Can not remove trojan horse dropper

Hi,
Usually when I post a problem, you know I got one. I have been removing spyware and malware, etc, etc from people's computers for over 3 years now but as everyone knows it's become more than a challenge...The computer in question when brought to me, did not allow you to access Msconfig, Add/Remove panel and could not access the Internet...After some house cleaning, I was able to access the Internet (which is dial up), and soon after had to deal with pop-up's...Eventually I was able to download some spyware removal programs but the pop-up's would freeze the scan and cause me to have to reboot the computer...One of the programs was AVG Virus scan, which detected 35 trojans...In time I was able to reduce that from 35 to 12...To assist me further, I downloaded Spybot, AdwareSE, X-Cleaner and SpySweper...Several items were removed but no matter how many times I run AVG, the 12 trojans listed as Trojan Horse Dropper 1A / HG /7.K / YF / YC can not be healed and no matter what I do including running the removers in safe mode, disabling system restore, showing hidden files & folders, nothing removes them from the C:\Windows directory...The computer is a Windows XP and uses Mozilla Firefox for it's Internet Browser...Your assistance will be greatly appreciated...P.S - Everything can be accessed now, shuts down and boots up good and no more pop-up's...

 

Use the Killbox, it can setup the files to be deleted on reboot.

 

Hi,
Thank you, will look into it...Options and alternatives are always appreciated.I even un-installed the programs that I used and re-installed them incase they became infected because they were downloaded to help remove infections that were numerous and that did not make a difference. I also did so incase there were any false positives and still no luck. Finding out info on this particular Trojan has been a difficult task as well...

 

Hi,
I first want to apologize for originally posting this in the wrong place, I know better than that but some how failed to realize that.

Anyways, incase anyone should entertain the thought of advising me to use a program called "trojan hunter "...to be aware that I did after all the other things I mentioned were done and it detected only one possible infected file to which I later tracked down, removed and that made no difference. What really puzzles me is how this happens, and with assistance from AVG, Spybot, SpySweeper, X-Cleaner and AdwareSE along with manual removals of known items that 12 alledged trojans can remain...I will report back later on the success of Killbox...Just wanted to add the above info for our readers...

 

Try the scan in safe mode.
If you know what the file is, locate it and right click and choose properties. See if you can find the name of the process it generates. Then use task manager or codestuff starter to kill the process. Then repeat the scan.
Codestuf starter startup manager and process viewer

 

Hi,
I tried AVG in safe mode and it detected the same thing as in normal mode:
Trojan horse Dropper 1A/ HG/ 7.K/ YF/ YC
The files listed with it were:
dreese.exe
setup.exe
cmdxp.exe
slipit.exe
omi.exe
windowsmedias.exe
wingls.exe
pokapoka66.dll
NOTE: I can not find the above and at the completion of the AVG scan it shows no infected files/none healed but yet it detects it as trojans.

Trojan Hunter detected the following possible infected file:
c:\windows\system32\config\systemprofile\localsettings\temporaryinternetfiles\contentIE5\VD40XORM\d2(1).exe
NOTE: I followed the patch as outlined and found that particular file and deleted it myself.

Additional info; Spybot found CoolWebSearch Aff.Winshow and removed such from: c\documents&settings\owner\favorites\search...

Also, at the begining stages of my removal tactics, the following was found I do believe by AVG (and to the best of my knowledge removed it):
Trojan Horse IRC/Backdoor Sdbot.FMM in: c:\volumeInformation...

As a reminder, I could not access Msconfig, Control Panel or the Internet but that is all accessible now but my last and only problem is down too the 12 trojans. These trojans have given a new meaning to the word "frustration "...

 

Update...

When I ran Spybot, it detected and listed the following;

WindowsSecurityCenter.UpdateDisableNotify 1 entry
WindowsSecurityCenter.AntiVirusDisableNotify 1 entry
WindowsSecurityCenter.AntiVirusOverride 1 entry
WindowsSecurityCenter.FirewallDisableNotify 1 entry
WindowsSecurityCenter.Override 1 entry

I then checked to see if this computer had SP1 or SP2 and to my suprise it has SP1...I then tried to see if there was an issue with the Microsoft Firewall and can not find it thru via the Control Panel...So now I am wondering if what the AVG is detecting has any relation to the above...

 

Hello Master Green,

When I ran Spybot, it detected and listed the following;

WindowsSecurityCenter.UpdateDisableNotify 1 entry
WindowsSecurityCenter.AntiVirusDisableNotify 1 entry
WindowsSecurityCenter.AntiVirusOverride 1 entry
WindowsSecurityCenter.FirewallDisableNotify 1 entry
WindowsSecurityCenter.Override 1 entry

http://www.windowsbbs.com/showthread.php?t=46779&highlight=spybot

What you're seeing is SSD flagging of the Security Center if notiications have been disabled.

Regards - Charles

 

Hi,
I understand and thank you...To follow this up more, I had strong suspicion that the Microsoft Updates were not being allowed, once that was checked off to be automatic that is when the SP2 pack (that was suppose to be done in April or else), popped up...It was suppose to take 4 1/2 hrs, instead took more than that and after approx 22 hrs it was installed and was half way done with the updates...Unfortunately I had to do a no-no and stopped the updates as I needed to get to work...Afterwards, a message popped up saying the updates were not complete...I will see if I can get the updates done later...For now the SP2 is showing in the Add/Remove and as a installed.
However, when I ran the AVG it still listed the 12 trojans even though X-Cleaner, AdwareSE and Spybot shows a clean system (other than the Windows Security items)...I also ran CWShredder and it showed nothing...In my list of things to do later, I will re-run Spybot now that the SP2 etc were done and see if they still appear...Will post back later...

 

Hi,
I guess just when you think there's a light at the end of the tunnel, wrong again...TrendMicro virus scan will not run on Mozilla, and because I interupted the SP2 Updates it now says to uninstall the Windows Service Pack through the Add/Remove but when I do it gives me some type of message to do with the language and will not uninstall...In the mean time AVG keeps popping up with a virus detected "c:windows/system32/msconfig.exe and says it's been removed but it keeps re-appearing...For some reason I don't think after 36 hrs of finding, removing, spending hours just downloading stuff (becuase it's dial up), that I am going to win this battle.

 

I am assuming you have XP, if so, that file is a fake. The legit Msconfig.Exe does not exist in that folder. It is in "C:\WINDOWS\PCHealth\HelpCtr\Binaries ". You should use the Killbox on it, and maybe post a HJT log?

 

Hi,
I will post a hijacklog and go from there...

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe "
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\RunServices: [Service Drivers] msnpg.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: EarthLink ToolBar 5.0.lnk = C:\Program Files\EarthLink 5.0\etoolbar.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108584393156
O17 - HKLM\System\CCS\Services\Tcpip\..\{739B062A-E2D3-4492-87DA-2D1D5502C488}: NameServer = 207.217.77.82 207.217.120.83
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: msmbios (Microsoft System Management BIOS Driver) - Unknown owner - C:\WINDOWS\mssmbios.exe
O23 - Service: Sound Sservice Driver (Sound Service) - Unknown owner - C:\WINDOWS\System32\msconfig32.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe (file missing)
O23 - Service: Windows Taskbar Manager (wtaskbarmngr) - Unknown owner - C:\WINDOWS\taskbarmngr.exe (file missing)

 

Logfile of HijackThis v1.99.1
Scan saved at 1:50:01 PM, on 9/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\mssmbios.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\EarthLink 5.0\ConMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\EarthLink 5.0\etoolbar.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\EarthLink 5.0\FastLane\ARUpld32.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe "
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\RunServices: [Service Drivers] msnpg.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: EarthLink ToolBar 5.0.lnk = C:\Program Files\EarthLink 5.0\etoolbar.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1108584393156
O17 - HKLM\System\CCS\Services\Tcpip\..\{739B062A-E2D3-4492-87DA-2D1D5502C488}: NameServer = 207.217.77.82 207.217.120.83
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: msmbios (Microsoft System Management BIOS Driver) - Unknown owner - C:\WINDOWS\mssmbios.exe
O23 - Service: Sound Sservice Driver (Sound Service) - Unknown owner - C:\WINDOWS\System32\msconfig32.exe (file missing)
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows Process Moniter - Unknown owner - C:\WINDOWS\winmon.exe (file missing)
O23 - Service: Windows Taskbar Manager (wtaskbarmngr) - Unknown owner - C:\WINDOWS\taskbarmngr.exe (file missing)

 

Hi,
Sorry about the first HijackThis log posting, I did not realize what had happened to after I submitted it.

In addition to the log I would like to add this info to also what's happening:
(1) I tried to uninstall Service Pack 2 -thru add/remove
Note: gave the following message>
Bosnia is selected as the language for standards and formats, or for non-
Unicode programs. This language is not supported prior to Windows Xp
Service Pack 2. Please see readmesp.htm to select a different language.

(2) I tried to uninstall Service Pack 2 -by doing a system restore
Note: Would not restore to a date prior to the Install of Service Pack 2.

(3) I tried to uninstall Service Pack 2 -from run box (c:\windows\$NtService
PackUninstall$\spuninst\spuninst.exe)
Note: Gave the same message as is the add/remove attempt.

 

Hi Master Green,

(2) I tried to uninstall Service Pack 2 -by doing a system restore
Note: Would not restore to a date prior to the Install of Service Pack 2.
Does this mean you can restore to a point after SP2 or does it mean can't restore at all?

I think if SR is not totally s r e w e d up, there just isn't any room for the restore. SR has to store all the system changes of SP2 + the additions, it does that for the "un do" option.

What you might try to do is make some room:

Go into the SR tab of My Computer and shrink the room allocated to SR by moving the slider left and reboot and move the slider back to the max - I assume it's currently the default setting of 12% of the HD.

I can't tell you by how much to decrease the size because I don't know how big the SVI file is. It depends how far back SP2 is. If it's too far back, you run the risk of getting rid of more than you want.

Hope this is some help to you.

Regards - Charles

 

Hi,
If my memory serves me correctly, I believe I did the SP2 thing about two days ago and I tried the system restore the day before, and I "think" it said cannot restore "before "(but that does not make sense if that's what it said)...So what I would like to do is wait out a response to the posting of the HijackThis log and then see if the slider info you provided will help pending the response...

 

Hello all.......I'm compelled to jump in here because of some of the infected files you listed associated with an infection that needs a special fix.

Please download LQfix.exe and place it on your desktop.
Doubleclick LQfix.exe and click install.
Leave the default settings. If you change them, the fix will fail.
Make sure 'Launch LQfix' is checked. After clicking finish in the install, the fix will start.
Follow the prompts on the screen.
Your system will reboot afterwards.
Please be patient after reboot, because there is a script running in the background.

Run AVG again and post the names and locations of any infected files found. Also post a new HijackThis log.

 

Hi,
Thanks for jumping in and I will do as instructed and post back as soon as I can...

 

Hi,
I did the LQFix.exe and I have no clue what it was doing as every time I tried to read the screen it moved on that quick to it's next step...In step two of your suggestion which was too run the AVG, it remains detecting the 12 trojans plus the following:
"Trojan Horse IRC Backdoor.Sdbot.B "
C:\WINDOWS\SYSTEM32\ERASEME_28111.EXE
Note: It was removed by AVG (Healed)

Previously I had mentioned that this was detected in the following:
C:\VOLUMEINFORMATION... (AS TROJAN IRC BACKDOOR SDBOT.FMM)
Note: It was removed by AVG (Healed)

Note; When the computer boots up, it is very slow but after all is loaded, all appears to work fine...