Copying Files Dialogue Ran Without My Permission

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by majinbuu, Mar 23, 2017.

  1. majinbuu

    majinbuu Specialist

    I was browsing the internet yesterday and out of nowhere a window popped up on the top left of the screen saying files were being copied (either to or from, happened too fast to tell) from the Windows/system32 folder.

    Initially I panicked and ran Adwcleaner and deleted the entries it found, which I know is what I wasn't supposed to do. After calming down I followed your guide and have attached all logs.

    Could you please tell me if I am infected with anything and also if I caused any damage by deleting the stuff from Adwcleaner that I wasn't supposed to.
     

    Attached Files:

    majinbuu, Mar 23, 2017
    #1
  2. majinbuu

    majinbuu Specialist

    MGlogs is attached here.
     

    Attached Files:

    majinbuu, Mar 23, 2017
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rerun RogueKiller and have it fix these items:

    ¤¤¤ Registry : 16 ¤¤¤
    [PUP.Gen0] (X64) HKEY_USERS\S-1-5-21-3317604687-2596612211-1087445003-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-03232017113007235\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {C55BBCD6-41AD-48AD-9953-3609C48EACC7} : -> Found
    [PUP.Gen0] (X86) HKEY_USERS\S-1-5-21-3317604687-2596612211-1087445003-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-03232017113007235\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {C55BBCD6-41AD-48AD-9953-3609C48EACC7} : -> Found
    [PUP.Gen0] (X64) HKEY_USERS\S-1-5-21-3317604687-2596612211-1087445003-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-03232017113007668\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {C55BBCD6-41AD-48AD-9953-3609C48EACC7} : -> Found
    [PUP.Gen0] (X86) HKEY_USERS\S-1-5-21-3317604687-2596612211-1087445003-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-03232017113007668\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser | {C55BBCD6-41AD-48AD-9953-3609C48EACC7} : -> Found

    ¤¤¤ Files : 1 ¤¤¤
    [Hidden.ADS][Stream] C:\Windows:A42BB95A2423B939 -> Found

    Then rerun Hitman and have it fix all it found.

    Reboot and rescan with both RogueKiller and Hitman and attach the new logs.
     
    TimW, Mar 23, 2017
    #3
  4. majinbuu

    majinbuu Specialist

    Thanks for your help. I really appreciate what you guys do here.

    I ran RogueKiller and had it fix what you told me. For the x86 registry entries it came up with Error 2.
    As for Hitman, it ran and cleaned without issue.

    I have attached the new logs.

    Also, as I stated in my initial post I stupidly deleted some stuff with AdwCleaner which you can see in AdwCleaner[C0].txt
    Do you think this will cause any problems?
     

    Attached Files:

    majinbuu, Mar 24, 2017
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You didn't do any harm with ADWCleaner. And your other logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8 or 10, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     
    TimW, Mar 24, 2017
    #5
    majinbuu likes this.
  6. majinbuu

    majinbuu Specialist

    Ok, it's all done now and everything seems fine. Thank you for your help.
     
    majinbuu, Mar 25, 2017
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.
     
    TimW, Mar 25, 2017
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds