Virus hacking email and sending spam, maxing CPU

[GeneralGeek]

I have followed the 'READ FIRST' up to the point of deleting AVG for good.

I think the virus came when I downloaded free trial software to fix a registry issue on another harddrive, when I eventually fixed the registry manually, I was left with a CPU maxing and locking up a few times an hour. Virus scans were showing nothing, but then I got complaints and loads of 'failed to deliver report' emails detailing a spam email sent from my account (nothing in sent box).

A scan found and cleared a virus after the first email problem, but it hit another account today so I really need to get it sorted.

Many Thanks

Edit: on reading some similar replies it seems I missed some aspects since I only d/l programs didn't run the logs, I shall do that now.

[chaslang]

Originally Posted by GeneralGeek

I have followed the 'READ FIRST' up to the point of deleting AVG for good.

If you want help, you need to finish the rest of the instructions up to and including the attaching of the 5 logs we asked for. But I see you realized this in your edit. Just attach them here when you finish.

[GeneralGeek]

OK! Its been a while since I've been busy with college reports and things, not been on pc too much, using phone and other pc's for emails etc but now I have done all the tests/scans.

Generally things are better with less crashing/freezing, altho there are still some occasions, logs attached.

I didn't do the root repeal because I have 64bit.

Many Thanks

[chaslang]

Your logs are pretty clean. Just do the below.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (file missing)
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll (file missing)
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\10.2.0.3\AVG Secure Search_toolbar.dll (file missing)

After clicking Fix, exit HJT.

Delete the below folder:
c:\users\Keef\AppData\Local\jtublbqp

And let's run two more scans to be safe.


Goto the below link and follow the instructions for running TDSSKiller from Kaspersky

• TDSSkiller - How to run

• Be sure to attach your log from TDSSKiller

Now please also download MBRCheck to your desktop.


See the download links under this icon

• Double click MBRCheck.exe to run (vista and Win 7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

[GeneralGeek]

Hi,

I have done the requested steps, logs attached.

[chaslang]

These last logs were clean too.



If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

[GeneralGeek]

Hi that's excellent, also no problems noting, CPU doesn't seem to be going above 50% and no crashes so far.

Many thanks for all your help!

[chaslang]

You're welcome. Glad to hear it is working okay. Surf safely!

[GeneralGeek]

Originally Posted by chaslang

You're welcome. Glad to hear it is working okay. Surf safely!

After having cleared so much I thought I was virus free and when problems came back they were unrelated, but now I'm not convinced as I've noticed quite often when I get freezes I'm typing stuff into forms such as this and that makes me suspicious there is something tracking what I'm typing.

However, I can now open google chrome which I wasn't able to do when I had the virus.

Are there any logs I could produce again for a quick check? I don't mind running all the steps again from this thread if needed.

Thanks

[chaslang]

Originally Posted by GeneralGeek

After having cleared so much I thought I was virus free and when problems came back they were unrelated, but now I'm not convinced as I've noticed quite often when I get freezes I'm typing stuff into forms such as this and that makes me suspicious there is something tracking what I'm typing.

I really don't think your problems are malware related. Your previous logs really did not show any problems; however you never attached a log from a scan with Malwarebytes as requested in the READ & RUN ME. Not that I think it would find anything of significance but you never know.

I would look more into what you are running. There are several items that I would not allow to run on my PC at startup and then also I would make sure they are shutdown when not in use. These are:

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [supertintin_msn] "C:\Program Files (x86)\Supertintin for Msn\supertintin_msn.exe" /start_context sys_auto
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKLM\..\Run: [InstaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup
O4 - HKLM\..\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files (x86)\DNA\btdna.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [OfficeSyncProcess] "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"

Especially Steam and BitTorrent DNA which can have significant affect on PC performance

Also why do you have both Acronis and Macrium running? Do you really need both of these and are backups being done while your PC is under normal use or are they performed only when you are not using your PC?