Backdoor.Bifrose and HKEY_CURRENT_USER\SOFTWARE\System32

[htpc]

Hello,

I've got the backdoor.bifrose showing up just as the user here describes in this closed thread:

http://forums.malwarebytes.org/index.php?showtopic=28395

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4134

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

5/24/2010 10:57:47 AM

mbam-log-2010-05-24 (10-57-47).txt

Scan type: Full scan (C:\|)

Objects scanned: 177324

Time elapsed: 10 minute(s), 44 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\System32 (Backdoor.Bifrose) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

-------------------------

I've quarantined and deleted it, and it appeared to have gone away. However, it re-appeared later, so now I'm concerned that Malware didn't completely remove it from my system.

I've also dun a DDS scan and here is the output:

-------------------------

DDS (Ver_10-03-17.01) - NTFSX64

Run by admin at 10:48:38.32 on Mon 05/24/2010

Internet Explorer: 8.0.7600.16385

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.4061.2542 [GMT -4:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

C:\Program Files (x86)\LogMeIn\x64\LMIGuardian.exe

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe

C:\Program Files (x86)\LogMeIn\x64\LMIGuardian.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\wuauclt.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe

C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\regedit.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Users\admin\Documents\Downloads\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

mLocal Page = c:\windows\syswow64\blank.htm

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IFEO: ehshell.exe - "c:\program files (x86)\logmein\x64\LogMeInSystray.exe" -MceShellRedirect

mRun-x64: [LogMeIn GUI] "c:\program files (x86)\logmein\x64\LogMeInSystray.exe"

IFEO-X64: ehshell.exe - "c:\program files (x86)\logmein\x64\LogMeInSystray.exe" -MceShellRedirect

============= SERVICES / DRIVERS ===============

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files (x86)\logmein\x64\rainfo.sys [2008-8-11 15928]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-5-23 72216]

R3 e1yexpress;Intel® Gigabit Network Connections Driver;c:\windows\system32\drivers\e1y60x64.sys [2009-6-10 281088]

=============== Created Last 30 ================

2010-05-24 01:01:19 0 d-----w- c:\windows\Panther

2010-05-24 01:01:07 8192 --sha-r- C:\BOOTSECT.BAK

2010-05-24 01:01:06 383562 --sha-r- C:\bootmgr

2010-05-24 01:01:06 0 d-sh--w- C:\Boot

2010-05-24 00:02:56 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_09_00.Wdf

2010-05-23 22:16:29 0 d-----w- c:\users\admin\appdata\roaming\Malwarebytes

2010-05-23 21:58:51 0 d-----w- c:\program files\MPC HomeCinema (x64)

2010-05-23 21:46:12 0 d-----w- c:\users\admin\appdata\roaming\Mirillis

2010-05-23 21:46:12 0 d-----w- c:\programdata\Mirillis

2010-05-23 21:42:10 0 d-----w- c:\windows\syswow64\Macromed

2010-05-23 21:37:38 0 d-----w- c:\programdata\LogMeIn

2010-05-23 21:37:37 29496 ----a-w- c:\windows\system32\LMIport.dll

2010-05-23 21:37:36 87384 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2010-05-23 21:37:36 72216 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys

2010-05-23 21:37:34 80696 ----a-w- c:\windows\system32\LMIinit.dll

2010-05-23 21:37:33 1024 ----a-w- C:\.rnd

2010-05-23 21:37:30 0 d-----w- c:\program files (x86)\LogMeIn

2010-05-23 21:35:48 24664 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-05-23 21:35:48 0 d-----w- c:\programdata\Malwarebytes

2010-05-23 21:35:48 0 d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware

2010-05-23 21:34:43 0 d-----w- c:\users\admin\appdata\roaming\IrfanView

2010-05-23 21:34:43 0 d-----w- c:\program files (x86)\IrfanView

2010-05-23 21:32:20 0 d-----w- c:\program files (x86)\Mirillis

2010-05-23 21:31:29 0 d-sh--w- c:\windows\Installer

2010-05-23 21:30:38 270208 ------w- c:\windows\system32\MpSigStub.exe

2010-05-23 21:11:15 171136 --sha-r- C:\w7ldr

2010-05-23 21:10:19 0 d-sh--w- C:\Recovery

==================== Find3M ====================

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat

2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat

2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat

2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini

2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat

2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat

2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat

2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat

2009-07-14 05:12:52 245760 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\ietldcache\index.dat

2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\index.dat

2009-07-14 04:55:03 32768 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat

2009-07-14 04:55:03 16384 --sha-w- c:\windows\syswow64\config\systemprofile\appdata\roaming\microsoft\windows\cookies\index.dat

2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe

2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 10:48:48.04 ===============

Any help would be greatly appreciated.

Thanks,

HTPC

[Firefox]

Hello htpc,

As everyones computer is different, you will have to post your own logs, and post them in the right section.

Please read the following so that you can begin the cleaning process:

We don't work on Malware removal in the general forums.

Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

Please note that it may take 48 hours or more for you to receive a response in the malware removal forum, as it is often busy at times. Please do not reply to your own post asking for help unless its been more than 48 hours since you originally posted, as this can make it appear as though you are being helped and take longer for you to get help.

If you are unable to do all or any of the steps in the link to the directions above, just post your problem into the forum I gave you a link to anyway and someone will be able to assist you.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

If you are a corporate customer please send an email to corporate-support@malwarebytes.org. (NOTE: An order number is required for corporate support.)

Also, when replying, please use the "ADD REPLY" button or erase what the person you are replying to said, as this makes the forum easier to read.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post.

Thank you

[htpc]

Thanks- I'll do more legwork to get the data as per the instructions and post in the proper forum.

I did notice that Win7 was creating system restore points. I'm disabling that to see if the issue returns again.

[Firefox]

Great, thanks for the info, I usually delete restore points after an infection is found and cleaned. I then will create a new restore point once I know the computer is clean.

[adi_bun]

I had this problem too .

It`s a registry key created by Mirillis Splash Lite player after every startup of the program , so it`s a false positive . They should solve it .

[adi_bun]

Next day after my last post it was fixed , but now reapeared this problem .

You have the developer log attached to my post .

Please fix this false positive again .

mbam_log_2010_06_23__10_37_07_.txt

[nosirrah]

This will be pulled in the next update.