Virus With Foreign Characters

RoadRunner1 · Jan 19, 2016

Hi,

About two weeks ago a friend tried downloading a PS3 computer version. After that my browser homepage was hijacked with Chinese characters. I was able to reset my browser homepage and Super Anti Spyware detected some a PUP and Trojan that were removed. I have Kaspersky Anti Virus and the first things detected were Trojan-Downloader.Win32.Upatre.fniz & UDS: DangerousObjectMulti.Generic (all in Temp Folders). I still have some files with Chinese characters (C:/Windows/Installer) and I have not been able to run Malware Bytes Anti Malware regardless of how many times I've installed and removed it, not even in Safe Mode. The latest error message is 'SDK Database Load Defaults failed 1812'. It also says that the Threat Scan was completed successfully but when I save the results the log is blank and the requested log is not in the History tab. Other times it says that the Threat Scan was cancelled. At this point I'm at my wits end and would prefer disinfecting the computer without having to reinstall Windows 7. I have prior Hitman Pro and TDSS logs available, if needed. At this time I've attached the logs I ran today. Your assistance is greatly appreciated.

Kestrel13! · Jan 19, 2016

Hi there and welcome, RoadRunner1,

I am currently reviewing your logs and will get back to you with a response very soon.

Kestrel13! · Jan 19, 2016

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Tencent -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\.QMDeskTopGCIcon | (default) : {B7667919-3765-4815-A66D-98A09BE662D6} -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...and the same for this entry on the files tab please....

[PUP][Folder] C:\ProgramData\{c56332c3-6d26-0c13-c563-332c36d2cb0d} -> Found

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).

Paste the following code under the area. Do not include the word Code.
Code:
:Files
C:\Users\Arbi\AppData\Local\Temp\{2B7C5F6C-85DB-49FE-AFC4-950A4F5C5589}\{9768AEEB-B562-4C84-AE03-2FCA799A173C}.exe
C:\Windows\system32\tasks\{33E77B4B-CC9E-404E-BE35-28F75CAB7B35}
C:\Windows\system32\tasks\{451EA596-14DA-4552-9C48-C78C51C8F055}
C:\Windows\system32\tasks\{51BBE6D2-A5D7-473B-B080-80D722EBE022}
C:\Windows\system32\tasks\{52BB2F22-45AF-4CBE-8580-EDC93546F401}
C:\Windows\system32\tasks\{54904343-6A20-4884-889D-35F9132B3A20}
C:\Windows\system32\tasks\{8387F66A-C4F6-40E4-8657-D3C02F177BEC}
C:\Windows\system32\tasks\{9D5C86E3-7EB9-4F5A-B0FE-9C1408E01DF9}
C:\Windows\system32\tasks\{B113D15B-B75F-4306-9C0C-67D5F5DC19F0}
C:\Windows\system32\tasks\{C9447259-6DF5-48FD-995A-B76D8A146FB3}
C:\Windows\system32\tasks\{CDFFDB50-E574-49E5-9131-874093416171}
C:\Windows\system32\tasks\{D1DB67BE-6436-4B8C-B594-3D1A64881EC4}
C:\Windows\system32\tasks\{F3F42272-D0DE-4FC8-8289-66937E1855C6}
:Commands
[emptytemp]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Push the large button.

OTM may ask to reboot the machine. Please do so if asked.

Copy everything in the Results window (under the green bar), and paste it into a text file to ATTACH into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

Download>>> Cleano 1.31

Download it to your desktop, Right click the cleano.exe file and run as admin > and place check marks in the boxes as follows (click on link below to see image)

View attachment 148092
Click clean now and exit the program.

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: Make sure you download the correct version for your PC. Only the correct version will work.

Double-click to run it. When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.

The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

When you rescan with Malware Bytes does it find anything?

How are things running now?

RoadRunner1 · Jan 19, 2016

Hi. Thanks for your reply. Please see the attached logs. Malware Bytes Anti Malware still does not complete a scan. I ran it right after Farbar Recovery and received the message 'SDK Database Load Default Error 1812'. I rebooted and then received an error messaging stating that the program had to close. Should I uninstall and try again?

Kestrel13! · Jan 20, 2016

Sorry, forgot to ask you to do this as well.... Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Also re run RogueKiller yet again (just a scan) and attach log please.

RoadRunner1 · Jan 20, 2016

NP. Here they are.

Kestrel13! · Jan 20, 2016

Uninstall Malware Bytes using >>> Revo Uninstaller. It might do a much more thorough job.

NOTE: This script was written specifically for this user for use on this particular computer. Running this on another machine may cause damage to your operating system.
Download Fixlist.txt

Save fixlist.txt on your Desktop. Make sure you save it as a txt file.

You should now have both fixlist.txt and FRST64.exe on your Desktop.

Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).

Run FRST64.exe by right clicking on it and selecting Run As Adminstrator

Click the Fix button just once and wait.

Your computer should reboot after the fix runs.

Reconnect your internet connection after reboot so you can come back here to continue.

The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

Fixlog.txt

MgLogs.zip

Explain how things are running.

RoadRunner1 · Jan 20, 2016

Sorry, but where do I download fixlist.txt?

Kestrel13! · Jan 21, 2016

My apologies Here you go.

RoadRunner1 · Jan 21, 2016

Thank you for your help thus far. Still at the same crossroad. I rebooted the computer after running the MG Tools' .bat file and proceeded to download Malware Bytes from this site. I ran it as administrator, with and without Kaspersky protection enabled and still get error message SDK Database Load Defaults failed with code 1812. Please see the attached logs.

Could you break down for me what malware is on my computer? How exposed my computer is? Why won't Malware Bytes run?

Kestrel13! · Jan 21, 2016

RoadRunner1 said: ↑

Why won't Malware Bytes run?
Click to expand...

Try this https://www.malwarebytes.org/chameleon/ Let me know how you get on.

Malwarebytes Chameleon technologies gets Malwarebytes Anti-Malware installed and running when blocked by malicious programs.
Click to expand...

chaslang · Jan 21, 2016

RoadRunner1 said: ↑

I ran it as administrator, with and without Kaspersky protection enabled and still get error message SDK Database Load Defaults failed with code 1812.
Click to expand...

More than likely this is not a malware problem. See the below:

https://support.malwarebytes.org/cu...an-sdk-databaseload-defaults-error-?b_id=6400

RoadRunner1 · Jan 21, 2016

I tried Chameleon and received the same error message. The scans never get past the Pre-Scan. I also followed the link to resolve the error and I don't have any scheduled scans. I however unchecked the indicated box under 'Updates'. Still the scan does not complete. It either says 'Threat Scan Completed Successfully' or 'Threat Scan Cancelled'.

Now, are you saying that the latest logs indicate that my computer is clean? There is no malware?

Kestrel13! · Jan 23, 2016

Yes the logs are clean. Did you read the link Chaslang posted?

RoadRunner1 · Jan 24, 2016

Hi! Yes, I read Chaslang's post and I had already unchecked the 'Update' box prior to running Malware Bytes.

I reran the first attached scans again and found some concerning items in RougeKiller under Registry, Tasks, & especially FILES. Could you please look at the attachments? I only ran the scans, no changes were executed.

Also, what malware did I encounter?

Thank you for your assistance.

Kestrel13! · Jan 25, 2016

What RogueKiller is finding is related to Roxio I believe
I wasn't really seeing any malware... just some junk really.
Those logs are also clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Virus With Foreign Characters

RoadRunner1 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RoadRunner1 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RoadRunner1 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RoadRunner1 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

RoadRunner1 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

RoadRunner1 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

RoadRunner1 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches