Malware Cleaning And Maintenance.

Angelus21 · Feb 11, 2016

Hello all,

I'm working on my friend's PC and figured I would do some possible malware scanning and removal. I've followed the instructions in the "READ and RUN me" thread. Unfortunately I did run into a snag with the Hitman Pro program.

I followed all instructions with it and the program did find about 450 issues and I promptly ignored all as was instructed. Unfortunately whenever I clicked on the "Save log" link, nothing. I could click on that sucker 10 times over and nothing. I ran the scan about 2 more times following the instructions and same result, couldn't save log. I rebooted thinking that might be it, but it ended with the same result of the "Save log" link doing nothing when clicked.

Other than that issue I was able to run all other programs and logs without issue. I've attached the logs below. Looking forward to working with you as you've always been a great help in the past.

Ian

Kestrel13! · Feb 12, 2016

With Hitman Pro, and what it is finding.... does it all look like junk to you? Are there any valid programs in what it's finding? Let me know. Take screenshots, that would be useful.

Angelus21 · Feb 13, 2016

Hello, I didn't think to take screenshots so I ran the scan again and took screenshots of everything it found in descending order. There seems to be 1 file that looks like a remnant of a program and the rest seem to look like registry keys. Like I've said I've included all items with the screenshots I took. Sorry for there being so many but I wanted to be thorough so you'd have the best picture possible.

Ian

Kestrel13! · Feb 13, 2016

Thanks for attaching all those screenshots, I know it must have been a nuisance to do, I really appreciate it though. You can re run Hitman, activate the free trial if it's not been used before, and have it remove all of the junk it finds.Once done, reboot the machine and then rescan with Hitman again, if it finds anything again let me know.

I have to ask... are you deliberately set up to use a proxy?

Angelus21 · Feb 14, 2016

Alright so I did as you instructed, rebooted and ran Hitman Pro again. The scan came back "clean" or rather with no threats/issues.

As per your second question could you perhaps elaborate a little on that. Again this is my friend's computer and I'm just helping him update it and clean it up. It's a store bought ASUS laptop so if there's perhaps any settings that I could change for the better such as this proxy issue then I'm all ears.

Ian

Kestrel13! · Feb 14, 2016

You need to ask your friend whether he uses a proxy or not.

Proxy server is a computer that offers a computer network service to allow clients to make indirect network connections to other network services.
Click to expand...

Angelus21 · Feb 14, 2016

Alright I'll follow up with him when I see him next. In terms of malware and the like however, are there any more steps I should be following? Or is it safe to continue on with the RUN and READ me thread with turning UAC back on and such.

Kestrel13! · Feb 14, 2016

Just leave the machine switched off until you see your friend.

Angelus21 · Feb 15, 2016

Alright so I talked to my friend. Forgot to mention that he's quite computer illiterate so I have to break it down for him. After explaining the proxy issue I checked within Windows and the internet settings aren't on a proxy, set to detect automatically. Furthermore I won't be able to check his router as A) it's issued by his ISP and B) he's moving next week and will be returning said router since he'll be going with a different ISP do to geographical bullshit that ISP's love to play.

Any further guidance?

Ian

Kestrel13! · Feb 15, 2016

Hi Ian,

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Tarma Installer -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\MyWebSearch -> Found

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found

[PUM.Proxy] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49948;https=127.0.0.1:49948 -> Found

[PUM.Proxy] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49948;https=127.0.0.1:49948 -> Found

[PUM.Proxy] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49948;https=127.0.0.1:49948 -> Found

[PUM.Proxy] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:49948;https=127.0.0.1:49948 -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...Same for this item on the Tasks tab...

[Suspicious.Path] \4704 -- wscript.exe (C:\Users\Owner\AppData\Local\Temp\launchie.vbs //B) -> Found

...Same for these on the Files tab...

[PUP][Folder] C:\Program Files\Babylon -> Found

[PUP][Folder] C:\Program Files (x86)\Conduit -> Found

[PUP][Folder] C:\Program Files (x86)\fbDownloader -> Found

[PUP][Folder] C:\Program Files (x86)\SDIV 2.0 -> Found

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SpUninstallDeleteDir"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{000E1111-F332-12DB-84A4-B811200B9A66}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{01FDC335-A4A1-4B47-A844-E3BA7F1A8D6A}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{52D6F36B-6FE4-4B47-8AC4-02F2AF9DCF93}]
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Re scan with RogueKiller (just a scan) and upload new log.

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: Make sure you download the correct version for your PC. Only the correct version will work.

Double-click to run it. When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.

The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Angelus21 · Feb 15, 2016

Alright so I ran RogueKiller and let the scan finish. There were a few snags though in that a few items that you listed were not found in the scan results.

Under the Registry tab the following were not present

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Conduit -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\MyWebSearch -> Found

Under the files tab the following were not present

[PUP][Folder] C:\Program Files\Babylon -> Found

[PUP][Folder] C:\Program Files (x86)\Conduit -> Found

Other than those items I deleted all others as instructed and rebooted the machine. I then saved the registry code like you said and was able to successfully install it. I then ran another scan with RogueKiller and procured a log. Following that I downloaded the next program, ran the scan and obtained the two logs. All of them should be attached. Again thanks for your help thus far and your continued help.

Ian

Kestrel13! · Feb 16, 2016

I would like for Avast to be uninstalled before this fix runs, it can often get in the way of one being inplemented properly.

NOTE: This script was written specifically for this user for use on this particular computer. Running this on another machine may cause damage to your operating system.
Download Fixlist.txt

Save fixlist.txt on your Desktop. Make sure you save it as a txt file.

You should now have both fixlist.txt and FRST64.exe on your Desktop.

Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).

Run FRST64.exe by right clicking on it and selecting Run As Adminstrator

Click the Fix button just once and wait.

Your computer should reboot after the fix runs.

Reconnect your internet connection after reboot so you can come back here to continue.

The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

Fixlog.txt

C:\MGlogs.zip

Please attach the above two log first before you continue with the below.
Also at this point, I want to double check the status of things by having you run another scan with FRST like in my last message and attach the new FRST.txt

Angelus21 · Feb 16, 2016

Alright so I uninstalled Avast like you asked and downloaded the fixlist.txt file. After that I disabled the wireless card and made sure I had no internet access. Following that I ran the FRST program as instructed and rebooted when it was done. Re-enabled the wireless card and ran the MGtools utility, both logs should be attached.

To make sure I'm following you instructions correctly you want to look at these 2 logs BEFORE I run the FRST program again for a new log correct? If not I can easily run the program and add another post with that log for you.

Kestrel13! · Feb 16, 2016

Go ahead and continue on Run FRST like you did in post #10

Angelus21 · Feb 16, 2016

Gotcha, here's the log.

Kestrel13! · Feb 16, 2016

Re run RogueKiller please and upload new log. (I have to go to bed now)

Angelus21 · Feb 17, 2016

Here's the new RogueKiller log, hope you got some good sleep.

Kestrel13! · Feb 17, 2016

Good morning. I sure did sleep well. Hope you did too.
OK how is the machine running?

Angelus21 · Feb 17, 2016

It's running pretty well so far, a little snappier than before. I've also noticed that an oddball toolbar is gone from Google Chrome which is good as I thought it was quite suspect looking to begin with. If there's anything in specific that you would like me to look for let me know and I'll look for it when I get back from class tonight.

Kestrel13! · Feb 18, 2016

Very good. I am happy now that those proxy entries have been removed and stayed removed.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Angelus21 · Feb 18, 2016

Sounds great and thanks again for all the help. You guys at this site have always been a great help when it comes to cleaning up any malware on computers, whether mine or other people's, that I've worked on. Have a great day.

Ian

Kestrel13! · Feb 18, 2016

You are most welcome.

Malware Cleaning And Maintenance.

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Angelus21 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches