For a friend

[patio]

Got a panic call from a friend i built a new system for not long ago.
XPPro
All updates in place.
Symptoms: Will not boot to normal mode.
Very quick command prompt window flashes...something about shutdown.exe.
Also a run32 dll error message then the system shuts down.
Followed the suggestions and posting the logs.
The system will run in safemode however i was unable to remove java from add/remove...which is where i tracked one of the baddies down.
It is restricting Admin rights in safemode and also showing Win installer error messages. Whether the 2 are related i can't tell.
Struggling to get eSet to run properly but here are the other 2 logs for now.
Thanx in advance....

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

Wild log......Feels like a test.

HijackThis v2.0.0 (BETA) We need to get the new version of Hijackthis installed to the default location and post a new log using it.

Can you not run Avast in safe mode to see if it removes any of the malware?

We can do a few things before posting the new HJT log.

Download Trend Micro CWShredder

1. Double click the CWShredder.exe to open the Program and Click on I AGREE to accept the license agreement.
2. Checkmark the option Move CWS files found to the Recycle Bin instead of deleting them as a precaution. We can empty the Recycle Bin later once the infection is cured.
3. Click on Update to ensure the latest updates are installed.
4. Click Fix to let the CWShredder look for and fix any CWS infection it finds.
5. Click OK in the confirmation screen to continue.

• CWShredder will scan your system for known variants of CWS infections.
• The scan results are shown.

7. Click Next to continue.
8. Click Exit to exit the program.

----------

Download SDFix.exe and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
  
• Choose your usual account.
• Open the extracted SDFix folder and double click RunThis.bat to start the script.
  
• Type Y to begin the cleanup process.
  
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard).
  
• Finally add the contents of the Report.txt in your next post.

.
----------

Next post
SDFix log
New Hijackthis log

[evilfantasy]

Also, what about Superantispyware and Dr Web?

[patio]

Avast ran in safe mode...found baddies and cleaned them.
On 2nd scan they were still there so it seems it's replicating itself.
Just so you know everything i've tried up to now seems to almost get rid of things but on subsequent re-boots Failure.
I'll run the CWS and SDFix as well as SAS and Dr.Web.

PS Vundo found nothing.

Again Thanx

[evilfantasy]

I would hope that CWS, SAS, DR Web along with SDFix will get most if not everything so I am curious to see the results.

The reason I say it feels like a test is most if not all of the infections shown in HJT have been known for quite some time and aren't much of a problem any more with updated security programs. Nothing "in the wild", which is indicative of a practice log from an online school, a nice mix of bad guys are represented. Although they are some of the more "sticky" ones as you have already found.

Were there error messages during the failed Java uninstalls?

[patio]

Attempting to uninstall the 4 or 5 instances of java resulted in a very quick command prompt window and a restart.
Pause/Break key was no help whatsoever.
Just to let you know here's what has been run so far
Avast / deep scan
Spybot
AdAware
AVG Anti-spyware
Stinger ( in safemode)
VUndofix.
NTRegopt

As to the known infections i understand where you're coming from...he's not one for housekeeping and is fairly casual about his protection strategy...however i pretty much have done the basics and i still cannot get the machine to boot properly.
I'll do your follow up tasks and let you know...again Thanx

[evilfantasy]

I'm pretty sure NTRegopt is also installed along with SDFix as it uses ERUNT to make the backups created before running and NTRegopt for the cleanup procedure.

Brute force may be needed to uninstall the old java. Not sure how yet as I have never had or seen that particular problem. Have you tried to install the new version of java yet?

I have a feeling that the PC has been infected for a while and it is finally to this point. Hopefully I can help clear the malware to the point where you can work your magic and revive the OS.

Edit: After some tinkering/investigating, try going into C:\program files\java (given program files is the install location)
Open the java folders and see if there are installers there. Running the installer presents the option to modify/remove. Choose remove obviously.

Or, you can find most of the old installers here http://www.filehippo.com/download_java_runtime
And the rest here http://www.oldversion.com/program.php?n=java

The downside of this is you may need a good internet connection for it to work.

[patio]

Eset log file attached...
I'm on my way over to his Office now to run the other tools.

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

From the items found by ESET he earns the backdoor vulnerability speech.

Backdoor Trojans are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use Backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.

Read this article: Danger: Remote Access Trojans.

If your computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one! If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

Your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that because the Backdoor Trojan has been removed the computer is now secure. Many experts in the security community believe that once infected with this type of malware, the best course of action is to reformat and reinstall the OS.

