Malicious Program in Startup Menu

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Salama07, Aug 25, 2012.

  1. Salama07

    Salama07 Private E-2

    Hello,

    I desperately need some help with a pesky trojan (? I'm guessing) that keeps re-inserting itself into my Startup menu. Every time I turn my computer on, I get a prompt from the UAC asking if I want a program called Registry Console Tool to make changes to my computer. The "verified publisher" of this Tool is supposedly Microsoft but I have serious doubts about this. If I say no, the program keeps prompting me continually until I say yes and allow it to make changes to the PC. I literally cannot do anything on my computer until I say yes. Once I say yes, the program automatically turns off my UAC (i.e. - resets it to the level "never notify"). I've tried everything to remove this thing - MalwareBytes Anti-Malware, Super Anti-Spyware, Spybot Search & Destroy, Microsoft Security Essentials...you name it, but nothing's working. Spybot keeps finding 8 trojans on my Registry keys but it cannot remove them because they are "currently using memory".

    I've gone into my Startup menu and unchecked the suspicious program but it keeps on making new entries and reinserting itself into the menu with new names. It's driving me nuts!!!

    I would really appreciate any help I can get with this.
     
    Salama07, Aug 25, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Aug 26, 2012
    #2
  3. Salama07

    Salama07 Private E-2

    Thanks TimW!

    I've run all the scans as directed but unfortunately, the malware is still on my PC (in my startup menu). As I mentioned above, it usually activates as soon as I turn my computer on and then forces me to allow it to turn off my UAC but since my UAC was off anyway (as instructed, I turned it off to run the scans) it did not prompt. It's still very much on my system though. I'm attaching all my scan logs below...(Note: my MBAM log is from 4 days ago. I didn't run MBAM today because it takes forever to scan AND I've actually run 3 separate full scans since my system became infected and it never found anything).
     

    Attached Files:

    Salama07, Aug 26, 2012
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there. Could you please also attach the MGlogs.zip from running MGTools.exe please? Then TimW can give you a complete fix. :)
     
    Kestrel13!, Aug 26, 2012
    #4
  5. Salama07

    Salama07 Private E-2

    Oops...here's the MGTools log.
     

    Attached Files:

    Salama07, Aug 26, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:

    • [RUN][SUSP PATH] HKCU\[...]\Run : KhcjjyT (c:\ProgramData\FbnmjuS\MthqfdI\KhcjjyT.exe) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : TcyjnaQ (c:\ProgramData\YjkpciR\CyootiD\TcyjnaQ.exe) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : HsoxliO (c:\ProgramData\HmbmvcP\PflufxY\HsoxliO.exe) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : YyirowJ (c:\ProgramData\GpxqtsA\TistjbL\YyirowJ.exe) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-2060303320-3278574050-2509588749-1001[...]\Run : KhcjjyT (c:\ProgramData\FbnmjuS\MthqfdI\KhcjjyT.exe) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-2060303320-3278574050-2509588749-1001[...]\Run : TcyjnaQ (c:\ProgramData\YjkpciR\CyootiD\TcyjnaQ.exe) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-2060303320-3278574050-2509588749-1001[...]\Run : HsoxliO (c:\ProgramData\HmbmvcP\PflufxY\HsoxliO.exe) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-2060303320-3278574050-2509588749-1001[...]\Run : YyirowJ (c:\ProgramData\GpxqtsA\TistjbL\YyirowJ.exe) -> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now click the Files/folders tab and locate these detections:

    • C:\ProgramData\3afukwQBGh.exe
      C:\ProgramData\3afukwQBGh.exe.bmp
      C:\ProgramData\FbnmjuS
      C:\ProgramData\GpxqtsA
      C:\ProgramData\HmbmvcP
      C:\ProgramData\listaloca
      C:\ProgramData\listone
      C:\ProgramData\RtsvevO
      C:\ProgramData\sdr.bmp
      C:\ProgramData\WvwcnoX
      C:\ProgramData\YjkpciR
      c:\ProgramData\RtsvevO\QwxeesT\GrysiuW.exe
      c:\ProgramData\WvwcnoX\XjpnboR\HplpshA.exe
      c:\ProgramData\RtsvevO
      c:\ProgramData\WvwcnoX
      c:\ProgramData\FbnmjuS

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    If those file are not detected:

    Download OTL to your desktop.
    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
:killallprocesses
:files
C:\ProgramData\3afukwQBGh.exe
C:\ProgramData\3afukwQBGh.exe.bmp
C:\ProgramData\FbnmjuS
C:\ProgramData\GpxqtsA
C:\ProgramData\HmbmvcP
C:\ProgramData\listaloca
C:\ProgramData\listone
C:\ProgramData\RtsvevO
C:\ProgramData\sdr.bmp
C:\ProgramData\WvwcnoX
C:\ProgramData\YjkpciR
c:\ProgramData\RtsvevO\QwxeesT\GrysiuW.exe
c:\ProgramData\WvwcnoX\XjpnboR\HplpshA.exe
c:\ProgramData\RtsvevO
c:\ProgramData\WvwcnoX
c:\ProgramData\FbnmjuS
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.



    Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now reboot and re-run RogueKiller and attach the log.

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    * OTL log
    * Roguekiller log
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    Last edited: Aug 27, 2012
    TimW, Aug 27, 2012
    #6
  7. Salama07

    Salama07 Private E-2

    Hi TimW,

    I've attached the logs you requested. When I first ran RogueKiller, the Registry tab showed that it had detected the suspicious paths but the Files/Folders tab didn't have anything in it. I just went ahead and deleted the suspicious results in the Registry tab. The registry merge process (REGEDIT4) was successful and so far things are running pretty smoothly on my system. At the last reboot, the malware didn't try and turn off my UAC so I assume it's been deleted. Thanks for your help! I'll be sure to let you know if it shows up again over the following days.
     

    Attached Files:

    Salama07, Aug 27, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks good.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Aug 28, 2012
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds