Software Referral Malware Virus

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Bixo, Jul 9, 2008.

  1. Bixo

    Bixo Private E-2

    Hello,
    While trying to dowload an AVI codec I accidentaly downloaded this Malware virus to my computer. It is the Software Referral virus which I'm sure you're all familiar with (as I've seen similar threads on this forum).

    While I was doing the step by step manual, as described in the Read & RUN ME RIRST thread, a new problem occured.

    When I was done running a Super Anti Spyware scan I couldn't boot back to normal Windows mode anymore.
    It gave me a blue screen and I had to boot into save mode (in which I am right now).
    I tried unchecking the Kernal options in the Scanner options tab as well but no luck :(

    Sorry that I can't post any log files I as I have nothing to post. I didn't even get past the first step.

    So basically m problems right now are:
    - Trying to do a proper Super Anti Spyware scan without getting a blue screen.
    - Trying to get rid of the Malware virus.

    Thanks in advance for helping.
     
    Bixo, Jul 9, 2008
    #1
  2. Bixo

    Bixo Private E-2

    Alright I was able to get the log files from Super AntiSpyware, Malwarebytes Anti Malware and MGtools.
    I've uploaded them (check the attachments)

    For some reason I can't run the Combofix.exe
    I've renamed it as described in the Read Me thread but I get an error when I try to run it saying that it isn't accesible.

    Please note that I am still running and posting all this in Windows save mode as I still can't get into normal mode without getting a blue screen which prompts me back to save mode.
     

    Attached Files:

    Bixo, Jul 9, 2008
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please disable all anti-virus and anti-spyware programs while we do the following:

    Right click your desktop / properties / desktop / customize / web ---make sure there is nothing checked there.

    Run C:\MGtools\analyse.exe by double clicking on it(Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Now download The Avenger by Swandog469, and save it to your Desktop.
    * Extract avenger.exe from the Zip file and save it to your desktop
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

    Now Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

    * Double-click ATF-Cleaner.exe to run the program.
    * Under Main choose: Select All
    * Click the Empty Selected button.

    If you use Firefox browser

    * Click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    * Click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main ATF Cleaner menu to close the program.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.
     
    TimW, Jul 9, 2008
    #3
  4. Bixo

    Bixo Private E-2

    Thanks Tim, I'll try all that when I get back from holiday in about a week.
    I'll let you know if it worked out alright.
    Thanks again!
     
    Bixo, Jul 10, 2008
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Attach the logs when you get the chance. :)
     
    TimW, Jul 10, 2008
    #5
  6. Bixo

    Bixo Private E-2

    I have attached the logfiles in this post.
    I ran the MGtools.exe and the whole malware problem seems to have disappeared.
    If this is the case, than thanks heaps! :)
     

    Attached Files:

    Bixo, Jul 16, 2008
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Still more to remove ....did you reset the web settings in the desktop properties as I asked you to do in the last fix? This is still showing: O24 - Desktop Component 0: Privacy Protection - (no file)

    What is this in your add/remove programs : run4j

    Please disable all anti-virus and anti-spyware programs while we do the following:

    Run C:\MGtools\analyse.exe by double clicking on it(Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    * Run avenger.exe by double-clicking on it.
    * Do not change any check box options!!
    * Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

    * Now click the Execute button.
    * Click Yes to the prompt to confirm you want to execute.
    * Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    * Your PC should reboot, if not, reboot it yourself.
    * A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.
     
    TimW, Jul 16, 2008
    #7
  8. Bixo

    Bixo Private E-2

    I did everything you said as described in your previous post.
    That run4j thingy is something I made myself while trying to create my own .exe files a while back. It's really nothing to worry about.
    I did another scan as you requested.
    The log files are attached.
     

    Attached Files:

    Bixo, Jul 19, 2008
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you remove the web setting in your desktop properties? It still shows in the HJT log.

    Please use windows explorer to find and delete:
    C:\WINDOWS\system32\mcrh.tmp

    Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

    NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

    * Double-click ATF-Cleaner.exe to run the program.
    * Under Main choose: Select All
    * Click the Empty Selected button.

    If you use Firefox browser

    * Click Firefox at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    If you use Opera browser

    * Click Opera at the top and choose: Select All
    * Click the Empty Selected button.
    o NOTE: If you would like to keep your saved passwords, please click No at the prompt.

    Click Exit on the Main ATF Cleaner menu to close the program.

    Now tell me if you are having any other problems.
     
    TimW, Jul 19, 2008
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds