Trojan horse Rootkit CW uh oh

15 years ago

This is the first time I've ever had a virus. I was visiting a blog that I read every day and it wouldn't connect the first couple of times. There was a message...something about incorrect header or something and I didn't pay much attention, just tried it again and it loaded normally.

AVG continues to pop up the same window as below>>>>

AVG popped up a window saying Multiple Threat Detection

It listed the following:

Trojan horse Backdoor Generic 11CEG

Trojan horse downloader Agent.AVTB

Trojan horse Rootkit Agent.CW

Trojan horse Rootkit Agent.CW

I chose "Remove all unhealed infections" The first three listed were sent to the virus vault but the fourth one (duplicate of third one) still says infected.

I selected it and chose to remove selected infection and a window popped up that says "Some files cannot be healed".

Am I in big trouble?

I'm running a complete scan right now and will see what that says.

Pam

Sort by:Oldest

Comments (35)

zep516
15 years ago
last modified: 9 years ago
Please follow directions we can look at log an make a decision if you need to be moved to the forum that raven an I send folks to.

Please download Malwarebytes' Anti-Malware to your desktop. Click here
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
Â If an update is found, it will download and install the latest version.
Â Once the program has loaded, select "Perform Full Scan", then click Scan.
Â The scan may take some time to finish,so please be patient.
Â When the scan is complete, click OK, then Show Results to view the results.
Â Make sure that everything is checked, and click Remove Selected.
Â When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
Â The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Â Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
zep516
15 years ago
last modified: 9 years ago
It looks like a vundo infection see what malwarebytes pulls out.
Related Discussions
A question of hydraulic minds.....
Q
Comments (7)
Kompressor, Sorry to be late in posting, but this website's weird login kept me from responding much earlier. I've reread my original posting, and I cannot see where I gave anyone the idea that I was an expert on working with hydraulics. So, I take your suggestion with a grain of salt. I can however read, and I've studied a number of wide and varied subjects in my time. Hydraulics can be learned just like anything else with proper time and patience. I have installed hydraulic bypass and an additional cylinder on the rear end of my Farmall Cub for the 3 point hitch. Either I'm darn lucky, or the information I read was on the money as I didn't blow out the hydraulic system, and the 3 point hitch has worked like a charm from the time it was installed as well as the other times it was removed for tractor restoration and then replaced. That project also involved installing a cessna single spool valve to drive the rear hydraulic cylinder. I had contacted kwikway on this project seeking to purchase a hydraulic pump separately to do my project. The project being to add hydraulics to drive either a IH scrape blade or even replace the electric actuators on my JB Jr Bucket when the actuators burn out. No intention of installing a FEL at that point. However in talking with a representative of kwikway on the phone, I was told they are considering doing away with the FEL business on garden tractors as the demand just isn't there anymore with this weak economy. They also told me they really weren't interested in selling individual parts for the loader system. With that amount of information, I then called Surplus Center inquiring about a hydraulic pump from them. Problem is the pumps I was considering were for direct drive, and not for use with a pulley to be driven from the PTO on the front of my Kohler engine. Back to the drawing board again. I've read about people using automobile power steering pumps for the hydraulics, with good results. So, here's where I am. At least I know my engine turns CCW, and I can either use a side mounted hydraulic pump the also turns CCW, or I can use a pump the turns CW by turning that pump to face the front of my engine and drive it via belt off my PTO. So, there you are. Oh, as far as the Case/Ingersoll is concerned: I hadn't even heard of the garden tractors (large farm tractors yes) until about a year or so ago, and it was from right here. In my area - (NC), that brand of tractor is about as scarce as hen's teeth. Now that I know of them, I've found I think 5 total in the entire state of NC for sale used. But, since I have my Cub Cadet, I find it hard for me to rebuild yet another garden tractor just to get the hydraulics. Besides, there's something to be said about building and learning from a project like this. I still enjoy reading and working with my hands. It is a hobby, not a job. That makes a huge difference as far as I'm concerned. I had another hobby for well over 22 years. It became so intense that it became worse than a job. I finally gave it up even though I used to love it as much as I did. You know something? Though I miss it from time to time, I do not miss the "war of money" from the competition. I now take my time an enjoy life as I can. It is getting shorter these days, and I love it more than I ever have. Cheers to all of you.
...See More
Hijack this scan results
Q
Comments (9)
I used a website to analyze your log file. You can go their and paste your log if you wish. http://hijackthis.de/index.php ------------------------------------------------- C:\WINDOWS\9129837.exe Extremely nasty Nasty (2.27 / 5.00) ------------------------------------------------------------ O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe Nasty Must be fixed! Malware ----------------------------------------------------------- O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll Nasty ------------------------------------------------------------
...See More
PC security scan thing....
Q
Comments (6)
There's a line between prudence and paranoia and I think some folks tend towards the latter. Everything that goes wrong with a computer, isn't the result of malware and viruses. There's a healthy dose of old fashioned user error in the mix and quite frankly some of these "help" programs cause more problems than they solve. It was a month or so back where we had a user, with one of these "help" programs who got a little overzealous editing the registry with predictably disastrous results. I don't know that Linux is the answer for the average user. It, unfortunately, seems to add a layer of complexity without a good technical support structure. There are also a fair number of users who use their computers for work and their employers require or support only certain applications and even operating systems. If the boss wants your spreadsheet in Excel, Linux isn't much help. Oh sure, you can run a Windows virtual machine inside of Linux but now you need two operating systems. I played with Linux back in my anti-Microsoft days but once I discovered NT, most of my problems went away.
...See More
accents and words used
Q
Comments (10)
I think Gilbert Gottfried is hilarious and what's interesting is that he enunciates very well and at least to me, is at least very understandable. The interesting thing with drawls, people with them don't have them when they sing. (Except for some "CW" singers who don't sing they just talk nasally to force their already forced accent anyway.) But when singing, there's no y'alls randomly tossed in for no good reason. So, where do they go if this is so "natural"? I get a kick out of watching something like American Idol and to plagerize a toothpaste commercial Y'all wunder were the yallin went when y'all is singing in public... I have yet to hear "Y'all are my sunshine, my only sunshine, y'all make me happy when y'alls skies are grey..." I was raised in Minnesota and my cousin was raised in Texas. We had an interesting conversation about it and I asked her about it. She stopped for a second and went "You know what, you're right. I can't explain that." And she even made the comment they force in a lot of unnecessary "y'alls" especially when they're trying to make a point. My Aunt was married to a guy from Mississippi. She was talking about her late husband and mentioned how the accent always got thicker when he got more frustrated or angry. I've never noticed it but after decades of marriage, she'd know. Another thing she mentioned was he never used "y'all" and never let the kids use it either. Guess he agreed with Will Smith's grandmother! Back in the 80s I was sent to Charlotte, NC, for work and there were representatives from around the country. What a combination! Felt like the United Nations! Some of the ones I recall are people from Ohio, Boston, Minnesota (of course), Arkansas, Dallas to name a few. We nearly needed a translator! The guy from "Bwaston" had everyone scratching their heads. Looking for a "bubbla" and took a while for it to sink in he wanted a drinking fountain. But we figured him out quickly when he asked "shu-we hava bee-uh". This guy could put Cliff Clavin to shame. I occasionally am reminded of him when watching Cheers! I'm sort of a news and weather junkie and there's another interesting thing I've noticed when I'd travel. I always would turn on the local news and try to catch several different channels. For a while I had satellite with several different newscasts available. With rare exception, the top rated news anchors and most voiceover announcers would be accent-free or what's known in media as the "midwest accent". It surprised me how people without the regional accent would be more popular. A great example is Houston's Dave Ward. Even Maaaaaaaarrrvin Zindler, Eyeeeeeeeeeeeeeewitness News had very little accent for being a Houston native at the end of his life. Actually, looking at old footage compared to later footage he actually seemed to lose a lot of his accent. I have my suspicions as to why though... In any case, I do have to say old Marvin was hilarious and I really enjoyed his "Rat and Roach Reports" and SLIME, in the ICE MACHINE! He was definitely one unique character. As far as Paula Deen, besides the forced accent, the thing that troubles me most is that she claims recipes as "hers" when they've been around a long time. I highly doubt Paula Deen invented smokies in BBQ sauce. I got a recipe for butterscotch brownies from Franco Palumbo and saw it in an old, old cookbook too, but she claims it as "hers". To me it's at least fraud. People like that lose my respect and the phoniness on top of it just makes her move down that many more pegs. Nice person? Probably very nice. Like to have her as a neighbor? Sure, why not, at least from what I know now, but then ask if I would trust someone like that? Nope. I'd rather have Marvin, excuse me, Marrrrrrrrrrvin back.
...See More
zep516
15 years ago
last modified: 9 years ago
AVG is not going to be able to deal with this.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
After I posted above, the "Multiple Threat Detection" window continues to pop up. This time I right clicked and it let me "delete".

The Resident Shield Alert popped up again and this time it said "Threat Detected".
File name: c:\\Windows\system32\drivers\netsik.sys
Threat name: Trojan hose Rootkit-Agent.CW
"detected on open"

I clicked on "more information about this threat" and it took me to AVG's virus encyclopedia. I typed in the name of the virus and it says it's not found in the encyclopedia.

While scan was running another "resident shield alert" window listing
C:\\Windows\system32\drivers\fips32cup.sys (I chose to heal and it moved it to virus vault)
C:\\Windows\system32\drivers\fips32cup.sys - result: infected
C:\\Windows\system32\drivers\nicsk.32.sys - result: moved to virus vault

Another resident shield alert
Threat detected
File name: C:\\Windows\syster32\drivers\ati64si.sys
Threat name: Trojan horse Rootkit-Agent.CW detected on open.

I'm getting an ad at the bottom of my AVG scan window asking me to upgrade to AVG Internet Security. ???

The scan finished showing no infections. It scanned my C: and J: (external hard drive) a total of 334,374 files. There were 22 warnings that were all tracking cookies. Do I really have a virus?

Microsoft XP Professional
Version 2002
Service Pack 3

AMD Athlon 64 Processor
3200+
2.00 GHz, 512 MB of RAM

I will be out of town tomorrow. I'll check back as soon as I return tomorrow afternoon or evening.
zep516
15 years ago
last modified: 9 years ago
The file extension .sys is usually associated with rootkits, they can hide on the system.

When you return you should run Malwarebytes, hijackthis log.

And the online scanner in the link below that will create a log an is most important.

I will post the instructions for kaspersky scanner later
zep516
15 years ago
last modified: 9 years ago
The on line scanner does not remove anything but will show malware that virus scanners don't see.
ravencajun Zone 8b TX
15 years ago
last modified: 9 years ago
the infection names you are seeing are very significant infections as zep said rootkits hide deep in your system, these are items you do not want on your pc and if you do have a backdoor also you want to make sure you are not using that pc for anything like banking or making purchases where you will be exposing your info. Definitely do the malwarebytes scan and let us see what the log finds.
susieq07
15 years ago
last modified: 9 years ago
AVG also has a Free rootkit scanner which I have downloaded and run but, it found no problems in my PC, but I bet it would in yours?
ravencajun Zone 8b TX
15 years ago
last modified: 9 years ago
pfmastin just so you know malwarebytes does have rootkit detection and removal included it covers the bases well.
zep516
15 years ago
last modified: 9 years ago
Rootkits were already identified below:

C:\\Windows\system32\drivers\fips32cup.sys
C:\\Windows\system32\drivers\fips32cup.sys
C:\\Windows\system32\drivers\nicsk.32.sys
C:\\Windows\syster32\drivers\ati64si.sys
pfmastin
Original Author
15 years ago
last modified: 9 years ago
I just got home and have run Malwarebytes. Shall I go ahead and follow your instructions and download and run Hijack This?

Also, Zone Alarm keeps wanting me allow CEE.8.exe and I've been saying "deny". Is that correct?

And AVG Resident Shield Alert keeps popping up showing the threats and I'm just saying "close". Is that all right?

