registry values (trojan)

pinky_fatty_fat · March 24, 2009

So im running XP SP3

here is what my mbam log shows

Malwarebytes' Anti-Malware 1.30

Database version: 1306

Windows 5.1.2600 Service Pack 3

3/24/2009 6:44:35 PM

mbam-log-2009-03-24 (18-44-35).txt

Scan type: Quick Scan

Objects scanned: 57090

Time elapsed: 2 minute(s), 44 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

================================================================================

=========================

however when i try to remove it wont remove... i have DL'd:

AVIRA

HiJackThis

ComboFix

SuperAntiSpyware

ATF-cleaner

any thoughts?

I can start ATF, AVIRA and MBAM (though only through MBAM)

Fatdcuk · March 24, 2009

Hi thoes entries are consistent with the presense of Rootkit.Sentinel

However you are using a very old version of MBAM combined with a very old database.

Malwarebytes' Anti-Malware 1.30

Database version: 1306

We are currently upto 1.34 + DB 1891

Please uninstall old MBAM and then reinstall most recent version.

http://download.cnet.com/Malwarebytes-Anti...4-10804572.html

Update and run a quick scan

acooldozen · March 24, 2009

Where is version 1.35??????? and when?????

Fatdcuk · March 24, 2009

The download link is in my previous post

acooldozen · March 24, 2009

that is version 1.34 not 1.35 as stated in your 1st post! (post#2)....must have been a "finger" error!

Fatdcuk · March 24, 2009

lol my bad ! will edit to correct

acooldozen · March 24, 2009

Cheers!

pinky_fatty_fat · March 25, 2009

ok i updated and heres where im at (when i updated MBAM it showed 15 total after scan now im back down to the original 4 again)

Malwarebytes' Anti-Malware 1.34

Database version: 1749

Windows 5.1.2600 Service Pack 3

3/25/2009 10:33:10 PM

mbam-log-2009-03-25 (22-33-10).txt

Scan type: Quick Scan

Objects scanned: 85588

Time elapsed: 10 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Fatdcuk · March 25, 2009

Hi,

You have 2 very unpleasent rootkits present on computer that is going to take some fancy footwork to displace!

First to be addressed is the 1 thats not showing but is preventing MBAM from updating to its current database.

MBAM log is still showing you on Database version: 1749 and we are currently upto 1897

Please use the following walkthrough to diagnose(&cure) if present the CLB Rootkit Driver.

http://www.malwarebytes.org/forums/index.php?showtopic=12709

When you have done this open MBAM,goto update tab and select check for updates.

Now run quick scan and post back the MBAM log generated.

Thanks in advance.

pinky_fatty_fat · March 26, 2009

Now this is the log.. rebooting to delete...brb

Malwarebytes' Anti-Malware 1.34

Database version: 1899

Windows 5.1.2600 Service Pack 3

3/26/2009 3:12:33 PM

mbam-log-2009-03-26 (15-12-33).txt

Scan type: Quick Scan

Objects scanned: 45107

Time elapsed: 5 minute(s), 13 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 6

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Supports RAS Connections (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Supports RAS Connections (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\Temp\UAC5a35.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.

pinky_fatty_fat · March 26, 2009

all updated and still the virus..

Malwarebytes' Anti-Malware 1.34

Database version: 1899

Windows 5.1.2600 Service Pack 3

3/26/2009 4:05:53 PM

mbam-log-2009-03-26 (16-05-53).txt

Scan type: Quick Scan

Objects scanned: 92287

Time elapsed: 4 minute(s), 7 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

pinky_fatty_fat · March 26, 2009

when i did the Rootrepeal i came up with this (i have no idea why so many mp3's are locked)

ROOTREPEAL © AD, 2007-2008

==================================================

Scan Time: 2009/03/26 16:37

Program Version: Version 1.2.3.0

Windows Version: Windows XP SP3

==================================================

Hidden/Locked Files

-------------------

Path: C:\Documents and Settings\Gary.TAFT-D93B5620A7\Local Settings\Temp\mnxfhean.dat