Win32.AutoRun.tmp & Spyware.OnlineGames, Two problems now

Kay · December 21, 2010

Hi Chris,

There is only one account on the computer so I assume I am the administrator.

This all happens at startup: (From my message #17:) "A balloon comes up from the tray: Windows has blocked some startup programs. Windows blocks programs that require permission to run when windows starts. Click to view blocked programs. Choices are:

Show or remove blocked startup program

Run blocked program

View Help

Exit

When I click on Show or remove blocked startup programs, I get the System configuration window with 5 tabs: General, Boot, Services, Startup and Tools.

Looking at the Startup and Services tabs, MBAM is shown as enabled and running -- which it is not because I have not yet selected Run blocked program. Then I have to give permission for MBAM to run."

I assume MBAM is not running since I have to give permission via tab shown in the 2nd picture.

While I was typing this, MBAM ran a flash scan and *Spyware.OnlineGames* is back. That is what caused me to start this thread and *Win32.AutoRun.tmp* was the second reason.

So actually there are three things going on: Spyware.OnlineGames (detected by MBAM), Win32.AutoRun.tmp (detected by Spybot S & D), and MBAM blocked at startup.

_________________________________

Malwarebytes' Anti-Malware 1.50

www.malwarebytes.org

Database version: 5364

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18999

12/20/2010 6:10:36 PM

mbam-log-2010-12-20 (18-10-36).txt

Scan type: Flash scan

Objects scanned: 96550

Time elapsed: 1 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Windows\temp\NOD1.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.

________________________________________

Eveyday when I start up the computer, I run Spybot to *fix* Win32.AutoRun.tmp. Obviously it is not fixed since it reappears each time the computer is started.

Thanks, Kay

screen317 · December 21, 2010

Hi Kay,

All right-- let's tackle things one at a time.

A few things I'd like to mention before we continue:

First, Spybot's "detection." Spybot keeps saying one Registry key is remaining and that it is infected. Even if it were a real detection, it wouldn't mean anything because there is no file associated with it; meaning, it's not an active infection. We used ComboFix to remove the entry if it existed, but the detection persisted. Seems it's either a bug with Spybot, or more likely, TeaTimer is restoring that Registry key, because that's what it does: restore Registry keys and block Registry changes (like it's doing).

Did you end up running the ResetTeaTimer.exe?

Kay · December 21, 2010

Hi Chris,

No, I did not run ResetTeaTimer.exe because the link you gave me was not working. I did find a link in a thread that Maniac was working on, but was waiting to see what you had to say about it since it is in a foreign language and I have forgotten which one. (http://forums.malwarebytes.org/index.php?showtopic=70419, msg #19) Shall I go ahead a use it?

I am not at my computer and have to leave for a couple of hours. So it will be later this afternoon before I can get to this.

Thanks, Kay

Kay · December 21, 2010

Hi Chris,

OK. So I ran ResetTeaTimer.exe:

1. I booted up my computer, ignored blocked startup msg; ran Spybot as administrator and disabled SDHelper and Teatimer.

2. I rebooted the computer, downloaded ResetTeaTimer.exe from one of Maniac's msg threads that I mentioned before. Clicked twice on the ResetTeaTimer.exe and a small window opened that said that SDHelper and Teatimer couldn't be located, press any key and the .exe ran.

3. I ran Spybot scan and it detected Win32.AutoRun.tmp and I *fixed* it again.

4. I rebooted the computer twice and enabled Teatimer and SDHelper, ran a scan and Win32.AutoRun.tmp was detected again and fixed again.

While I was running the Spybot scan, MBAM ran a flash scan and nothing was detected. The blocked startup balloon came up twice and I ignored it. So I guess this means that MBAM does run just not at startup.

Kay

screen317 · December 22, 2010

Hi Kay,

1. Uninstall Malwarebytes' Anti-Malware using Add or Remove programs in the Control Panel.

2. Restart your computer (very important).

3. Download and run this utility.

4. It will ask to restart your computer (please allow it to).

5. After the computer restarts, install the latest version from here.

Note: You will need to reactivate the program using the license you were sent via e-mail if you purchased it.

See if it is still blocked at startup.

Kay · December 23, 2010

Hi Chris,

I followed your instructions and removed, rebooted, and reinstalled MBAM and reactivated the program with my ID and registration.

I then had to do a repair on ESET because I was getting a warning from Windows Security that it is was not activated. The repair took care of that problem.

MBAM is still blocked at startup, Spyware.Online Games.tmp was detected.

