mmx19g.sys, xmm13g.dll, scsiusr4.dll - Haxdoor

mmx19g.sys, xmm13g.dll, scsiusr4.dll

HijackThis

O20 - Winlogon Notify: scsiusr4 - scsiusr4.dll
O20 - Winlogon Notify: xmm13g - C:\WINDOWS\SYSTEM32\xmm13g.dll

F-Secure BlackLight

09/24/06 22:14:54 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\QZ.DLL 09/24/06 22:14:54 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\MMX19G.SYS 09/24/06 22:14:55 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\QZ.SYS 09/24/06 22:14:55 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\WA114.INI 09/24/06 22:14:56 [Info]: Hidden file: c:\WINDOWS\SYSTEM32\ASZZXE~1.VB

datfindbat

Verzeichnis von C:\WINDOWS\system32
24.09.2006 21:17 256 ps.a3d
24.09.2006 21:09 152 ilxphmgy.txt
09.09.2006 17:17 0 ksl48.bin
26.08.2006 14:36 0 scsipsrvc.sys

** klick Start -> Ausführen>> schreibe rein: Services.msc und Klick OK!
"Eigenschaften" >> klick "Stop" >> Starttyp "deaktiviert"
MMX2 virtualization service

Avenger (Beispiel)

registry keys to delete: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\mmx19g.sys HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\xmm13g.sys Files to delete: c:\WINDOWS\SYSTEM32\QZ.DLL C:\WINDOWS\System32\mmx19g.sys C:\WINDOWS\System32\xmm13g.sys c:\WINDOWS\SYSTEM32\QZ.SYS c:\WINDOWS\SYSTEM32\WA114.INI c:\WINDOWS\SYSTEM32\ASZZXE~1.VB C:\WINDOWS\system32\ps.a3d C:\WINDOWS\system32\ksl48.bin C:\WINDOWS\system32\scsipsrvc.sys C:\WINDOWS\SYSTEM32\xmm13g.dll C:\WINDOWS\System32\scsiusr4.dll

Regsearch
und doppelklicken, um zu starten. in: "Enter search strings" reinkopieren)

MMX19G.SYS
scsipsrvc.sys
xmm13g.sys

in edit und klicke "Ok".
Notepad wird sich öffnen

Silentrunner

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! xmm13g\DLLName = "xmm13g.dll" [** WMI GetObject error **]

Download haxfix.exe und anwenden

* Save it to your desktop.

* Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix)

* Checkmark "Create a desktop icon".

* Click "Next".

* When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed. Click "Finish".

* A red "dos window" (dos box) will open.

* Select option 1. Make logfile by typing 1 and then pressing Enter. Haxfix will start scanning the computer. When it is finished a logfile will open. Copy the contents of that logfile and paste it into this thread.

checking for haxdoor
--------------------
checking for a3d files....
a3d files found
ps.a3d

checking for matching notify keys....
matching notify keys found
xmm13g

checking for matching services....
matching services found
xmm13g
mmx19g

checking for matching safeboot services....
matching safeboot services found
xmm13g.sys
mmx19g.sys

--------------------------

Run Haxfix choose option 2 autofix

searching for services....
service xmm13g found
[SWSC] DeleteService SUCCESS
service mmx19g found
[SWSC] DeleteService SUCCESS