Trojan.agent taskman persistence

[juliano99]

Hi, hope you can help. I've read the other similar posts, but they all seem to have been a while ago.

For some reason, my laptop has suddenly picked up a host of infections - maybe to do with connecting up to a hotel LAN whilst on business, I'm not sure.

Anyway, a combination of Anti-Malware, spybot search and destroy and mcafee has got rid of most of the items.

however, there remains a trojan.agent on the system. No matter how many times I re-run my scans, it always comes back. even if I run in Safe mode.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Trojan.Agent) -> Quarantined and deleted successfully.

I've just downloaded the latest updates and run those, to no avail.

I've also followed the instructions on http://forums.malwarebytes.org/index.php?showtopic=9573

so I've uploaded the necessary files

many thanks in advance.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Julian xxxx at 20:46:27.64 on 25/08/2010

Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_21

Microsoft

Attach.zip

[RPMcMurphy]

juliano:

Hello and welcome. Please follow these guidelines while we work on your PC:

[*]Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I

[juliano99]

Thanks for assisting RPMMcMurphy.

attached is the combo log as requested.

Juliano

combofix.txt

[RPMcMurphy]

juliano:

How is your computer running now? Please run these for me next:

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
  
• Click Check for Updates
  
• If an update is found, it will download and install the latest version.
  
• The program will close to update and reopen.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
  
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
  

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
  
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • 
    
  • Spyware, adware, dialers, and other riskware
    
  • Archives
    
  • E-mail databases
    

  [*]Click on My Computer under the green Scan bar to the left to start the scan.

  [*]Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

  [*]Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

  [*]Click View report... at the bottom.

  [*] Click the Save report... button.

  [*] Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

• MBAM log
  
• Kaspersky log
  
• How is your computer running now?
  

[juliano99]

Hi RPMcMurphy,

followed all the instructions, laptop running pretty good.

MBAM text below and Kaspersky report attached

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4493

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18943

28/08/2010 13:12:46

mbam-log-2010-08-28 (13-12-46).txt

Scan type: Quick scan

Objects scanned: 144611

Time elapsed: 12 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Julian Sham\downloads\Defogger.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

many thanks

J

KasReport.txt

[RPMcMurphy]

juliano:

Your logs look good. I'm not sure why MBAM targeted Defogger. If you used it and need to re-enable your CD emulation drivers you will have to download it again HERE. Skip this step if you didn't run it, or don't use CD emulation software.

To re-enable your Emulation drivers, double click DeFogger to run the tool.

• The application window will appear
  
• Click the Re-enable button to re-enable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger will now ask to reboot the machine - click OK
  

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.

Your Emulation drivers are now re-enabled.

Now I have another update and some very important cleanup for you to take care of:

Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Uninstall ComboFix

• Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
  Combofix /Uninstall
  

Delete the following tools along with any other logs you saved from our work:

• DDS
  
• GMER
  

Download TFC to your desktop

• Close any open windows.
  
• Double click the TFC icon to run the program
  
• TFC will close all open programs itself in order to run,
  
• Click the Start button to begin the process.
  
• Allow TFC to run uninterrupted.
  
• The program should not take long to finish it's job
  
• Once its finished it should automatically reboot your machine,
  
• if it doesn't, manually reboot to ensure a complete clean
  

Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

• Restart any anti-malware programs that we disabled while we were cleaning your machine.
  
• Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  
• Please visit our General Computer Security Forum and review this post for some helpful information.
  

Please post once more so I know you are all set and I can mark this thread resolved. Good luck and stay safe!

[juliano99]

RPMcMurphy,

you're a star!

Thank you very much for your guidance.

I've followed all the remaining instructions and the computer seems to be running just great.

many thanks again.

J

[RPMcMurphy]

You're welcome, juliano99. Take care.