When should I re-format? How should I reinstall?.
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

Should you decide not to follow that advice, we will do our best to help clean the computer of any infections but we cannot guarantee it will be 100% secure afterwards or that the removal will be successful.

[patio]

SDFix ran...reportattached.

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

That was a let down, nothing found.

Any luck with SAS? Remember to post a new HJT log also (after installing the new version of HJT)

[patio]

SAS would not run in safemode...i was kinda suprised by that.

DR Web running now...looks like it'll be awhile.
DLoad of the new HJT and a new scan to follow.
Thanx Again.

patio.

[patio]

OK... at a bit of a standstill here...do i let DRWEB cure all these ? ?
Log attached
Sorry if it's a mess but it saves as a .csv file had to convert it...

[file cleanup - saving space - attachment deleted by admin]

[patio]

New HJTlog

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

DRWEB should cure/delete all of that. Some are backups from combofix and SDFix and the rest are (I believe) related to the remote tools from the backdoor trojan.

HJT looks much better but still some work to do.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {5F426A93-0821-47D2-A126-5A48A874B289} - http://212.145.159.194/251065/dialercab/WebRecomendada.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.142/code/PWActiveXImgCtl.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} -
O16 - DPF: {D94293A8-568A-4BED-992B-94B9CBDC2148} - http://corp.2by2.net/toolbar/bin/2by2Bar.CAB
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Any luck in updating Java?

It looks like safe mode is still the only option, can you do an online scan in Safe mode with network support? I suppose so since you ran ESET.

BitDefender updated their online scanner recently to include their spyware database so I would like to run that now.

----------


This scanner works with Internet Explorer only
Go to the BitDefender Online Scanner
Click I Agree to the license and then install the ActiveX control.
Please DO NOT change the Scanning Options.
That will make your logs huge and we don't need to see clean files.
Select Start Scan to begin.
This scan can take a while so please be patient and let it complete.


Once Bitdefender completes the scan:
Click-on the Detected Problems tab.
Then select Click here to export the scan report



When the window comes up to save the report, change the Save as type: box to:
Text (Tab Delimited) (*.txt) and then in the File name box enter change to bdscan then click Save



This will save a file named bdscan.txt. I would suggest saving it to the Desktop so you can easily find it.
(take notice of where you save it so you can find it later)

This bdcan.txt file will actually contain HTML code that we can easily view later while reviewing your log. All we have to do is rename the file to bdscan.html.

If you do not follow these step, you will have an incorrect log or worse a log summary which is useless to us

Post the bdscan.txt in the next post as an attachment.

Next post
Bdscan log
New Hijackthis log

[patio]

Not sure these came out the way they should...Long Scans...

[recovering space - attachment deleted by admin]

[patio]

New HJT...

[recovering space - attachment deleted by admin]

[evilfantasy]

Yea, the bdscan results are in html format so I just have to save it to my pc as html and then view the results online.... But the BitDefender online scan is again my favorite now they have upgraded it.

I am baffled that you are still stuck in Safe mode. Have you gone into MSCONFIG under BOOT.INI and checked that it is not set to boot in safe mode? Also click check boot paths.

HJT looks MUCH better then when we started. There is one entry that needs to be examined.

O23 - Service: .NET Framework Service (.NET Connection Service) - Unknown owner - c:\windows\$ntservicepackuninstall$\svchost.exe (file missing)

This is running from the system32 folder so "could" be malicious.

Try to scan that file path with www.virustotal.com and see what results are given please.

[patio]

Wakeup EF...i have managed to get this beast back into normal mode.....
There was a reference in startup called Windows\driver.bat......
Thinking an unknown batch file was conspicious i disabled it. This is because even with hidden files and folders on Search found nothing...
In normal mode i'm now getting rid of any unneeded apps and doing a general cleaning.
One hangupi'm having though isthere are still some Admin functions that are acting up...
Once again THANX a TON and let me know what's next.

patio.

[evilfantasy]

Nice find!!!!

Since we are now booting normal then we should take a look at a new HJT log. Could be some new nasties in the startups.

[evilfantasy]

Almost forgot. I ran across this not long ago researching another fix. It won't do anything for the malware but might fix the admin settings and give you some more control.

Download to your Desktop this self-extracting ZIP archive FixPolicies.exe
 

• Double-click FixPolicies.exe
  
• Click the Install button on the bottom toolbar of the box that will open.
  
• The program will create a new Folder called FixPolicies
  
• Double-click to Open the new Folder, and then double-click the file named  Fix_Policies.cmd
  
• A black box will briefly appear and then close. This will enable your Control Panel, Task Manager and stop any Administrative warnings.
• Delete the FixPolicies files and folders.