Will I infect anyone else? I worry about that.
Thank you both for your help.
Pam

Malwarebytes' Anti-Malware 1.35
Database version: 1938
Windows 5.1.2600 Service Pack 3

04/03/2009 8:42:38 PM
mbam-log-2009-04-03 (20-42-29).txt

Scan type: Full Scan (C:\:)
Objects scanned: 134579
Time elapsed: 48 minute(s), 50 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 18
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 43

Memory Processes Infected:
C:\WINDOWS\Temp\CEE8.tmp (Backdoor.KeyStart) -> No action taken.
C:\WINDOWS\9129837.exe (Trojan.Agent) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\crypts.dll (Trojan.Agent) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpi32 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\acpi32 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\netsik (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\systemntmi (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\systemntmi (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\systemntmi (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\new_drv (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Spamtool) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ksi32sk (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ksi32sk (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksi32sk (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ws2_32sik (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ttool (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\Program Files\PCBugFinderPro (Rogue.PCBugFinder) -> No action taken.

Files Infected:
C:\WINDOWS\Temp\CEE8.tmp (Backdoor.KeyStart) -> No action taken.
C:\RECYCLER\S-1-5-21-1292428093-152049171-725345543-1004\Dc48.exe (Rogue.Installer) -> No action taken.
C:\RECYCLER\S-1-5-21-1292428093-152049171-725345543-1004\Dc50.exe (Rogue.Installer) -> No action taken.
C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP983\A0167838.exe (Rogue.PCBugFinder) -> No action taken.
C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP987\A0168838.exe (Rogue.PCBugFinder) -> No action taken.
C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP997\A0179806.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\acpi32.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\securentm.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\systemntmi.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\port135sik.sys (Rootkit.Agent) -> No action taken.
C:\WINDOWS\Temp\327.tmp (Backdoor.KeyStart) -> No action taken.
C:\WINDOWS\Temp\4B33.tmp (Backdoor.KeyStart) -> No action taken.
C:\WINDOWS\Temp\FC82.tmp (Backdoor.KeyStart) -> No action taken.
C:\Program Files\PCBugFinderPro\ErrorLogFile.txt (Rogue.PCBugFinder) -> No action taken.
C:\WINDOWS\9129837.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\i386si.sys (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN3.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN7.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\Temp\wpv821238318368.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\crypts.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN10.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN11.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN12.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN13.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN27.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN2A.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN2B.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN2F.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN34.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN35.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN36.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN37.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN38.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN39.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Pam\Local Settings\Temp\BN3A.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\ksi32sk.sys (Rootkit.Agent) -> No action taken.
zep516
15 years ago
last modified: 9 years ago
Yes run hijack
zep516
15 years ago
last modified: 9 years ago
You also missed a step with malwarebytes you took no action,

Please review these steps again,

When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Oops, I might have put this in the wrong place...please ignore the other post. So sorry.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:57:49 PM, on 04/03/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\TEMP\CEE8.tmp
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\9129837.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Stickies\stickies.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Documents and Settings\Pam\Pam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Road Runner High Speed Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - (no file)
O2 - BHO: Symantec Intrusion Prevention - (6D53EC84-6AAE-4787-AEEE-F4628F01010C) - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll (file missing)
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - (no file)
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Elements 6.0\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Pam] C:\Documents and Settings\Pam\Pam.exe /i
O4 - HKCU\..\Run: [ttool] C:\WINDOWS\9129837.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - Startup: Stickies.lnk = C:\Program Files\Stickies\stickies.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Real.com - (CD67F990-D8E9-11d2-98FE-00C0F0318AFE) - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - (FB5F1910-F110-11d2-BB9E-00C04F795683) - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: (8AD9C840-044E-11D1-B3E9-00805F499D93) (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk/6u12-b04/jinstall-6u12-windows-i586-jc.cab?e=1237899824608&h=8930706315980f1c96d909f78bf83381/&filename=jinstall-6u12-windows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - Unknown owner - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe (file missing)
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - Unknown owner - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9071 bytes
zep516
15 years ago
last modified: 9 years ago
We will move you to another forum,

Backdoor.KeyStart is a dangerous trojan application. It was designed to download and install other malware, adware or rogue anti-spyware programs. Usually, it displays fake alert messages or notifications about various infections. Of course, those infections are made up in order to scare the user hopping that he will download worthless spyware remover. Backdoor.KeyStart is also a serious threat to personal information such as credit card numbers or passwords. It is highly recommended to remove Backdoor.KeyStart from the system as soon as possible after detection.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Zep, should I select Backdoor.KeyStart it and remove it? Should select to remove everything?

