eric012

I think we have the culprit. I stopped the Kaseya Agent Process and reran MBAM. It did not detect the limewire files.

It just might. I'm no longer in that business environment, but Kaseya Agent is still running on my machine. I'll uninstall it and see if that resolves the issue.

Done. Systemlook does not see any file called limewire.exe. I checked 4-5 of them manually and could not find the file (and I am showing hidden files, OS files, etc). Files found are consistent with past observations. Are you thinking this is a MBAM bug? Files Detected: 14 c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

I rebooted and ran systemlook twice and it didn't find anything either time. I ran MBAM immediately after the second run, and it again flagged the files just like before. I then ran systemlook again and it saw nothing. No other scanner sees these files but MBAM and I've ran a bunch of them. Very strange. I'd like to just write it off as a false positive, but these backdoor trojans are scary.

Nope. Detected again after restart. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.02.08 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 EHarris :: D620-EHARRIS [administrator] 8/2/2012 2:40:08 PM mbam-log-2012-08-02 (14-40-08).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 359021 Time elapsed: 8 minute(s), 49 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 14 c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. (end)

OK, I ran it and it didn't find anything. I'm going to restart again and rerun and see what it finds. This seems to have happened before. I run it and it finds nothing. I restart and rerun and it finds those entries.

All went fine. Run another scan and see what happens?

It is the free version. I do plan to intall the pro version though as I use the tool a lot. No other scanner (and I've ran many ) finds those problems. I did run ESET's online scanner and it found some things (including Yontoo which you suggested I remove). None of it looks like the same problem to me though. See below: C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined C:\Documents and Settings\All Users\Application Data\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined C:\Documents and Settings\All Users\Start Menu\Programs\eBay.url Win32/Adware.ADON application cleaned by deleting - quarantined C:\Documents and Settings\eharris.SIXSIGMA\My Documents\Downloads\cnet2_SiteMapGenerator_exe (1).exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined C:\Documents and Settings\eharris.SIXSIGMA\My Documents\Downloads\cnet2_SiteMapGenerator_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined

SystemLook 30.07.11 by jpshortstuff Log created at 11:02 on 02/08/2012 by EHarris Administrator - Elevation successful ========== filefind ========== Searching for "limewire.exe" No files found. -= EOF =

I was out of town yesterday and just had a chance to check and, unfortunately, MBAM still finds the problem. See below. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.08.02.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 EHarris :: D620-EHARRIS [administrator] 8/2/2012 9:24:57 AM mbam-log-2012-08-02 (09-24-57).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 358978 Time elapsed: 22 minute(s), 24 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 14 c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot. (end)

What do you mean "Update"?

https://www.virustotal.com/file/3da4f51682e7d42c5569f1fb1adc6295182962e36f748219e1d0c8f2389ba516/analysis/1343777334/ I also noticed that ComboFix created a file called ComboFix-quarantined-files.txt. Do you need that?

Detection Ratio: 1/40 Antivirus: eSafe Result: Win32.TrojanHorse

Combofix log is attached. log.txt

Id'd them again. I did remove all, but haven't restarted. Maybe irrelevant, but MBAM crashed on my first attempt at rerunning this time. Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Database version: v2012.07.31.10 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 EHarris :: D620-EHARRIS [administrator] 7/31/2012 4:30:30 PM mbam-log-2012-07-31 (16-51-22).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 360146 Time elapsed: 20 minute(s), 40 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 14 c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken. (end)