______________________

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5385

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18999

12/23/2010 1:29:03 PM

mbam-log-2010-12-23 (13-29-03).txt

Scan type: Flash scan

Objects scanned: 96516

Time elapsed: 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Windows\temp\NOD1.tmp (Spyware.OnlineGames) -> Quarantined and deleted successfully.

___________________________

Spybot is still detecting Win32.AutoStart.tmp after startup.

Kay

screen317 · December 24, 2010

Hi,

Hmm. Maybe the infection is still hiding after all.

Please run a GMER Rootkit scan:

Download GMER's application from here:

http://www.gmer.net/gmer.zip

Unzip it and start the GMER.exe

Click the Rootkit tab and click the Scan button.

Once done, click the Copy button.

This will copy the results to your clipboard.

Paste the results in your next reply.

Warning ! Please, do not select the "Show all" checkbox during the scan.

Please delete your copy of ComboFix, download the latest version from here, and save it to your Desktop. Run it and post its log.

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

Click Start Scanning.
You should get a notification bar (on top) to install the ActiveX control.
Click on it and select to install the ActiveX.
Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
In case you are having problems with installing the ActiveX/starting the scan, please read here.
Click the Full System Scan button.
It will start to download scanner components and databases. This can take a while.
The main scan will start.
Once the scan has finished scanning, click the Automatic cleaning (recommended) button
It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
The cleaning can take a while, so please be patient.
Then click the Show report button and Copy/Paste what is present under results in your next reply.

Kay · December 24, 2010

Hi Chris,

Here are the 3 logs you requested:

GMER 1.0.15.15530 - http://www.gmer.net

Rootkit scan 2010-12-23 20:53:34

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD501LJ rev.CR100-13

Running: gmer.exe; Driver: C:\Users\JANEDO~1\AppData\Local\Temp\axrdrfow.sys

---- System - GMER 1.0.15 ----

SSDT 84D3BB70 ZwAllocateVirtualMemory

SSDT 8576B3C8 ZwCreateProcess

SSDT 8576B1C0 ZwCreateProcessEx

SSDT 84D3BE40 ZwCreateThread

SSDT 84D3BBE8 ZwQueueApcThread

SSDT 84D3BA80 ZwReadVirtualMemory

SSDT 84D3BCD8 ZwSetContextThread

SSDT 84D3BF30 ZwSetInformationProcess

SSDT 84D3BD50 ZwSetInformationThread

SSDT 84D3BEB8 ZwSuspendProcess

SSDT 84D3BC60 ZwSuspendThread

SSDT 84D3BFA8 ZwTerminateProcess

SSDT 84D3BDC8 ZwTerminateThread

SSDT 84D3BAF8 ZwWriteVirtualMemory

SSDT 84D3B990 ZwCreateThreadEx

SSDT 84D3BA08 ZwCreateUserProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 131 81EE8894 4 Bytes [70, BB, D3, 84]

.text ntkrnlpa.exe!KeSetEvent + 209 81EE896C 8 Bytes [C8, B3, 76, 85, C0, B1, 76, ...]

.text ntkrnlpa.exe!KeSetEvent + 221 81EE8984 4 Bytes [40, BE, D3, 84]

.text ntkrnlpa.exe!KeSetEvent + 4E5 81EE8C48 4 Bytes CALL 1A736008

.text ntkrnlpa.exe!KeSetEvent + 4FD 81EE8C60 4 Bytes [80, BA, D3, 84]

.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] ntdll.dll!KiUserExceptionDispatcher + A 77705DD2 5 Bytes JMP 00017DB0 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] kernel32.dll!VirtualProtect 76081DC3 5 Bytes JMP 000169B0 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] kernel32.dll!LoadLibraryExW 760A9109 5 Bytes JMP 00016000 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] kernel32.dll!VirtualFree 760C40AA 5 Bytes JMP 00016990 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] kernel32.dll!VirtualAlloc 760CAD55 5 Bytes JMP 00016960 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\Webroot\Spy Sweeper\SSU.EXE[2300] kernel32.dll!CreateFileA 760CCE5F 5 Bytes JMP 00016000 C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (Spy Sweeper SSU/Webroot Software, Inc. (www.webroot.com))

.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[2528] kernel32.dll!SetUnhandledExceptionFilter 760AA84F 4 Bytes [C2, 04, 00, 00]

.text C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe[2760] kernel32.dll!CreateThread + 1A 760CC928 4 Bytes CALL 00450771 C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Spy Sweeper Client Executable/Webroot Software, Inc.)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[500] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [742A7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396