[patio]

HereYa Go...ididn't do anything yet with the suspicious entry 023...
Thanx

[recovering space - attachment deleted by admin]

[evilfantasy]

99.9% sure it is an infection from the SDBot trojan. It is showing as a service patch uninstaller so removing it isn't going to hurt anything even if it is legit (which I doubt it is) We will run a good scan that targets this type of trojan also for a good double check.

Click Start > Run and type in: services.msc
Click OK
In the Services window find: .NET Connection Service
Select/highlight and right click the entry, and choose: Properties
On the General tab, under Service Status click the Stop button
Beside: Startup Type, in the drop menu, select: Disabled
Click Apply, then OK

Now, go to Start > Run, and copy/paste the following into the Open box:
sc delete .NET Connection Service
Click: OK

----------

I haven't used this guide in a while but it should all still be relevant to the new version of program.

Download and install The Cleaner

Open The Cleaner

• Choose Yes to create a Restore Point
  
• Click Check For Updates > Yes
  
• Choose the Options tab > Heuristics and check Disable Heuristics
  
• Now choose Home > Scan System
  • Once The Cleaner is finished click Scan Report
    
  • Click Select All
    
  • Click Save Report as HTML
    
  • Name the report The Cleaner
    
  • Save it where it can easily be found like the Desktop and click Save
• Next click Repair Selected and choose Yes to accept the changes.
  • Now in The Cleaners Toolbar cilck File > Report
    
  • Once the report is generated, in Notepad click File > Save As
    
  • Name it TCReport and save it to the desktop.
  
  
• This log will be huge and MUST be added as an attachment in the next post
  
• Exit The Cleaner.
  
• Restart the Computer.

.
This scan will usually take a while so you might want to grab one of those Guinesses

----------

Let me know how it went along with the log.

[evilfantasy]

Also do you have an XP CD on hand?

If so..........

1. Download IEFix.zip and run it.
2. Click the Apply button.
3. You'll be prompted for the Operating System CD or the Service Pack Files location.
4. Once finished Restart Windows.
 
If you're using Windows XP, insert the Operating System CD. For OEM systems, point to the Operating System source path when prompted. If you've applied a Service Pack separately, you need to insert the Slipstreamed Operating System CD (if you have one) or point the installer to the ServicePack source path when prompted (see example below). Mention the path as "C:\Windows\ServicePackFiles\i386" or "C:\Windows\ServicePackFiles"
 
 
If you don't have the Windows installation CD, and if the installation source files are not present in the hard disk, you may click Cancel when you see a dialog similar to the example below. IEFix will continue with DLL registration part.

[evilfantasy]

Can't believe I have never run across this til now.

RRT - Remove Restrictions Tool - http://en.sergiwa.com/modules/news/

Never used it but it is hosted on MajorGeeks as well so it is safe.

[patio]

OK...Long story but here's the short version....
After running everything you suggested there were still some Admin features dis-abled...
Whatever this nastie was disabled the following:
Windows installer ( and any other installer )
Uninstalling ( both in full Admin Mode and Safe Mode )
User account settings could not be changed or enabled.
Password changes in Full Admin mode.

After 2 sessions of digging around it seems these changes were slipped in thru a vulnerability in Administrator Templates of all things...since they affected the default Admin account ( which should NEVER happen ) it took some real sleuthing to find out where they were....

I promised the short version right ?...

Had him run HJT and SAS yesterday and he just shot them to me...
As of now the machine is running great; all Admin priveledges from what i can see are operable and installing/uninstalling is back to normal.

Once again Huge Kudos and Thanx ! !
patio.

[recovering space - attachment deleted by admin]

[evilfantasy]

WOW, good job!!

I knew your knowledge would be invaluable on this one. Great work.

Can you also write a script that smacks him every time he begins to go down this road again   

Looking at the logs........

[evilfantasy]

Pick one AV and loose the other. Besides that it looks fine.

I usually say to clear infected restore points but think it may be better to hold off on that for at least a few days to make sure everything is actually OK. Instead run OTMoveIt's cleanup feature which will remove all of the specialized tools. I think I remember that Combofix was installed to a folder somewhere (tisk tisk ) so be sure to delete that.

Download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop. (unless you already have it)

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)

• When finished exit out of OTMoveIt2

.
UPDATE!!! UPDATE!!! UPDATE!!! - If you do not have automatic updates enabled then visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer.
* Help with Windows updates

Learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?

[Broni]

I've been following this thread since the very beginning, and....great job, guys