brian14

I recently received great support from this forum in cleaning my PC of a rootkit. Please see

Rootkit and Multiple problems

Today I ran a scan of a-squared Anti-Malware software and it showed me a suspicious program.

c:\program files\passware detected: Trace.Directory.BackupKey!A2
c:\program files\passware\demos detected: Trace.Directory.BackupKey!A2

I am sure, I never installed this. When I tried to delete the entry it could not and asked me to consult the a-squared forums to get help on this. Since I got outstanding help here..I just wanted to check here on TSF if this indeed is a threat and in some way related to my recent rootkit infection. I have attached a log from a-squared.

Thanks!!


a-squared Anti-Malware - Version 4.5
Last update: 7/3/2009 1:29:34 AM

Scan settings:

Scan type: Quick Scan
Objects: Memory, Traces, Cookies
Scan archives: On
Heuristics: Off
ADS Scan: On

Scan start: 7/3/2009 11:22:54 AM

c:\program files\passware detected: Trace.Directory.BackupKey!A2
c:\program files\passware\demos detected: Trace.Directory.BackupKey!A2
c:\program files\amazon detected: Trace.Directory.Berm.Amazon Toolbar!A2
c:\program files\passware\demos\pk.chm detected: Trace.File.BackupKey!A2
c:\program files\passware\demos\dict.txt detected: Trace.File.Office Key 7.0!A2
Value: HKEY_USERS\S-1-5-21-823518204-1563985344-725345543-1003\Software\Passware\common\8 --> general detected: Trace.Registry.Money Password Recovery Key!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@247realmedia[1].txt detected: Trace.TrackingCookie.247realmedia!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@247realmedia[3].txt detected: Trace.TrackingCookie.247realmedia!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@2o7[2].txt detected: Trace.TrackingCookie.2o7!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@adserver.adtechus[1].txt detected: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@adserver.adtechus[2].txt detected: Trace.TrackingCookie.adserv!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@questionmarket[2].txt detected: Trace.TrackingCookie.questionmarket!A2
C:\Documents and Settings\Matrix\Cookies\Matrix@specificclick[2].txt detected: Trace.TrackingCookie.specificclick!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1245723627671875 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1245723628046875 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246120403156250 detected: Trace.TrackingCookie.dealtime!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246136342921876 detected: Trace.TrackingCookie.zedo!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246136344281250 detected: Trace.TrackingCookie.zedo!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246159644453130 detected: Trace.TrackingCookie.link!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246200577562500 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246200609390626 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246200665421875 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246200684140625 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246200731703126 detected: Trace.TrackingCookie.webtrends!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246203863984376 detected: Trace.TrackingCookie.count!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246321203890625 detected: Trace.TrackingCookie.count!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246385289768850 detected: Trace.TrackingCookie.link!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246385384596976 detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246385384596978 detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246405140284472 detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246405493034472 detected: Trace.TrackingCookie.com!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246544937000004 detected: Trace.TrackingCookie.count!A2
C:\Documents and Settings\Matrix\Application Data\Mozilla\Firefox\Profiles\ynnzhs7y.default\cookies.sqlite:1246544937000007 detected: Trace.TrackingCookie.dealtime!A2

Scanned

Files: 2881
Traces: 667059
Cookies: 858
Processes: 61

Found

Files: 0
Traces: 6
Cookies: 29
Processes: 0
Registry keys: 0

Scan end: 7/3/2009 11:25:15 AM
Scan time: 0:02:21

TheBruce1

Hello

We want all our members to perform the steps outlined in the link I'll give you below, before posting for assistance. There's a sticky at the top of this forum, and a link at the top of each page.

---------------------------------------------------------------------------------------------

Please follow our pre-posting process outlined here:

NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Please note that the Virus/Trojan/Spyware Help forum is extremely busy, and it may take a while to receive a reply.