I think I have some sort of virus/spyware

hdhock3y · Jun 18, 2013

Last week, my computer had a full screen pop-up take over the computer saying that my browser couldn't display the page. It was as if I had entered Firefox into full-screen mode but I couldn't enter task manager. I realized it wasn't actually that, and some sort of spyware taking over my computer. However, if I tried to shut down the computer it forced that task to close and if I quickly stopped the shut down I was able to at least do a virus scan and remove something, but it was definitely still in my system.

I tried to boot into safemode to run malwarebytes to fully remove, but my computer got stuck in an infinite loop entering safemode and then just shutting down. I was forced to do a repair which did a system restore. I was able to boot into safemode and do a scan, but I think the problem is still here.

Logs are attached, thanks for your help I appreciate it!

Kestrel13! · Jun 18, 2013

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the file/folder tab and locate these 2 detections:

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$6e9f4be4967e07ce73d47086f6b13ad5\n. [x]) -> FOUND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$6e9f4be4967e07ce73d47086f6b13ad5\n. [x]) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run TDSSKiller, just a scan and attach the new log please.

Re run Hitman and have it delete Malware remnants, and Potential Unwanted Programs.

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now!

hdhock3y · Jun 19, 2013

I re-ran RogueKiller and deleted those two infections. Also re-ran TDSSKiller for the log and then Hitman to delete those things. Logs are all attached to this post.

I ran the Windows Repair following the settings and seemed to complete fine, and then the restart took forever. It took forever to both shut down and then it sat at the Welcome screen for a good minute. My computer finally came back to just a black screen and a mouse.

I restarted my computer again to the same results. I have to manually start explorer.exe from the task manager. It seems like a lot services are now unable to start, and I can't access the internet. The firewall will not start either

I did re-run MGtools afterwards though, that log is now attached too.

Thanks for taking the time to help me out.

Kestrel13! · Jun 19, 2013

Once again, let's run RogueKiller and Hitman, just scans and attach logs from each, please.

hdhock3y · Jun 20, 2013

Ran them both, logs are attached. For some reason when I started my computer up this time my services seemed to be working and even my firewall is turned on :confused

Thanks again for your help.

Kestrel13! · Jun 21, 2013

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

chaslang · Jun 21, 2013

Just an FYI for Kestrel13!: I'm sure you noticed them already but I figured I would mention the below observed in the previous MGlogs.zip

Code:

   Dynamic Host Control Protocol -DHCP-     is NOT running  
   Base Filtering Service               is NOT running  
   Windows Firewall Service is NOT running  
   Windows Firewall Authorization Driver Service is NOT running  


    ----------------------------------------------------------------------------
       **** ERROR: The below registry key is missing and should not be: ****    
            "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WINDEFEND"                                                               
    ----------------------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Enum]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Parameters]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Security]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE\Parameters]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo]
"Collection"=hex:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Security]

Kestrel13! · Jun 22, 2013

Download Dhcp.reg to your desktop.

Now please click Start, and type regedit into the search box.

You should see a regedit.exe and icon appear in the Programs area of the Start Menu.

Right click on regedit.exe and select Run As Administrator

Then in the Registry Editor menu click File and select Import.

Navigate to the Dhcp.reg file saved to your Desktop and double click it. Allow it to be added to the registry.

Reboot.

Run the Windows Repair Tool again please.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

hdhock3y · Jun 24, 2013

I ran MGTools before doing all this. Then I added Dhcp.reg to the registry rebooted my computer. I ran the Windows Repair and let it complete, and then I re-ran MGTools again. I have attached both of those results to this post.

Kestrel13! · Jun 25, 2013

Download BITS.reg to your desktop.

Now please click Start, and type regedit into the search box.

You should see a regedit.exe and icon appear in the Programs area of the Start Menu.

Right click on regedit.exe and select Run As Administrator

Then in the Registry Editor menu click File and select Import.

Navigate to the BITS.reg file saved to your Desktop and double click it. Allow it to be added to the registry.

Reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this.

hdhock3y · Jul 1, 2013

Successfully added to the registry and restarted, new logs are attached.

Kestrel13! · Jul 1, 2013

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

hdhock3y · Jul 28, 2013

Sorry for my super late reply, I was on vacation at the beginning of July and completely forgot about this!

I've removed and cleaned everything up now. I still have MBAM installed though as you recommended. I disabled my system restore point, rebooted, and then re-enabled and created a clean restore point. Everything seems to be running perfect now, nothing odd!

I just want to say thank you very much for all your help, I really appreciate it.

Kestrel13! · Jul 29, 2013

You are most welcome. Safe surfing!

Log in or Sign up

I think I have some sort of virus/spyware

hdhock3y Private E-2

Attached Files:

RKreport[0]_S_06182013_183818.txt

mbam-log-2013-06-18 (18-48-09).txt

TDSSKiller.2.8.16.0_18.06.2013_18.52.21_log.txt

HitmanPro_20130618_1904.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

TDSSKiller.2.8.16.0_19.06.2013_17.19.37_log.txt

RKreport[0]_D_06192013_171731.txt

HitmanPro_20130619_1724.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

RKreport[0]_S_06202013_171139.txt

HitmanPro_20130620_1714.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

MGlogs first.zip

MGlog second.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

I think I have some sort of virus/spyware

hdhock3y Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hdhock3y Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches