Trajon Files Left in the System Folder

Windows Security Tutorials - Herong's Tutorial Examples

∟PWS (Password Stealer) Trojan Infection Removal

∟Trajon Files Left in the System Folder

This section provides detailed information on malicious files left by two Trojan attacks. Somehow McAfee failed to detect and delete them.

After finish review the McAfee VirusScan log file, OnAccessScanLog.txt, I started to look at the system folders to see files left by the Trojan.

In c:\windows, I saw the following new files:

\system32
10/26/2008 5:59 PM    6,540   heb.exe
10/26/2008 5:59 PM    6,540   wuauclt.exe
10/26/2008 5:59 PM    6,540   ctfmon.exe
10/26/2008 5:59 PM    6,540   conime.exe
10/26/2008 6:00 PM    1,582   yoprybzpax.ini
10/26/2008 6:00 PM    2,752   abzpqaxboq.exe
10/26/2008 6:01 PM   16,433   xboqpxabzp.exe
10/26/2008 6:01 PM    5,504   5102a80.sys
10/26/2008 6:03 PM   24,576   BHBO.dll
10/26/2008 6:05 PM   79,048   xyoqrxabzp.exe
10/26/2008 6:11 PM   52,712   qcabyoprxy.exe
10/26/2008 9:34 PM    6,540   yvspqn.exe
10/26/2008 9:35 PM    6,540   alg.exe
10/26/2008 9:35 PM    1,582   abopxy.ini
10/26/2008 9:36 PM   33,193   sovhst.exe
10/26/2008 9:36 PM    5,504   9fd8db.sys
10/26/2008 9:36 PM   28,672   HBWOW.dll
10/26/2008 9:36 PM    7,680   System.exe
10/26/2008 9:36 PM   20,480   conmie.exe
10/26/2008 9:36 PM   24,576   HBASKTAO.dll
10/26/2008 9:36 PM       26   discard.ini
10/26/2008 9:36 PM    1,148   sufost.ini
10/26/2008 9:37 PM   24,576   HBZHUXIAN.dll
10/26/2008 9:37 PM   24,576   BHYY.dll
10/26/2008 9:37 PM   18,587   pcxyqr.exe

\system32\drivers
10/26/2008 5:59 PM    8,192   pcidump.sys
10/26/2008 9:37 PM   16,343   HBKernel32.sys

\temp
10/26/2008 5:59 PM   36,864   mmhtml.dll

This confirmed that:

There were two Trojan attacks: one at 5:59 PM and one at 9:35 PM.
McAfee failed to protect my system on both attacks and let some malicious programs installed in the system folder.
Both attacks were from the same original Trojan, because attacks left some files with identical sizes and similar file names, like heb.exe and alg.exe.