Avira Pop-ups "TR/ATRAPS.Gen2

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by tantram61, Aug 2, 2012.

  1. tantram61

    tantram61 Private E-2

    Have looked through the threads and found what appears to be the same problem - "TR/ATRAPS.Gen2".

    I have followed the Redirect and Malware guides and still have the issue with Avira popping up - finding the above virus.

    Also the virus' detected were as follows from Avira:
    Object Detection
    services.exe W32/Patched.UA
    80000064.@ TR/ATRAPS.Gen2
     

    Attached Files:

  2. tantram61

    tantram61 Private E-2

    Additional files
     

    Attached Files:

  3. thisisu

    thisisu Malware Consultant

    Hello tantram61 :)

    [​IMG] Delete items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Once the scan is complete, go to the Registry tab and checkmark everything except the below items:
    • [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0)
    • [HJ] HKLM\[...]\System : EnableLUA (0)
    Now press the Delete button.
    When it is finished, there should be a couple of new RogueKiller logs on your desktop.
    Attach the latest one to your next message. (How to attach)

    __

    [​IMG] - Rescan with HitmanPro

    This time if the below detections are found, choose the action I've listed below:
    • services.exe - Virus ==> Replace
    • Desktop.ini - Trojan ==> Delete
    Ignore any other detections and click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    __

    [​IMG] Once you are back in Windows, run another scan with HitmanPro and then attach the latest hitmanpro log. (How to attach)

    __

    Completely delete these two folders manually using Windows Explorer:

    • c:\windows\installer\{92fa28bf-84db-e36c-4a5c-94c008f958a7}
    • c:\users\nelida antram\appdata\local\{92fa28bf-84db-e36c-4a5c-94c008f958a7}

    Let me know if you were successful or not.
     
  4. tantram61

    tantram61 Private E-2

    I was able to run everything and I have attached the files. I don't have Avira popping up with virus finds - so I am keeping my fingers crossed. If Avira doesn't find any thing for the rest of the day I will let you know!
     

    Attached Files:

  5. thisisu

    thisisu Malware Consultant

    Hi,

    I'd like to review the RogueKiller log that you pressed Delete with.
    The one you attached is just another scan (with the infections present).

    Also run this scan using this tool:

    [​IMG] Please download OTL by OldTimer.

    • Save it to your desktop.
    • Right mouse click on the OTL icon on your desktop and select Run as Administrator
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
      Code:
      activex
      netsvcs
      /md5start
      services.exe
      /md5stop
      
    • Now click the [​IMG] button.
    • One report will be created:
      • OTL.txt <-- Will be opened
    • Attach OTL.txt to your next message. (How to attach)
     
  6. tantram61

    tantram61 Private E-2

    The fixes seem to be working. Sorry I couldn't respond sooner - I work a weird schedule.

    I have attached the files for roguekiller and OTL.

    Thanks
     

    Attached Files:

  7. thisisu

    thisisu Malware Consultant

    [​IMG] From Programs and Features (via Control Panel), please uninstall the below:
    • Java(TM) 6 Update 31 (outdated)

    __

    [​IMG] Fix items using OTL by OldTimer

    Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    [COLOR="DarkRed"]:otl[/COLOR]
    IE - HKLM\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found
    IE - HKLM\..\SearchScopes\{38bc6857-67fa-4358-afae-28e0f9ad2128}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YXxdm002CVus&ptnrS=YXxdm002CVus&si=CO2Pu__9irECFc3MKgodrGG61Q&ptb=C8773B29-0972-4E5B-9A7F-1824C59AB753&ind=2012070817&n=77edc3a1&psa=&st=sb&searchfor={searchTerms}
    IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1320680
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No CLSID value found
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\URLSearchHook: {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\SearchScopes\{38bc6857-67fa-4358-afae-28e0f9ad2128}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YXxdm002CVus&ptnrS=YXxdm002CVus&si=CO2Pu__9irECFc3MKgodrGG61Q&ptb=C8773B29-0972-4E5B-9A7F-1824C59AB753&ind=2012070817&n=77edc3a1&psa=&st=sb&searchfor={searchTerms}
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\SearchScopes\{435065FA-F736-4396-AC7F-EF3758518CE8}: "URL" = http://delicious.com/search?p={searchTerms}
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1320680
    IE - HKU\S-1-5-21-2013776147-152033503-3419086030-1000\..\SearchScopes\{D414A51F-550E-4B6D-9B97-B4AC4A9D6E25}: "URL" = http://www.fastbrowsersearch.com/results/results.aspx?q={searchTerms}&c=web&s=DSP&v=19&tid={6FADC9B6-EB47-4dfa-8A1F-98336031D00C}
    FF - prefs.js..browser.search.defaultthis.engineName: "Free Ride Games Customized Web Search"
    FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1320680&SearchSource=3&q={searchTerms}"
    FF - prefs.js..browser.search.selectedEngine: "Free Ride Games Customized Web Search"
    FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT1320680&SearchSource=13"
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
    FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1320680&q="
    [2012/07/02 09:23:02 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Nelida Antram\AppData\Roaming\Mozilla\Firefox\Profiles\jfh2te6h.default\extensions\plugin@yontoo.com
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
    O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - {f92a9fe4-2850-4198-b9d5-279880e49b16} - No CLSID value found.
    O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
    [2012/07/27 09:35:50 | 000,000,000 | -HSD | C] -- C:\windows\SysWow64\%APPDATA%
    @Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:E2B0AAB4
    [COLOR="DarkRed"]:files[/COLOR]
    dir /s "C:\Users\Nelida Antram\AppData\Roaming\xsecva" /c
    C:\Users\Nelida Antram\AppData\Roaming\xsecva
    dir /s "C:\Users\Nelida Antram\AppData\Roaming\49E46447" /c
    C:\Users\Nelida Antram\AppData\Roaming\49E46447
    dir /s "C:\Users\Nelida Antram\AppData\Local\{8AB3491A-D7F7-11E1-8270-B8AC6F996F26}" /c
    c:\users\nelida antram\appdata\local\{92fa28bf-84db-e36c-4a5c-94c008f958a7}
    c:\windows\installer\{92fa28bf-84db-e36c-4a5c-94c008f958a7}
    C:\Users\Nelida Antram\AppData\Roaming\wcser.dll
    C:\windows\WLXPGSS.SCR
    c:\windows\assembly\gac_32\desktop.ini
    c:\windows\assembly\gac_64\desktop.ini
    C:\Program Files (x86)\Yontoo /d
    [COLOR="DarkRed"]:commands[/COLOR]
    [emptytemp]
    
    Now click the [​IMG] button.
    If the fix needed a reboot please do it.
    Click the OK button (upon reboot).
    When OTL is finished, Notepad will open. Close Notepad.
    A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    Attach this log to your next message. (How to attach)

    __


    [​IMG] Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
    This updates all of the logs inside MGlogs.zip.
    When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)
     
  8. tantram61

    tantram61 Private E-2

    deleted the Java update (31) and ran MGTools and OTL the files are attached.
     

    Attached Files:

  9. thisisu

    thisisu Malware Consultant

    [​IMG] Please download Farbar Service Scanner and run it on the computer with the issue.
    • Make sure all the options are checked
    • Press Scan.
    • It will create a log (FSS.txt) in the same directory the tool was run.
    • Please attach FSS.txt to your next message. (How to attach)
     
  10. tantram61

    tantram61 Private E-2

    I have ran Farbar and attached the file. Thanks
     

    Attached Files:

    • FSS.txt
      File size:
      4.8 KB
      Views:
      4
  11. thisisu

    thisisu Malware Consultant

    [​IMG] Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now open Repair_Windows.exe
    • Go to the Start Repairs tab.
    • Press the Start button
    • Create a System Restore point if prompted.
    • In the Repair Options window, choose the following repairs:
      • Reset Registry Permissions
      • Repair Windows Firewall
    • Place a checkmark in Restart/Shutdown System When Finished
    • Fill in the Restart System bubble
    • Now click the Start button.
    • Be patient while the tool repairs the selected items. Your computer should automatically restart when finished.
     
  12. thisisu

    thisisu Malware Consultant

    • Download each of the five files below onto the desktop of the computer with the issues:
    • Now double-click each of them, one at a time, and allow each one to merge into the Windows registry.
    • Let me know if you received a successful message for all five files.
    • If all were successful, reboot your computer.

    __

    [​IMG] Now scan with Farbar Service Scanner again and attach its latest log.
     
  13. tantram61

    tantram61 Private E-2

    I ran the Windows Repair and it seemed to go ok. Ran the 5 files and each was successful. Rebooted. Ran Farbar and have attached the file.

    Thanks
     

    Attached Files:

  14. tantram61

    tantram61 Private E-2

    I did notice that from a banking account when I tried to pick a date it would not allow me. Java script was void. Do I need to download Java and install?
     
  15. thisisu

    thisisu Malware Consultant

    Yes but remember to keep it up to date. Malware creators often exploit old versions of Java, Adobe Reader, and Adobe Flash Player.
    P.S. Is there a reason you are using such an old version of Mozilla Firefox?

    [​IMG] Now install the current version of Sun Java from: here

    Your latest FSS.txt looks perfect ;)

    If you are not having any other malware related problems, it is time to do our final steps:
    • Any programs we had you download and/or install can be removed at this time.
    • If we had you download and run ComboFix, here is how to uninstall it:
      • Press and hold the Windows key [​IMG] and then press the letter R on your keyboard.
      • This opens the Run dialog box.
      • Copy and paste the below text inside the text-field:
        • "%userprofile%\desktop\ComboFix" /uninstall
      • Now press ENTER
      • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
    • You can re-enable your Disk Emulation software at this time via DeFogger.
    • If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
    • Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
    • Now we will toggle System Restore to remove any infected system restore points.
    • Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
    • Be safe :)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds