Trojan Help

Flazz · September 13, 2010

Hello!

Found my way here through a series of searches, looking for help removing some stubborn files I've found. I started doing a series of scans and checks when my computer started having issues, frequent explorer crashes etc, and found some threads on these forums that loooked helpful, but most of the details seemed very specific to each individual computer, so thught it best to make a new thread.

Of course, these files may be completly unrelated to the issues, but its a good place to start!

Running Vista 64bit, as of a few hours ago I'm all upto date on updates as far as I know.

NOD32 is picking up some threats during a scan, but is saying its unable to delete/clean/fix them.

Running MBAM on my system does NOT pick up anything suspcious, which I thought was strange.

If I have NOD running in the background with its "real-time file system protection" enabled while MBAM does its scan, NOD pops up a warning saying MBAM tried to access those files. If I turn off the real-time protection, Malware still doesn't find them. I don't have Spybot SnD TeaTimer enabled at the moment, if it makes a difference.

Not sure what other information I should post at this point, or what log/summaries I need. Any guidance would be greatly appreciated!

Cheers.

Flazz · September 13, 2010

Here is the extra information I should have included in the original post. I think I followed all the instructions correctly.

When running the GMER, some of the options to the right were shaded out, so I couldn't check/uncheck them, but the ones that the guide said that needed to be unchecked looked like they were anyway, so I just went ahead.

DDS (Ver_10-03-17.01) - NTFSX64

Run by user at 1:59:40.72 on Tue 14/09/2010

Internet Explorer: 8.0.6001.18943 BrowserJavaVersion: 1.6.0_20

Microsoft

Attach.zip

screen317 · September 15, 2010

Hi and welcome to Malwarebytes.

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
wininit.exe
explorer.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Flazz · September 15, 2010

Thanks for taking the time to post!

Output is below.

SystemLook 27.08.10 by jpshortstuff

Log created at 16:37 on 15/09/2010 by user

Administrator - Elevation successful

========== filefind ==========

Searching for "wininit.exe"

C:\Windows\System32\wininit.exe --a---- 123904 bytes [05:14 01/06/2008] [08:00 19/01/2008] 117EA87DF785CA1B9D821F6F213DCE07

C:\Windows\SysWOW64\wininit.exe --a---- 96768 bytes [05:15 01/06/2008] [07:33 19/01/2008] (Unable to calculate MD5)

C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_8ada9256bfc30704\wininit.exe --a---- 122368 bytes [09:27 02/11/2006] [11:16 02/11/2006] 6F92CE5B50283B0C0A7A539ED552039A

C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_8d115452bcae17d8\wininit.exe --a---- 123904 bytes [05:14 01/06/2008] [08:00 19/01/2008] 117EA87DF785CA1B9D821F6F213DCE07

C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe --a---- 95744 bytes [12:24 02/11/2006] [09:45 02/11/2006] D4385B03E8CCCEE6F0EE249F827C1F3E

C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe --a---- 96768 bytes [05:15 01/06/2008] [07:33 19/01/2008] 101BA3EA053480BB5D957EF37C06B5ED

Searching for "explorer.exe"

C:\Windows\explorer.exe --a---- 3079168 bytes [05:14 17/06/2009] [07:10 11/04/2009] 6F89C6E6303F8701A3DD7E931C59EE19

C:\Windows\SysWOW64\explorer.exe --a---- 2926592 bytes [05:14 17/06/2009] [06:27 11/04/2009] D07D4C3038F3578FFCE1C0237F2A1253

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_ab9c809a352ecf21\explorer.exe --a---- 3086848 bytes [09:31 02/11/2006] [11:15 02/11/2006] 5D768BEB711FF67ADC8FAD4E2F6ABB02

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_abcac4f4350ba5b0\explorer.exe --a---- 3087360 bytes [01:14 23/01/2008] [01:14 23/01/2008] FCBF8AC1855EF986CDEC2387760F71C6

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe --a---- 3087360 bytes [22:32 09/12/2008] [06:15 29/10/2008] 50514057C28A74BAC2BD04B7B990D615

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_ac3dc19d4e3a6405\explorer.exe --a---- 3086848 bytes [01:14 23/01/2008] [01:14 23/01/2008] 819D88EC82C2C44B556DC32ED22044DE

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe --a---- 3086848 bytes [22:32 09/12/2008] [02:30 28/10/2008] 72B9990E45C25AA3C75C4FB50A9D6CE0

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe --a---- 3080704 bytes [05:12 01/06/2008] [08:00 19/01/2008] F6D765FB6B457542D954682F50C26E4F

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe --a---- 3080704 bytes [22:32 09/12/2008] [06:49 29/10/2008] BBD8E74F23D7605CB0CDB57A1B25D826

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe --a---- 3081216 bytes [22:32 09/12/2008] [05:30 30/10/2008] E404A65EF890140410E9F3D405841C95

C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe --a---- 3079168 bytes [05:14 17/06/2009] [07:10 11/04/2009] 6B08E54A451B3F95E4109DBA7E594270

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_b5f12aec698f911c\explorer.exe --a---- 2923520 bytes [12:12 02/11/2006] [09:45 02/11/2006] FD8C53FB002217F6F888BCF6F5D7084D

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_b61f6f46696c67ab\explorer.exe --a---- 2923520 bytes [01:14 23/01/2008] [01:14 23/01/2008] 6D06CD98D954FE87FB2DB8108793B399

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe --a---- 2923520 bytes [22:32 09/12/2008] [06:20 29/10/2008] 37440D09DEAE0B672A04DCCF7ABF06BE

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_b6926bef829b2600\explorer.exe --a---- 2923520 bytes [01:14 23/01/2008] [01:14 23/01/2008] BD06F0BF753BC704B653C3A50F89D362

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe --a---- 2923520 bytes [22:32 09/12/2008] [02:15 28/10/2008] E7156B0B74762D9DE0E66BDCDE06E5FB

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe --a---- 2927104 bytes [05:14 01/06/2008] [07:33 19/01/2008] FFA764631CB70A30065C12EF8E174F9F

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe --a---- 2927104 bytes [22:32 09/12/2008] [06:29 29/10/2008] 4F554999D7D5F05DAAEBBA7B5BA1089D

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe --a---- 2927616 bytes [22:32 09/12/2008] [03:59 30/10/2008] 50BA5850147410CDE89C523AD3BC606E

C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe --a---- 2926592 bytes [05:14 17/06/2009] [06:27 11/04/2009] D07D4C3038F3578FFCE1C0237F2A1253

-= EOF =-

Flazz · September 17, 2010

It appears I've manged to fix my problem. Explorer is no longer crashing and all scans I run are coming up clean.

When I was searching around for win32/bamital.dx and how to remove it on a 64 system, a few things just seemed to say the wininit.exe files (specifically the one located at C:\Windows\SysWOW64\wininit.exe) needed to be replaced with uncorrupted versions. I ran SFC /SCANNOW in command, and a quick check of the output that produced showed that it detected anomalies and would attempt to fix them. After a reboot when prompted, everything seemed to be back to normal!

If an expert wants to see any scan logs or such to double check I can post them, but otherwise I think everything is working as it should again!

screen317 · September 18, 2010

Hi,

My apologies for the delay.

That's good to hear.

We can confirm if it's gone; run SystemLook again as outlined above and we'll see if there are still any discrepancies.

Flazz · September 18, 2010

No worries!

Heres the output: