Can not logon to WindowsXP, deleted some registry keys

  • guptavis
  • Born
  • Born
  • guptavis
  • Posts: 4

Post 3+ Months Ago

Hello people,

I use Malwarebytes Antimalware regularly and havent had an infection found in about a year.
Yesterday i scanned after about a month and i saw 12 infections !

MBAM said it could not clean a few infections:
Code: [ Select ]
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 2
Internet Explorer Unknown

9/11/2010 11:19:49 PM
mbam-log-2010-09-11 (23-19-49).txt

Scan type: Quick Scan
Objects scanned: 94917
Time elapsed: 2 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mp3_audio_codec (Spyware.Zbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.
  1. Malwarebytes' Anti-Malware 1.44
  2. Database version: 3510
  3. Windows 5.1.2600 Service Pack 2
  4. Internet Explorer Unknown
  5. 9/11/2010 11:19:49 PM
  6. mbam-log-2010-09-11 (23-19-49).txt
  7. Scan type: Quick Scan
  8. Objects scanned: 94917
  9. Time elapsed: 2 minute(s), 49 second(s)
  10. Memory Processes Infected: 0
  11. Memory Modules Infected: 0
  12. Registry Keys Infected: 2
  13. Registry Values Infected: 2
  14. Registry Data Items Infected: 3
  15. Folders Infected: 1
  16. Files Infected: 4
  17. Memory Processes Infected:
  18. (No malicious items detected)
  19. Memory Modules Infected:
  20. (No malicious items detected)
  21. Registry Keys Infected:
  22. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
  23. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
  24. Registry Values Infected:
  25. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mp3_audio_codec (Spyware.Zbot) -> Quarantined and deleted successfully.
  26. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.
  27. Registry Data Items Infected:
  28. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
  29. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Spyware.Zbot) -> Data: system32\sdra64.exe -> Delete on reboot.
  30. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.
  31. Folders Infected:
  32. C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.
  33. Files Infected:
  34. C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
  35. C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
  36. C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> Quarantined and deleted successfully.
  37. C:\WINDOWS\system32\sdra64.exe (Spyware.Zbot) -> Delete on reboot.


So i thought of manually removing the infected Registry keys. (Something i've done many times before)

While I was at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
I saw a key named 'Special Accounts', it looked fishy to my paranoid eyes. Had some 'strange' values in it, None corresponding to my Username (Administrator) or Guest. 3 were somewhat random letters with a ~, and one was ' search assistant'. Looked like malware remains of some kind, so, i deleted them all.

After that i rebooted, the welcome screen showed up (usually straightaway shows me desktop since there is just one user 'Administrator') with the only user 'Administrator'. When i click it, it shows 'loading your personal settings' for a second. Then it reads 'saving your settings' and stays at the logon screen. Repeated it for 10 times. Restarted and repeated. Shut Down and repeated. Always same result.

Then i tried the 'Last Know good configuration' in statup options. Still same result.
Tried 'Safe Mode' starts loading then breaks at 'unable to load NTFS.dll'
'Safe mode with networking' same logon screen and same one second login and return to logon screen.

I dont know how to login. Can someone please help. Is there a way to remotely add the keys back to my registry. Or some way to correct this problem?

Thanks and Regards
  • Anonymous
  • Bot
  • No Avatar
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post 3+ Months Ago

  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4924
  • Loc: NY

Post 3+ Months Ago

Where does it say that anti malware couldn't delete? Delete on reboot doesn't mean that you are supposed to delete it.

Now, you probably have to do a repair install. Do you have the XP CD?
  • guptavis
  • Born
  • Born
  • guptavis
  • Posts: 4

Post 3+ Months Ago

I should not have messed with the registry key, but it looked suspicious at the time, stupid mistake i did while in panic.

Yes, i do have the XP CD (somewhere buried in my room). Im sure i'll be able to find it.
Will it solve my problem? will a repair keep my installed programs and setting intact?

Thanks for the reply :)
  • guptavis
  • Born
  • Born
  • guptavis
  • Posts: 4

Post 3+ Months Ago

Thanks for the reply. I remember having seen a repair option too, some years ago.
Finally found my Win XP CD and booted with it. It started fine and gave me this screen with the partitions and asking on which partition doi want to install windows.
It did show a message of ' Detecting previous windows Installations ' before coming to this screen.
I guess it somehow did not detect my windows XP. Could be because i had installed Windows7 on another hard disk from the same MBR.
____________________________________________


On bootup it shows me options for Windows 7 or 'Earlier version of Windows'
Default choice being WIndows7. So i guess ill have to remove the Windows 7 Bootloader for the XP setup CD to recogniseand repair my windows install. Any advice on How i can do that ?

On putting the CD (and restarting a couple times to try different options.) It did wipe out Grub from the MBR.

Earlier it used to be GRUB->Windows7 loader-> choose WinXP.
Now its Windows7 loader-> choose WinXP
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4924
  • Loc: NY

Post 3+ Months Ago

If you have Windows 7, why bother with XP?
  • guptavis
  • Born
  • Born
  • guptavis
  • Posts: 4

Post 3+ Months Ago

I had Windows7 but moved back to XP. Couldnt bother with 7 ;)
By the way, i got into my system. Booted to Ubuntu and replaced my Software hive in Windows/System32/Config folder with the Software.bak file. Booted up and logged injust fine :)
  • spork
  • Brewmaster
  • Silver Member
  • User avatar
  • Posts: 6245
  • Loc: Seattle, WA

Post 3+ Months Ago

"Couldn't bother with 7"? Are you joking?

Post Information

  • Total Posts in this topic: 7 posts
  • Users browsing this forum: No registered users and 32 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
cron
 

© 1998-2014. Ozzu® is a registered trademark of Unmelted, LLC.