Solved backdoor win32 cycbot.b

[Lorien]

It will now save to your default download save location. Just go there to get it and move it to the desktop (assuming the desktop isn't the default - I set my system up so the desktop is the default). If it's not on the desktop, it's probably in Downloads (but it could be anywhere - we may need to search for it - but we'll cross that bridge if we come to it). I keep forgetting I have IE9 beta and it works a little different than the others.

 

[FCUSA]

Thanks - I'll keep you posted.

 

[FCUSA]

I am trying to download in the affected user - and the bar comes up saying IE blocked the site from downloading and when I click OK to download, it keep cycling me back to the user agreement and the IE security blocked the site. Also, defender is popping with the alarm every few minutes on this user. I don't feel like I should be here.

 

[Lorien]

Go to Safe Mode with Networking and try to download from there. You're going to end up in Safe mode at some point anyway, so why not try the downloads from there. Then you aren't in that account. I suspect that the infection is blocking your ability to download anti-virus or anti-malware programs (which convinces me more than ever that you are infected with something - perhaps what you mentioned or maybe something else that came in with it). Does it ever give you an option to rename the program you're downloading to something else like lorien.exe or whatever? Sometimes the malware is programmed to block specific downloads and if you change the name it won't block it and will allow it (but from your earlier description, it doesn't seem like you have an opportunity to change the name). Let's hope Safe Mode with Networking does the trick. And while downloading (and ONLY while downloading this one time because of the problems), deactivate your security software and turn off your firewall. There's a tiny risk, but these are known sites so the chances of a problem are minimal (close out any other open windows you have though I suppose you could keep this one open too). As soon as the downloads are complete, re-activate the firewall and re-enable the security software.

I hope this helps.

Good luck!

 

[roy69]

I had this virus last week, it is a git to get rid of.

You need to ensure that the proxy server that the virus has set up has been changed back to normal.
To do this click on tools --> internet options --> connections --> lan settings;
Ensure that there is no tab on the proxy server and if there is click on advanced and clear all the fields then click on ok.

I managed to kill it using Microsoft security essentials. (full scan)

Also use spybot search and destroy or similar to kill the effected registry keys.

 

[FCUSA]

Hello Everyone!

What a day!

Roy - I wish I had seen your post before signing off to complete my 'tasks'. I was baffled why I couldn't get on the internet on the user that was infected and had to keep manually changing the proxy (using IE). Firefox had an error that the proxy had been changed (I haven't even tried to open that yet). I picked up on the difference while reviewing one of the other users settings.

I actually haven't figured out where the proxy settings are on Firefox - do you know?

So I have more to do on killing the Registry Keys?

I did have one item come up about the Registry (see below)



Lorien -

The scans all seemed to go well (although the instructions were clear, there were some functions not available to me). I really struggled ove it and decided possibly the program was upgraded. I will try to get those notes up tomorrow. I believe I have access to the logs in MBAM, however in Dr. Web Cureit there were never any options offered to where it would save, so I will go hunting.

Dr. Web showed 6 virus/infected files and then when I did MBAM, it only showed 5 - so hopefully the reports will shed light on that. All appeared to be isolated to the one user - I am happy about that. Computer booted fine - a little slow and with the following message:

'Could not load or run C:\users\FCUSA\AppData\Local\Temp.csrss.exe specified in the registr. Make sure file exits or remove the reference to it in the Registry'

Internet came up without issue and I double checked the proxy and the settings were where they should be.

Thank you all for your quick response and input.

'til tomorrow!

 

[FCUSA]

Roy69 -

This is the message I receive from Firefox -

The proxy server is refusing connections








Firefox is configured to use a proxy server that is refusing connections.

* Check the proxy settings to make sure that they are correct.
* Contact your network administrator to make sure the proxy server is
working.

I am not sure where to change that?

 

[Lorien]

Hi FCUSA,

To configure Firefox proxy settings, go to Tools / Options / Advanced / Network / Connection Settings / and click on No Proxy (which is what I think you want) then click OK and OK again. You will probably have to close and restart Firefox for the settings to become effective. That should solve the Firefox problem.

Good luck!

 

[roy69]

If you have the virus then the registry keys may be changed back to how the virus wants them.

I do not use firefox but Lorien has given clear instructions on how to change them.

After you have changed the proxey in IE let us know what the IP address is that it has been changed to. For some reason on my system the IP had been changed to the loopback address 127.0.0.1 so even if the virus had been active I dont think(more hope) that, that much had been compromised.

This virus is relativly new and I dont normally browse the web looking at new sites through bordom which means the sites I go to are relativly virus free, it still managed to install on my system just by looking at a couple of new sites not downloading programs.

If you have any more problems Lorien should be able to give you expert advice as normal.

If your proxy in IE is still changing the virus is still active.

 

[FCUSA]

So far so good, System booted this morning but still has this message:

'Could not load or run C:\users\FCUSA\AppData\Local\Temp.csrss.exe specified in the registr. Make sure file exits or remove the reference to it in the Registry'

Will definitely need assistance with that.

IE opened without issue and Lorien provided the necessary Firefox changes and that also has been corrected.

I am not certain what you mean by 'IP address looping back'. I only periodically check my IP through a website if I notice an IP in my web stats that I believe could be me - as that does change periodically.

How I got the virus: Also, I do not venture to far from home on the web. Mostly just review the search results of my web visitors (to see the competition) and for the most part, they are the same sites I am more than familiar with.

However, I saw something I was not familiar with and pulled up the site. All was still good until I clicked on the link at the bottom of the site that typically says 'Powered by etc" There were two (as it was an e-commerce site) Wordpress and I think 'Market Theme' (not 100% sure) and bam, the alarms sounded as soon as that site pulled up - so I was also not downloading anything - if that helps to understand the nature of the virus.

 

[FCUSA]

Is this the appropriate place to download/update Active X controls?

http://download.cnet.com/windows/activex/

Also, to post the logs from the scans - simply copy & past here?

 

[Lorien]

Hi FCUSA,

First, go to http://www.vistax64.com/network-sharing/284688-network-posting-tips.html and do steps 1 and 2 (but NOT 3) so I can see your IP configuration.

Second, download, update, and run http://www.safer-networking.org/en/index.html to see if we can eliminate that registry problem as Roy suggested. I'd rather not mess directly with the registry unless/until there is no other choice.

If that doesn't work, try a clean boot http://support.microsoft.com/kb/929135. If the problem goes away then it's just a matter of tracking down the culprit causing the problem. Follow the procedures in the article. Once found, delete, remove, deactivate, or uninstall it. Once done be sure to reset Vista back to normal status as explained in the procedures. If the problem occurs in clean mode then just restore the system to normal status and reboot - this solution is not going to work.

Next, what ActiveX control are you looking for - and why - and for which program? What do you want this ActiveX control to do that you can't do now? That's a fairly legitimate source for downloads, but there may be better choices depending on what exactly you want.

Finally, if the log is a file, then click on Go Advanced here and there will be a button for manage attachments. If it is one of the accepted types and within the size limits, just click on a browse button, find the file, click OK and then click Upload and it will be attached to your post (this is similar to how you will attach the IPCONFIG /ALL screenshots from the first step above). If it is too big or not an acceptable type, then zip it into a folder and then browse to the zipped folder and attach it like explained above and we'll just expand it and have access to it. If there is no log, then copy/paste it to a new file in Notepad and save it and upload that file. If you can't do that, then take a screenshot of the results (it may take two or three to get it all) and attach them as previously described.

I think that covers everything - if not, let me know what I missed.

I hope this helps.

Good luck!

 

[FCUSA]

OK - I did get the Snipit and the Log from Dr Web Cureit but I am having trouble uploading the files. Files are .txt and .jpg and are under 55mb each. I receive the following error
404 - File or directory not found.

The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.

I also went to pull the log for MBAM and although it said the file would be available under 'Logs' - I do not have anything there. Should I try searching for it in the event it is someplace else?

I will work on the other.

As far as ActiveX (I was looking over your suggestions in a post we have already closed (should I just create a different post on this so every thing is separated?)

 

[Lorien]

I hope you meant 55kb, not 55mb - 55mb is too large to send this way (but I've never seen a log of that size before so I can't believe either is anywhere near that size). If it is that big, we'll have to find a different way to send it using some online service (if even they will handle something that big). If it's 55kb, then we're fine. If it really is close to 55mb, then post back with the exact size and tell me which log you're talking about.

I think you're putting the file in the URL section or clicking the upload button for the URL section instead of the one for the files section. You need to click one of the browse buttons, then find the file, click on the file to highlight it and then click on open. It will add next to the browse button you selected. When you've added everything you want (you can add as many as there are browse buttons), then click the UPPER upload button (NOT the lower one next to the URL upload). It should then work.

For MBAM, go to Settings and the General Settings Tab and make sure the box to create a log is checked - I also check the box to show the log immediately after completion and given the problem suggest you do so as well. If it wasn't checked, that's why you don't have a log. If it was checked, I'm not sure why there's no log in that Tab. The best choice is to run another Full Scan and hope it creates a log this time - or at least presents a report when it is completed. If it presents a report but does not create one in the logs folder, then copy the presented report and paste it to your reply. If it does create a log, attach the log file as previously instructed.

As far as the ActiveX Control goes, you can either create a separate thread about it or perhaps just go back to the thread where it was mentioned and post there (just because it is marked solved doesn't mean you can't still post to it - which is probably best if it is related to that thread). If you do create a separate thread, then please include a link to the post where I mentioned the ActiveX control so I can refresh my memory about the issue and catch up to you faster.

I hope this helps.

Good luck!

 

[FCUSA]

In the meantime, I have automatic backups scheduled for today - do you think I should cancel that until this is more settled? I did have the backup drive connected for the MBAM scan.

 

[Lorien]

If it will create a separate full backup and you only backup your data, then go ahead and do it. If it will overwrite a previous backup (or is an incremental backup), then cancel it as we may need to restore from a point before this all started (if it comes to a clean install - don't jump ahead here on me, I'm just being careful and not suggesting that will be necessary but it is possible and I want to make sure we do what we can to preserve your data and not need to wipe it as well to get rid of the infection if it ends up there despite all our efforts - but that's pretty much a call for Jacee to make and she hasn't even seen this yet as we aren't ready to bring her in).

Good luck!

 

[FCUSA]

Yep - kb - both Dr Web Cureit (55,128kb) & the IP Snipit (58,126kb) - sorry about that.

Ok - I thought I was doing it right and tried again (used caution in the upload button making sure it wasn't the URL) - same problem. Takes some time then says IE cannot access the page - diagnos - no connection problems found - they the Server Error above.

Regarding MBAM under Settings - everything is checked (except Terminate IE during threat removal).

On 'Open log file immediately after saving' - I honestly cannot remember if that happened.

RE: Active X - I will post in the thread where we originally discussed it.

 

[FCUSA]

The backup is incremental (just adds the new data) - so I will cancel it.

Good job putting the brakes on my Alarm Mode!

 

[Lorien]

Yep - kb - both Dr Web Cureit (55,128kb) & the IP Snipit (58,126kb) - sorry about that.

Ok - I thought I was doing it right and tried again (used caution in the upload button making sure it wasn't the URL) - same problem. Takes some time then says IE cannot access the page - diagnos - no connection problems found - they the Server Error above.

Regarding MBAM under Settings - everything is checked (except Terminate IE during threat removal).

On 'Open log file immediately after saving' - I honestly cannot remember if that happened.

RE: Active X - I will post in the thread where we originally discussed it.

All right, let's first zip those files and attach the zipped folders instead. Perhaps that will work better. And if it really is 55,128kb, then that is 55mb and that shouldn't be possible - it's much to big for these things (I'm POSITIVE the IP snippit cannot be that large - something isn't right - are you using the right filetype to save it (I think it should be .jpg)). Perhaps zipping will reduce them to a size that can be accepted (10mb for a zip file/folder).

Here is a snip of my IPCONFIG /ALL (I just did the first part to illustrate) and it was 163.4kb. Please double-check what you are doing and try again. If we can't attach the logs, then you may need to open them and cut and paste the contents (perhaps in more than one post if they are too large). But I'm certain the IPCONFIG can be small enough to send as the .jpg file without zipping.

Good luck!

 

[FCUSA]

I am so sorry, but I am really confused now. The file is only 56.7kb. But my snipit also does not look like that. I cannot get all the info in the window - is there a certain area I should have in the window before taking the snipit?

I was just getting ready to do the following:
Second, download, update, and run http://www.safer-networking.org/en/index.html to see if we can eliminate that registry problem as Roy suggested. I'd rather not mess directly with the registry unless/until there is no other choice.

do you want me to wait until you get the snipit?