Hi all,
Thought I'd share this for any of you that may be having similar problems...

I just got done with a real hum-dinger of a trojan/malware combo on a buddys computer.

The trojan is called "newdotnet" and it is a bastard... but not as much of a PIA as the malware "bundle" that accompainied it. The trojan is easy to get... update AV defs, update all spyware programs, reboot into safe mode, and run em all... However, the malware is a bit different.

This particular malware named itself "iexplore.exe" which is the system process of microsoft internet explorer. He uses firefox, so this caught his
attention when he was ending a frozen program. Anyway, you can end the processes, but they just return. After I ran regmon and filemon (www.sysinternals.com) I saw what was going on. the process "iexplore.exe" (malware can take on any name, hence why they suck) was writing and excuting programs and files to try to disable the AV and changing registry values. The root key was called "Trans Help Bias" and its sub entry of "CASHEXTRA". I tried eliminating writing privlages to this key, but it overrode that. This was at midnight last night... I decided to run "hack this" (I obtained it from www.majorgeeks.com) and removed all invalid registry entries in safe mode. It still didnt work. It is at this point I begin to wonder if it is salvageable... The funny thing is, this didnt alter functionality of windows, IE, firefox, or anything. Just the AV. He uses Panda AV, same as me, and Panda didnt seem to be phased by it, but looking again it regmon and filemon it wasnt updating. I decided that it would be ok for the night and went to bed...

This morning I was shocked... This malware was getting smarter, because at first panda fought it, and kept going. But now the AV was disabled, and the "iexplore.exe" process was still going... I never did figure out what it was doing, except changing the homepage url in IE. I ran a program called ccleaner (www.ccleaner.com) and it cleaned up the registry and finally removed this bastard of a malware. It didnt work at first, but after rebooting into safe mode again, it finally worked. This isnt nearly as bad as the .dll exploit I had on my machine a few months back seen here...

http://www.realoldspower.com/phpBB2/vie ... hp?t=12911

This one was really resistant, but finally went down once I could destroy the root.

Andrew

Hi andrewk, hello everyone,

Found the same thing on an HP about a year ago. Owner brought it to me because it took almost 20 mins to boot to its Desktop and the speed was no better after that. He said it started after his Son used it. Surprise! Cache, history, etc, showed visits to many porn sites.

Took over ¾ of an hour to remove about 4900 instances of various pests. Took another 6, or so, to get rid of two hijackers.


The tricky ones reinstall themselves during the reboot. The new homepage would be a "search page" with all links leading to paid advertising and the writer (or buyer) of the program gets paid for each hit.


"Crap Cleaner" and "Hijack This" are two of my most valuable tools.


In my case, finding the root was the hard part. Every time I deleted the obvious culprit and rebooted, it came back with a different name.

Regards, Norm