Jump to content

Backdoor.Messa.Gen Found, but can't remove


Recommended Posts

It is the free version. I do plan to intall the pro version though as I use the tool a lot. No other scanner (and I've ran many ) finds those problems. I did run ESET's online scanner and it found some things (including Yontoo which you suggested I remove). None of it looks like the same problem to me though. See below:

C:\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined

C:\Documents and Settings\All Users\Application Data\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application cleaned by deleting - quarantined

C:\Documents and Settings\All Users\Start Menu\Programs\eBay.url Win32/Adware.ADON application cleaned by deleting - quarantined

C:\Documents and Settings\eharris.SIXSIGMA\My Documents\Downloads\cnet2_SiteMapGenerator_exe (1).exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined

C:\Documents and Settings\eharris.SIXSIGMA\My Documents\Downloads\cnet2_SiteMapGenerator_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined

Link to post
Share on other sites

I have a feeling it's a problem with MB itself.

Lets uninstall and then reinstall it and see what happens:

Go to your control panels add/remove programs and uninstall MalwareBytes Anti-Malware > reboot

Download and run this cleaner:

mbam-clean.exe

Reboot <---very important

Now download and see if you can install the latest version of MB from here: (disable any malware/anti-virus programs running first)

http://www.malwareby...am-download.php

Let me know, MrC

Link to post
Share on other sites

Nope. Detected again after restart.

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Database version: v2012.08.02.08

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

EHarris :: D620-EHARRIS [administrator]

8/2/2012 2:40:08 PM

mbam-log-2012-08-02 (14-40-08).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 359021

Time elapsed: 8 minute(s), 49 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 14

c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> Delete on reboot.

(end)

Link to post
Share on other sites

I rebooted and ran systemlook twice and it didn't find anything either time. I ran MBAM immediately after the second run, and it again flagged the files just like before. I then ran systemlook again and it saw nothing.

No other scanner sees these files but MBAM and I've ran a bunch of them. Very strange. I'd like to just write it off as a false positive, but these backdoor trojans are scary.

Link to post
Share on other sites

Done. Systemlook does not see any file called limewire.exe. I checked 4-5 of them manually and could not find the file (and I am showing hidden files, OS files, etc). Files found are consistent with past observations. Are you thinking this is a MBAM bug?

Files Detected: 14

c:\documents and settings\administrator.d620-eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\administrator\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\all users\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\atlanticitadmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\default user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\eharris.sixsigma.old\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\eharris.sixsigma\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\eharris\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\endeavoradmin\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\localservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\networkservice\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\temp\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\documents and settings\user\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

c:\windows\system32\config\systemprofile\application data\limewire.exe (Backdoor.Messa.Gen) -> No action taken.

Link to post
Share on other sites

Great :) A big thanks to tetonbob for that!

---------------------------------------

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

cf2.jpg

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

Link to post
Share on other sites

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.