How will you move me to another forum?
zep516
15 years ago
last modified: 9 years ago
I suggest you get to a clean computer and change your passwords for any banking related things, and contact you financial institutions
zep516
15 years ago
last modified: 9 years ago
Let malwarebytes remove everything it finds review the instructions for running it again.

I or raven will move you to a forum you will recieve instructions
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Yikes! Will do. Am I supposed to do anything with the Malwarebytes results....remove anything? How will you move me to another forum?
zep516
15 years ago
last modified: 9 years ago
Relax first,

I will get a link same place we send everyone....
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Zep, I want to leave right now to go to my husband's office to change the passwords. Do I need to be here for you to move me?
zep516
15 years ago
last modified: 9 years ago
Let malwarebytes remove everything it finds
zep516
15 years ago
last modified: 9 years ago
Go ahead we will take care of it....
pfmastin
Original Author
15 years ago
last modified: 9 years ago
It turns out I'll be here....can you transfer me to the forum?
zep516
15 years ago
last modified: 9 years ago
Working on it

No one is going to do anything tonight you will need to be patient as it can take a bit for someone to respond to you request.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Should I just check in tomorrow morning?

Can I ask a few questions?
Will I infect anyone else? I worry about that...should I not read email, etc?

How does one usually contract this infection?

In your experience can this usually be solved on a weekend? I need to let my office know.

Also, I have long distance access to my office...will this cause a problem for them or will they be safe if I don't connect to them?

Thanks so much!
Pam
zep516
15 years ago
last modified: 9 years ago
Here is the link for forum below you need to register there.

Then click where it says HIJACKTHIS logs an start a topic you will see it, please state your problem "I have
"Backdoor.KeyStart." You can copy an paste the malwarebytes log an the hijackthis log from here right into there.

Please provide a link to this thread also....They probably will not get to you till Sat.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
Thank you so much, Zep...I appreciate your help. I'll follow your instructions. Did you see my questions above...can you help me with those? If not, that's ok. Thanks again.
Pam
zep516
15 years ago
last modified: 9 years ago
"In your experience can this usually be solved on a weekend".

As long as you follow the directions the helper is giving you and provide the results of scans asked to run you can move quickly.

You can still use the computer I think malwarebytes is going to take care of most of it you just need to let it remove everything it finds, then run "ATF CLEANER" google it.

Don't connect to them to be safe office.

Not sure how you got it, could have been a malicious web link...

Post a malwarebytes log if you have time that shows you deleted everything this will speed up the process at the other forum.
pfmastin
Original Author
15 years ago
last modified: 9 years ago
I'll follow your instructions and let you know how it all turns out. Thank you very much, Zep. I'm running the malwarebytes scan and I'll post it here and have it for LandzDown.
zep516
15 years ago
last modified: 9 years ago
This is the second Malwarebytes scan after I removed everything I could from the first scan results.
Malwarebytes' Anti-Malware 1.35
Database version: 1939
Windows 5.1.2600 Service Pack 3

04/03/2009 11:04:36 PM
mbam-log-2009-04-03 (23-04-36).txt

Scan type: Full Scan (C:\:)
Objects scanned: 119355
Time elapsed: 47 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 15
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\acpi32 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amd64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netsik (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nicsk32 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i386si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ati64si (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fips32cup (Rootkit.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore"415790D9-BB81-41AF-9469-EEC2DB43FA43>\RP997\A0179839.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\acpi32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\amd64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\netsik.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\nicsk32.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\fips32cup.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\i386si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\ati64si.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
ravencajun Zone 8b TX
15 years ago
last modified: 9 years ago
Sorry Zep I just got your message, glad she got over to LzD ok, I have been off schedule preparing for this move.
Let me know if you need me.

Definitely some nasty infections there but it will get taken care of Pam, the team is excellent.
susankarberg_sbcglobal_net
15 years ago
last modified: 9 years ago
I seem to have gotten this same thing on my computer. I'm running a full Malwarebytes scan right now. Can I join and get some help too? Thanks so much!

Sue
zep516
15 years ago
last modified: 9 years ago
Start a new topic post the malwarebytes log
susanrk
15 years ago
last modified: 9 years ago
Thanks, will do.

Trojan horse Rootkit CW uh oh

Comments (35)

Related Discussions

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

pfmastinOriginal Author

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author

pfmastin
Original Author