[bphipps]

Hi GTG,

My XP Pro SP2 machine was infected with W32/alemod.f and Alfacleaner. By following instructions on this and other sites (greyknight17 and others) I managed to clean things up - McAfee virus scans, AdAware, HJT, manual replacement of wininet.dll and removal of other files, Ewido, etc.. HJT removed the program entry for Alfacleaner in my registry, but there are several other Alfacleaner entries still present. They do not look serious and I think I should be able to delete them by hand, but I want to be sure before I do this (I will backup the registry first). A list of these registry entries follows:


[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AlfaCleaner]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,80,00,\
00,00,00,00,00,00,72,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,60,00,32,\
00,da,02,00,00,5c,34,11,bc,20,00,41,4c,46,41,43,4c,7e,31,2e,4c,4e,4b,00,00,\
36,00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,41,00,6c,00,66,\
00,61,00,43,00,6c,00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,\
00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,\
00,92,00,00,00,01,00,00,00,84,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,\
72,00,32,00,4c,06,00,00,5c,34,11,bc,20,00,52,45,47,49,53,54,7e,31,2e,4c,4e,\
4b,00,00,48,00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,52,00,\
65,00,67,00,69,00,73,00,74,00,65,00,72,00,20,00,41,00,6c,00,66,00,61,00,43,\
00,6c,00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,\
0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,94,00,00,\
00,02,00,00,00,86,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,74,00,32,00,\
a3,02,00,00,5c,34,11,bc,20,00,55,4e,49,4e,53,54,7e,31,2e,4c,4e,4b,00,00,4a,\
00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,55,00,6e,00,69,00,\
6e,00,73,00,74,00,61,00,6c,00,6c,00,20,00,41,00,6c,00,66,00,61,00,43,00,6c,\
00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,\
00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00


[HKEY_USERS\S-1-5-21-1445258045-2690133624-1694720459-1004\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\AlfaCleaner]
"Order"=hex:08,00,00,00,02,00,00,00,b2,01,00,00,01,00,00,00,03,00,00,00,80,00,\
00,00,00,00,00,00,72,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,60,00,32,\
00,da,02,00,00,5c,34,11,bc,20,00,41,4c,46,41,43,4c,7e,31,2e,4c,4e,4b,00,00,\
36,00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,41,00,6c,00,66,\
00,61,00,43,00,6c,00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,\
00,00,1c,00,0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,\
00,92,00,00,00,01,00,00,00,84,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,\
72,00,32,00,4c,06,00,00,5c,34,11,bc,20,00,52,45,47,49,53,54,7e,31,2e,4c,4e,\
4b,00,00,48,00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,52,00,\
65,00,67,00,69,00,73,00,74,00,65,00,72,00,20,00,41,00,6c,00,66,00,61,00,43,\
00,6c,00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,\
0e,00,00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00,94,00,00,\
00,02,00,00,00,86,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,74,00,32,00,\
a3,02,00,00,5c,34,11,bc,20,00,55,4e,49,4e,53,54,7e,31,2e,4c,4e,4b,00,00,4a,\
00,03,00,04,00,ef,be,5c,34,11,bc,5c,34,11,bc,14,00,00,00,55,00,6e,00,69,00,\
6e,00,73,00,74,00,61,00,6c,00,6c,00,20,00,41,00,6c,00,66,00,61,00,43,00,6c,\
00,65,00,61,00,6e,00,65,00,72,00,2e,00,6c,00,6e,00,6b,00,00,00,1c,00,0e,00,\
00,00,0a,00,ef,be,00,00,00,00,1c,00,00,00,00,00,00,00,00,00


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANERSERVICE]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANERSERVICE]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER\0000]
"Service"="alfacleaner"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="alfacleaner"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER\0000\LogConf]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANERSERVICE]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANERSERVICE\0000]
"Service"="AlfaCleanerService"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="AlfaCleanerService"


Can someone knowledgeable about these things confirm that it is OK for me to go ahead and delete these?

Thanks for your help.

Barry

[Advertisements]

Download smitRem.exe ©noahdfear, and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Do another search for alfacleaner in the registry and post that as well.

Regards,

[Metallica]

Download smitRem.exe ©noahdfear, and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

Do another search for alfacleaner in the registry and post that as well.

Regards,

[bphipps]

Thanks Metallica,

I ran CleanUp! followed by smitRem in Safe Mode. smitfiles.txt is shown below. I did not attach a new search of the registry for "alfacleaner" because the results were identical - none of the registry keys were removed or changed. Again, my question is can I simply delete the "alfacleaner" registry keys listed in my original posting? Thanks.

Barry


smitfiles.txt:


smitRem © log file
version 2.8

by noahdfear


Microsoft Windows XP [Version 5.1.2600]
The current date is: Wed 03/08/2006
The current time is: 21:56:53.39

Running from
C:\Program Files\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

checking for ShudderLTD key

ShudderLTD key not present!

checking for PSGuard.com key


PSGuard.com key not present!


checking for WinHound.com key


WinHound.com key not present!

spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Existing Pre-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~

secure32.html


~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~




~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003 [email protected]
Killing PID 764 'explorer.exe'

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files


~~~ Program Files ~~~



~~~ Shortcuts ~~~



~~~ Favorites ~~~



~~~ system32 folder ~~~



~~~ Icons in System32 ~~~



~~~ Windows directory ~~~



~~~ Drive root ~~~


~~~ Miscellaneous Files/folders ~~~


~~~ Wininet.dll ~~~

CLEAN!

[Metallica]

Yes you can. Absolutely nothing in there that you need.
I wanted to know if smitRem tackled them, but it obviously didn't.

Regards,

[bphipps]

Thanks Metallica, I appreciate your help!

Barry

[Metallica]

My pleasure.

Feel free to let me know if any of them refuses to go peacefully.

Regards,

[bphipps]

Hi Metallica,

From your last reply I gather you might have been expecting this...

The two "start menu" (HKU, HKCU) registry entries happily went away but the all the "legacy_alfacleaner" (HKLM, controlsets) entries are refusing to go, with the message "cannot delete: error during deletion". I tried deleting individual values first but each of them gives the same message. Any ideas?

Thanks for your help.

Barry

[Metallica]

Two chances. Let's try the easy one first.
They are nothing to worry about, by the way, but I'd want them gone too.

Click Start > Run type services.msc > OK
In the list of services find:
alfacleaner
Rightclick that line and choose Properties.
On the General tab Stop and set the service to disabled.
In HijackThis click Config > Misc Tools > Delete an NT service
In the dialog box paste: alfacleaner

Copy the part in bold below into notepad and save it as Appid.reg
Set Filetype to "all files"

REGEDIT4

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER]

[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER]

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER]


Reboot into safe mode and doubleclick that file and confirm you want to merge it with the registry.

Let me know if that got rid of them.

Regards,

[bphipps]

Hi Metallica

Alfacleaner did not appear in services.msc, also HJT could not find it when I tried the NT service delete. I tried the registry merge anyway but all the "legacy_alfacleaner" entries remain. I figured they were unimportant but their presence is irritating!

Thanks

Barry

[Metallica]

Bleh. They must have tampered with the permissions.
I would advise to make a System Restore Point before you continue.
Just in case anything goes wrong.

Pleased download and install RegLite from:
http://www.resplendence.com/reglite

Run the program and paste
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_ALFACLEANER
in the Address bar and click Go
Rightclick the folder symbol and choose Properties.
Check what it says under Owner.

Then click the Security tab and click Take Ownership
Close the Windows after the confirming prompt and right click the entry again.
This time choose Delete.

If that is successfull you can repeat the procedure for:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_ALFACLEANER
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_ALFACLEANER

Let me know,

[bphipps]

Thanks to your excellent help, I have succeeded in purging the evil ALFACLEANER legacy registry entries. It took a lot of messing around and I'm not exactly sure how it worked. RegLite did not give me the option to Take Ownership (greyed out) - likely because the owner (Administrator) was legitimate (??). I went back into Regedit and found that the permissions on the LEGACY_ALFACLEANER(SERVICE) keys were messed up, e.g. users were "INTERACTIVE" and "Administrators", permissions not inherited and out of sync with subkeys. I reset them to be the same as other "LEGACY" registry keys in HKLM\SYSTEM\CurrentControlSet\Enum\Root and propagated the permissions to subkeys. I had to do this for the ControlSet001 and 002 keys also. Still unable to delete within Regedit, so back into RegLite and was able to delete as long as I started from the bottom up, i.e. I had to delete the lowest subkey first, then next up until I reached the main key, e.g. LEGACY_ALFACLEANER. The order was essential, and I believe I had to take out CurrentControlSet before the others would follow. Was feeling then but now !!

Thanks again Metallica for your help!

Barry

[Metallica]

Glad I was able to point the way.

Good of you to figure it out.

Please do have a look at my site about removing and preventing spyware.

Regards,