AccessProtectionLog.txt Log File Records

Windows Security Tutorials - Herong's Tutorial Examples

∟PWS (Password Stealer) Trojan Infection Removal

∟AccessProtectionLog.txt Log File Records

This section provides detailed information on malicious files left by two Trojan attacks. Somehow McAfee failed to detect and delete them.

I also reviewed the other McAfee log file, AccessProtectionLog.txt and saw many records related to this PWS Trojan:

<date> 5:58:59 PM Would be blocked by Access Protection rule
   (rule is currently not enforced) hyang 
   C:\Program Files\Mozilla Firefox\firefox.exe	
   C:\Documents and Settings\hyang\Local Settings\Temp\mmc.exe	
   Common Standard Protection:Prevent common programs from running
   files from the Temp folder Action blocked: Execute

And many other similar records:
<date> 5:58:59 PM hyang C:\Program Files\Mozilla Firefox\firefox.exe
   C:\Documents and Settings\hyang.Local Settings\Temp\mmc.exe

<date> 6:00:52 PM hyang C:\Program Files\Mozilla Firefox\firefox.exe
   C:\WINDOWS\Temp\mmhtml.dll 

<date> 6:15:23 PM hyang C:\Program Files\Mozilla Firefox\firefox.exe 
   C:\WINDOWS\Temp\mmhtml.dll

<date> 6:20:46 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\HBASKTAO.dll

<date> 6:20:55 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\HBASKTAO.dll  

<date> 6:21:02 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\xboqpxabzp.exe  

<date> 6:21:05 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\HBASKTAO.dll  

<date> 6:21:19 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\xboqpxabzp.exe  

<date> 6:21:44 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\System.exe  

<date> 6:21:51 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\heb.exe  

<date> 6:21:55 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\qcabyoprxy.exe  

<date> 6:21:56 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\HBZHUXIAN.dll  

<date> 6:21:59 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\heb.exe  

<date> 6:22:01 PM hyang C:\WINDOWS\explorer.exe 
   C:\temp\windows\system32\HBZHUXIAN.dll  

<date> 6:22:44 PM hyang C:\Program Files\Internet Explorer
   \IEXPLORE.EXE C:\WINDOWS\Downloaded Program Files\Manager.exe

<date> 6:28:45 PM hyang C:\WINDOWS\Explorer.EXE C:\temp\wuauclt.exe

<date> 6:29:30 PM hyang C:\WINDOWS\Explorer.EXE C:\temp\wuauclt.exe

<date> 6:29:35 PM hyang C:\WINDOWS\Explorer.EXE C:\temp\windows
   \wuauclt.exe common programs 

<date> 6:29:44 PM hyang C:\WINDOWS\Explorer.EXE C:\temp\windows
   \wuauclt.exe   common programs 

<date> 6:34:05 PM hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\Temp\mmhtml.dll 
   
<date> 7:21:09 PM hyang C:\Program Files\Internet Explorer
   \iexplore.exe C:\WINDOWS\Temp\mmhtml.dll 

<date> 7:36:25 PM hyang C:\Program Files\Internet Explorer
   \iexplore.exe C:\WINDOWS\Temp\mmhtml.dll 

<date> 10:06:28 PM hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\Temp\mmhtml.dll common programs 

<date> 10:32:11 PM hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\Temp\mmhtml.dll 

<date> 10:33:31 PM hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\Temp\mmhtml.dll common programs 

<date> 10:37:58 PM hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\Temp\mmhtml.dll common programs 

<date> 10:39:08 PM hyang C:\Program Files\Mozilla Firefox
   \firefox.exe C:\WINDOWS\Temp\mmhtml.dll 

<date> 10:51:15 PM hyang C:\WINDOWS\Explorer.EXE 
   C:\WINDOWS\Temp\mmhtml.dll common programs