Jump to content

Backdoor.Bot is driving me CRAZY !

GringoCA
 Share

Recommended Posts

GringoCA

GringoCA

Posted
Posted

I ran IObit Security 360 today and it came up with "Backdoor.Bot". I removed it and scanned again. Still there.

I always check for updates immediately before running any programs. I then downloaded the free version of Malwarebytes and updated it. I then rebooted into Safe Mode and ran the program. It found two malwares during the final stage (heuristics ?) and removed them. I rebooted and came back into Safe Mode and reran Malware bytes. Again, the same "Backdoor.Bot" was there.

I ran the following programs and here are the results:

-SuperAntiSpyware - said "no problems"

-SpyHunter3 - "no problems"

-ZoneAlarm scan - "no problems" and no alerts

-SpyBot Search and Destroy" - no problems

-AdAware - no problems

This trojan only shows up on Malwarebytes and IOBit Security 360, but neither removes the problem. I went to regedit to check for this file and nothing shows up there.

The message I receive from IOBit 360 reads:

Backdoor.Bot - Removed, Registry Value, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows NT\CurrentVersion\Winlogon Value=Taskman, 4-27415

I am using Windows XP. I am no programmer, but understand computers. Is my only option to partition the drive and reload everything, or can I somehow fix this?

Thank you for any lessons you can give to me.

Link to post
Share on other sites
mountaintree16

mountaintree16

Posted
Posted

hello and welcome to the forums GringoCA!

I think you should try posting that here (just copy and paste everything you just wrote into the new post):

http://www.malwarebytes.org/forums/index.p...w_post&f=30

This looks like a similar problem that many others have been having since the pathfile looks very similar.

Also, just as a side note, when replying to a post in the forum please either hit "add reply" at the bottom of the page, or erase what the person you are replying to you said, as this makes the forum easier to read.

Link to post
Share on other sites
Anguskirk

Anguskirk

Posted
Posted

Thanks, srtools. Here's the full scan.

I was wrong when I said Quick Scan found 100 instances of Backdoor.Bot -

it was reportedly in 5 registry keys, 1016 folders and 6446 files!

-------------------------------------------

Malwarebytes' Anti-Malware 1.41

Database version: 2895

Windows 5.1.2600 Service Pack 3

03/10/2009 00:36:50

mbam-log-2009-10-03 (00-36-50).txt

Scan type: Full Scan (C:\|F:\|)

Objects scanned: 397710

Time elapsed: 5 hour(s), 32 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 2

Files Infected: 16

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Program Files\WINDOWS (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32 (Backdoor.Bot) -> Quarantined and deleted successfully.

Files Infected:

C:\Program Files\WINDOWS\system32\MFCANS32.DLL (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\mfcuia32.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\mschrt20.ocx (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\msls2.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\msmask32.ocx (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\msstkprp.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\ncpa.cpl.manifest (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\nwc.cpl.manifest (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\ochlp30e.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\PCDLIB32.DLL (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\perfmon.msc (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\Pubole32.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\sapi.cpl.manifest (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\Westlake.dll (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\WindowsLogon.manifest (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Program Files\WINDOWS\system32\wuaucpl.cpl.manifest (Backdoor.Bot) -> Quarantined and deleted successfully.

Link to post
Share on other sites
prairie dog

prairie dog

Posted
Posted
In Anguskirk's case It (backdoor.bot) may not be FP.

If it is not a false positive, then it is still in the wrong forum. Malware removal is only worked on in the HJT log forum. The user needs to first post in the false positive section since he or she believes they may be false positives. IF they are not false positives and he or she needs assistance removing them, then the HJT log forum is the appropriate forum. Either way, this is the wrong forum

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Scan and post logs - read note at bottom in green

If you're having Malware related issues with your computer that you're unable to resolve.

  1. Please read and follow the instructions provided here: I'm infected - What do I do now?
  2. If needed please post your logs in a NEW topic here: Malware Removal - HijackThis Logs
  3. When posting logs please do not use any Quote, Code, or other tags. Please copy/paste directly into your post and do not attach files unless requested.

  • Please do not post any logs in the General forum. We do not work on any logs posted in the General forum.
  • Please do not install any software or use any removal/scanning tool except for those you're requested to run by the Helper that will assist you.
  • Using these other tools often makes the cleanup task more difficult and time consuming.
  • If you have already submitted for assistance at one of the other support sites on the Internet then you should not post a new log here, you should stay working with the Helper from that site until the issue is resolved.
  • Do not assume you're clean because you don't see something in the logs. Please wait until the person assisting you provides feedback.
  • There are often many others that require asistance as well, so please be patient. If no one has responded within 48 hours then please go ahead and post a request for review

  • NOTE: If for some reason you're unable to run some or any of the tools in the first link, then skip that step and move on to the next one. If you can't even run HijackThis, then just proceed and post a NEW topic as shown in the second link describing your issues and someone will assist you as soon as they can.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.