Fake User Account Control popup

[DaileyComputer]

Hi there.

This computer was infected with XP Smart Security yesterday. I have some experience with removing these infections. After deleting some files in Safe Mode, I was able to install Malwarebytes which I used to scan the machine and remove some infections. At that point, executable files were not working properly so I ran exefix.reg. Another full Malwarebytes scan found nothing.

Today, however, I'm getting a fake UAC popup. It comes up when Windows starts, and especially when I try to access the Internet via IE or Firefox. I ran Malwarebytes again, and it still finds nothing.

This is an XP Pro machine. Here's the text of the popup:

User Account Control

An unidentified program wants to access your computer

Windows Security Center block active process: csrcs.exe

Process try direct access to memory process msmsgs.exe

Then there are two buttons: Allow and System Scan. Allow closes the popup. I don't want to hit System Scan.

I can launch Malwarebytes, but it finds nothing. When I try to open the log to post it, the UAC popup comes up and closes the log. I'm in the process of trying to get the MBAM and GMER Rootkit Scanner logs to post.

Please help!

Thank you.

[DaileyComputer]

Here is the latest Malwarebytes log. I also included the first log from yesterday, which shows you the registry keys that were infected when I first ran the program.

mbam_log_2010_04_09__11_30_25_.txt

mbam_log_2010_04_06__19_21_44_.txt

[DaileyComputer]

I'm sorry - I guess it was Tuesday that I first looked at this machine, if it makes any difference. Not yesterday.

[Maniac]

Hello DaileyComputer! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

• The process of cleaning your system may take some time, so please be patient.
  
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  
• Instructions that I give are for your system only!
  
• If you don't know or can't understand something please ask.
  
• Do not install any software or hardware, while work on.
  

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

1. If you are using Firefox, make sure that your download settings are as follows:
   
   • Open Tools -> Options -> Main tab
     
   • Set to Always ask me where to Save the files.
     

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  

  -----------------------------------------------------------

  
  

• Close any open browsers.
  
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[DaileyComputer]

ComboFix is asking to install the Microsoft Windows Recovery Console. Shall I say Yes or No?

Thank you.

[Maniac]

Absolutely Yes.

P.S.: Here is 01:29 AM, so I'm going to sleep. Tomorrow (today....) I'll check your log.

[DaileyComputer]

I appreciate the help. Have a good night's rest. It's 3:30PM here, so I'll probably be asleep when you reply.

[Maniac]

Thank you very much!

For you... successful day!

[DaileyComputer]

Here's the Combofix log. I've shut down the PC until I hear back from you.

ComboFix.txt

[Maniac]

Step 1:

• Launch Malwarebytes' Anti-Malware
  
• Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  
• Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Step 2:

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
     
  2. Attach.txt
     

  [*]Save both reports to your desktop. Post them back to your topic.

Let me know how are things now.

In your next reply, please include these log(s):

* MalwareBytes' Anti-Malware log

* DDS log with Attach.txt

[DaileyComputer]

Malwarebytes didn't find anything. Here's the log, anyway.

I can't run dds.scr. As soon as I launch it, the User Account Control screen pops up and freezes everything. If I hit Allow, which is the only way to get the popup to go away, it closes the ddr screen.

Stupid malware.

mbam_log_2010_04_10__09_07_26_.txt

[DaileyComputer]

Are we reaching the "wipe and reinstall" Windows point yet?

[Maniac]

I hope not.

Step 1:

ESET Online Scanner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however may need to disable your current installed Anti-Virus, how to do so can be read here.

• Please go here then click on:
  
• Select the option YES, I accept the Terms of Use then click on:
  
• When prompted allow the Add-On/Active X to install.
  
• Now click on Advanced Settings and select the following:
  

• • Remove found threats
    
  • Scan archives
    
  • Scan for potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth Technology
    

[*]Now click on:

[*]The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.

[*]When completed the Online Scan will begin automatically.

[*]Do not touch either the Mouse or keyboard during the scan otherwise it may stall.

[*]When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!

[*]Now click on:

[*]Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.

[*]Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Step 2:

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

[DaileyComputer]

I can't run any browsers. As soon as they come up, the popup appears and closes the browser. I've been downloading the files from another machine then copying them to the infected machine via a network share. Sorry I didn't mention this before.

I'll try GMER.

[DaileyComputer]

Whoops. Thought I posted this some time ago. Must have messed it up somehow.

Here's the GMER log.

[Maniac]

I can't see GMER log. Please post it in your next reply here.

[DaileyComputer]

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-04-10 13:54:08

Windows 5.1.2600 Service Pack 2

Running: kriu3d0p.exe; Driver: C:\DOCUME~1\RANDYC~1.000\LOCALS~1\Temp\kwldapob.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs TmPreFlt.sys (Pre-Filter For XP/Trend Micro Inc.)

---- EOF - GMER 1.0.15 ----

[Maniac]

Please download GooredFix (by jpshortstuff) from one of the locations below and save it to your Desktop

Download Mirror #1

Download Mirror #2

• Ensure all Firefox windows are closed.
  
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista or 7).
  
• When prompted to run the scan, click Yes.
  
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
  

[DaileyComputer]

That was very fast. As soon as the log came up, the evil popup appeared.

GooredFix by jpshortstuff (08.01.10.1)

Log created at 14:40 on 10/04/2010 (Randy)

Firefox version 3.5.9 (en-US)

========== GooredScan ==========

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\

{972ce4c6-7e08-4474-a285-3208198ce6fd} [18:07 25/10/2007]

C:\Documents and Settings\randy.CCP.000\Application Data\Mozilla\Firefox\Profiles\97foc1ts.default\extensions\

en-US@dictionaries.addons.mozilla.org [01:26 07/04/2010]

{20a82645-c095-46ed-80e3-08825760534b} [17:25 15/10/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]

"{20a82645-c095-46ed-80e3-08825760534b}"="c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [01:03 11/08/2009]

"smartwebprinting@hp.com"="C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2" [19:15 30/11/2009]

-=E.O.F=-

[Maniac]

Please, download OTL (by OldTimer) and save it on your Desktop.

Double-click on OTL.exe, to run the program.

Check in:

• 
  
• Scan all users
  
• Lop check
  
• Purity check
  

Under section Extra Registry, select Use SafeList

Click on Run Scan and let it finish scanning. (it may take 10-15 minutes)

When finished, post the following two log files:

• OTL.txt (located on your desktop)
  
• Extras.txt (will open automatically)
  

[DaileyComputer]

The scan ran for about a minute, a text file appeared on the screen, the bad popup came up, I hit Allow as the only way to get rid of the popup (the other choice is scan), it closed the log file, and I can find neither one of the text files you mentioned on the desktop.

[Maniac]

Please carefully repeat the procedure.

[DaileyComputer]

I did with the same results. Would it help to try in Safe Mode?

[Maniac]

Let's try and see.

[DaileyComputer]

Same thing happens in Safe Mode.

Is it frustrating to try to help people via messageboard like this? It's tough enough troubleshooting over the phone.