then double-click on the killbox.exe program.


Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled Delete on reboot.

Do not close killbox, and open notepad, by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.


When notepad is open, copy and paste the following bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing Control-C on your keyboard. Then click on the open notepad windows and press Control-V to paste the contents into the notepad.



C:\windows\System32\msdirectx


Return to Killbox, go to the File menu and select Paste from Clipboard.


Still in Killbox, click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.

If your computer does not restart automatically, please restart it manually

[Prolatariat_]

This one would not delete: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP It gave an error message saying "Cannot delete LEGACY_DHCP: error while deleting key" Do I delete the exported files from the desktop too? I looked for this --> C:\windows\System32\msdirectx , but there was only a file called "DirectX" in System32.

[LDTate]

[quote name='Prolatariat_' date='Nov 9 2005, 07:07 PM' post='227843']
This one would not delete:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_DHCP

It gave an error message saying "Cannot delete LEGACY_DHCP: error while deleting key"
Lets leave that one then.

Do I delete the exported files from the desktop too? Not yet. I'd make sure everything works.


I looked for this --> C:\windows\System32\msdirectx , but there was only a file called "DirectX" in System32.
DirectX is a legit file. Leave it.

Give it awhile and let me know how it goes.

[Prolatariat_]

Well things appeared to be running well. Media Player is working without freezing, I can disconnect/reconnect without a problem, it's shutting down normally. Although, Add/Remove programs doesn't open. But once again a virus is picked up PC-cillin detected this again: C:\WINDOWS\System32\msdirectx.sys TROJ_ROOTKIT.H Can't be cleaned, was quarantined.

[LDTate]

Lets try this tool. rookit infections are very bad. they try to steal passwords, account numbers, etc.
http://www.microsoft...ve/default.mspx

[Prolatariat_]

I use internet banking a lot so I can do without that type of virus... MRT Log: --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.2, March 2005 Started On Thu Apr 07 10:54:52 2005 Results Summary: ---------------- No infection found. Return code: 0 Microsoft Windows Malicious Software Removal Tool Finished On Thu Apr 07 10:55:15 2005 --------------------------------------------------------------------------------------- Microsoft Windows Malicious Software Removal Tool v1.10, November 2005 Started On Thu Nov 10 15:46:10 2005 Quick Scan Results: ---------------- Found virus: Backdoor:Win32/Sdbot!40D5 in file C:\WINDOWS\System32\csrssa.exe Quick Scan Removal Results ---------------- Terminating process with pid 2448 Operation succeeded ! Deleting registry value HKLM\SOFTWARE\Microsoft\OLE, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Terminating process with pid 2448 Operation had previously completed. Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Terminating process with pid 2448 Operation had previously completed. Deleting registry value HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, entry: Microsoft Client/Server Runtime Server Subsystem Operation succeeded ! Writing in file C:\WINDOWS\system32\drivers\etc\hosts Operation succeeded ! Deleting file C:\WINDOWS\System32\csrssa.exe Operation succeeded ! Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Deleting file C:\WINDOWS\system32\csrssa.exe Operation had previously completed. Results Summary: ---------------- Found Backdoor:Win32/Sdbot!40D5 and Removed!

[LDTate]

Now lets see how it goes