Mutating EXE files in the registry

[ftvjr]

We are running Windows 2000 and it is full patched with updated McAfee DATs.
Program details: I have seen it named any of the following.

- dblog.exe
- dnssrv.exe
- awave.exe
- asurl.exe
- ordblc.exe (something close to that)

Most of the time located in...

c:\winnt\config
c:\winnt\tasks
c:\winnt\speech
c:\winnt

Another characteristic of the program is that for every .exe instance there is a corresponding .ini file that is the mirror image of the file name. For instance...

dblog.exe, has an INI file of golbd.ini

This is the case for every instance of the program that I saw. It installs itself in the usual registry places...(HKCU|HKLM)/Software/.../(Run|RunOnce).

Things I have tried:

- Latest SDAT and ran virus scan
- Installed Adaware
- Stinger
- Removing from registry - this one replaces the registry entries extremely quickly.
- Changing ACLs on the registry - this did not seem to work either.

Any thoughts or suggestions you have would be greatly appreciated. I could not find much mention of this one on the net. But, then again, it seems to create pretty random EXE names.

 

[wvajenm]

I posted a similiar response in the Citrix forum, but since it sounds like the same problem, I'll post here too. The user has WinXP SP1. I had this problem on a machine and discovered it because it prevented my Citrix apps from opening. The process was not detected by any of the usual means, Spybot, AdAware, Norton, or Hijack This. But after I had cleaned everything it found and still had a rogue process reappearing in my run key in the registry and one that I could not kill in the task manager, I went to work on it. This file was named imginet.exe and the ini's and bak's were named tenigmi. I first managed to rename it and delete the accompanying .ini and .bak files(which I am assuming were the backups to reinstall the process if it got deleted). I then watched the files reappear in the C:\windows\repair directory. Then I used Killbox and deleted all the files, removed them from startup, and rebooted. I got an error message saying that it could not find the file imginet.exe. Good news. But then I noticed that I had another process doing the same thing called acbin.exe, and it was in the same directory c:\windows\repair along with the .ini, .tmp and .bak files with the reversed name(nibca). So I repeated the process, using Killbox, editing the registry and removing the process from both Run and RunOnce, which had a strange rerun added after the file location. This time on the reboot I got the message that acbin.exe could not be found. No strange processes restarted this time, and there were no files left in the repair directory that shouldn't have been there. Don't delete the whole directory because there are valid windows files in there. I searched the registry for files with the names in them, and it came out clean. So far, this machine is still clean. If it hadn't interfered with Citrix, I may never have found it though. I don't know what other damage it may inflict, and I haven't been able to find anyone who has identified it yet. It also seems to mutate in different forms, as every forum I've seen talking about this has no two users listing the same file/process names. If anyone can identify what it is and a tool that might clean it, I'd be very interested.

 

[beerhunter2]

The only thing that I've seen that is similar to this is for a new variation of the CoolWebSearch homepage hijacker. Go to the following for removal instructions.

http://www.pchell.com/support/onlythebest.shtml

Make sure you have the latest About:Buster (should be at least 3.0).

In my case, I also noticed a corresponding 5 character .dll file for each of the 5 character .exe files in the Windows and Windows\system32 directories.

The additional step that I had to take (because About:Buster didn't get rid of all remnants) was to do a search on the whole hard disk for all 5 character .dll files (ie. ?????.dll). I noticed that all the 5 character .dll files related to this were either 53KB or 56KB in size. I manually deleted these files as well.

It's been a while ago, but I think I also searched for a corresponding .exe file for each of the .dll files that matched the above criteria, and manually deleted them as well.

The web site above also mentions 6 character .dll and .exe files, so you might want to check for them as well to see if they match the 53KB or 56KB characteristics.


Help! I've fallen and I can't reach my beer.