Member Avatar for dcc

I have a friend who has a Dell computer, and recently he has been getting error messages that when I check them out at Microsoft said that he had the virus MaxDoor. Microsoft went on from there to explain how to remove it in the registry, and warns up front that this is risky. Does anyone here know about this virus and how to get rid of it?

  • 2 Contributors
  • 5 Replies
  • 231 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

This thread is about the HaxDoor backdoor (the original "MaxDoor" typo by is a common mix-up). HaxDoor-class trojans generally provide remote-control access, install persistent autoruns/services, and can drop additional components that survive a single registry edit. Because of that persistence and the risk of damaging the system, a registry-only fix is often insufficient; a measured diagnostic-first approach is safer.

Valuable diagnostics to collect before making irreversible changes include: listening network ports tied to PIDs, running processes and their services, scheduled tasks, startup/autostart entries, recent executable modifications under system folders, and the hosts file. Useful Windows commands for gathering these quickly:

netstat -ano | findstr LISTEN
tasklist /svc
schtasks /query /fo LIST /v

Those outputs help map network activity back to a process or service and reveal unusual listeners.

Containment and cleanup options: isolate the PC from networks immediately; obtain a full image or backup (so the system can be analyzed or restored if needed); run updated signature and heuristic scanners from a clean, offline rescue environment where possible; remove identified malicious files and disable malicious services only after confirming their identity; back up the registry before edits. If persistence mechanisms remain or the machine handled sensitive accounts, a full wipe and reinstall is the most reliable assurance that the backdoor is gone. After remediation, all credentials used on the machine should be changed and the OS/applications fully patched.

For third-party help, include the OS/version, installed security products, the raw diagnostic outputs (HijackThis/EWIDO logs were suggested earlier by ), and the netstat/process listings. Redacting personal PII is reasonable, but responders generally need unedited diagnostic data to confirm HaxDoor indicators.

Recommended Answers

All 5 Replies

Member Avatar for crunchie

Never heard of it until now. Sure you do not mean Haxdoor?

Member Avatar for dcc

Hey crunchie...yeah, gotta do something about the danged dyslexia. Yes I was reffering to HaxDoor, htakns. :o

Member Avatar for crunchie

Download HijackThis self-extracting zip version from here. Once downloaded, double click on the file & it will install into it's own, permanent folder.
Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you the option of where to save it. Save it to desktop where it is easy to access. Open the log file and copy the entire contents of the file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

==

Please download the trial version of Ewido Security Suite here:

Install it, and update the definitions to the newest files. Do NOT run a scan yet.
Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.com/support/safemode.shtml

Once in Safe Mode, please run Ewido, and do a full scan. During the scan it will prompt you to clean files, click OK.

Save the logfile from the scan. Restart your computer in normal mode and please post an HijackThis log, as well as the log from the Ewido scan.

Member Avatar for dcc

Thanks crunchie...I will do as you have instructed and post the results, but I won't be able to get to the other computer until next week.
Can you tell me anything about this virus?

Member Avatar for crunchie

Here is a good tutorial to save me rehashing the info :).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.