Help with malware removal

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by zachawii, Jan 17, 2015.

  1. zachawii

    zachawii Private E-2

    zachawii, Jan 17, 2015
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Still need the log from running MGTools.exe -> C:\MGLogs.zip.
     
    TimW, Jan 17, 2015
    #2
  3. zachawii

    zachawii Private E-2

    Oh sorry, Heres MGTools
     
    Last edited: Jan 18, 2015
    zachawii, Jan 18, 2015
    #3
  4. zachawii

    zachawii Private E-2

    zachawii, Jan 18, 2015
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there, I'm logged in so I thought I might as well post something. This is a big fix, and we might need to go again with a round two or three...

    Uninstall this garbage:

    • Shopping Helper Smartbar
    • Search Settings v1.2.3
    • Homepage Protection


    You did not attach the correct log from Malware Bytes, it's just empty.


    Re run Hitman Pro and have it remove all that it finds.


    Re run Malware Bytes and have it remove anything it may find, then attach the new log please.




    [​IMG] Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:

    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{2B47855E-B429-4DF6-8293-E1DBF2381A07} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{8E56A02B-46FE-4490-B169-F16E5231533B} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301} -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E56A02B-46FE-4490-B169-F16E5231533B} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{34A0D84B-CDDC-4EC4-AFDD-4F1DDE1D14E5} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8E56A02B-46FE-4490-B169-F16E5231533B} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E312764E-7706-43F1-8DAB-FCDD2B1E416D} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | SearchSettings : C:\Program Files (x86)\Search Settings\SearchSettings.exe -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | BService : C:\Program Files (x86)\Bench\BService\1.1\bservice.exe -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Wd : C:\Program Files (x86)\Bench\Wd\wd.exe -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Bench Communicator Watcher : C:\Program Files (x86)\Bench\Proxy\pwdg.exe -> Found
    • [PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run | Bench Settings Cleaner : C:\Program Files (x86)\Bench\Proxy\cl.exe -> Found
    • [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | Browser Extensions : "C:\Users\Elizabeth\AppData\Roaming\Browser Extensions\CouponsHelper.exe" -> Found
    • [PUP] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | BRS : C:\Program Files (x86)\WSE_Lasaoren\BRS\brs.exe -runBRS -> Found
    • [PUP] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | Browser Infrastructure Helper : C:\Users\Elizabeth\AppData\Local\Smartbar\Application\Smartbar.exe startup -> Found
    • [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | Browser Extensions : "C:\Users\Elizabeth\AppData\Roaming\Browser Extensions\CouponsHelper.exe" -> Found
    • [PUP] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | BRS : C:\Program Files (x86)\WSE_Lasaoren\BRS\brs.exe -runBRS -> Found
    • [PUP] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Run | Browser Infrastructure Helper : C:\Users\Elizabeth\AppData\Local\Smartbar\Application\Smartbar.exe startup -> Found
    • [Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | Browse Safe-repairJob : wscript.exe "C:\Users\Elizabeth\AppData\Local\Browse Safe\repair.js" "Browse Safe-repairJob" -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LPTSystemUpdater ("C:\Program Files (x86)\LPT\srpts.exe") -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RGMUpdater (C:\Users\Elizabeth\AppData\Local\RGMService\RGMUpdater.exe) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\LPTSystemUpdater ("C:\Program Files (x86)\LPT\srpts.exe") -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RGMUpdater (C:\Users\Elizabeth\AppData\Local\RGMService\RGMUpdater.exe) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc) -> Found
    • [PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\LPTSystemUpdater ("C:\Program Files (x86)\LPT\srpts.exe") -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\RGMUpdater (C:\Users\Elizabeth\AppData\Local\RGMService\RGMUpdater.exe) -> Found
    • [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    • [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable : 1 -> Found
    • [PUM.Proxy] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:3128 -> Found
    • [PUM.Proxy] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyServer : http=127.0.0.1:3128 -> Found
    • [PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://feed.snapdo.com/?p=mKO_AwFzX...g_UsZgy7GCcUnxcW8NQ-gZE7t1w_tjbust3rhrVCXwOVA,, -> Found
    • [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://feed.snapdo.com/?p=mKO_AwFzX...g_UsZgy7GCcUnxcW8NQ-gZE7t1w_tjbust3rhrVCXwOVA,, -> Found
    • [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://feed.snapdo.com/?p=mKO_AwFzX...g_UsZgy7GCcUnxcW8NQ-gZE7t1w_tjbust3rhrVCXwOVA,, -> Found
    • [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://feed.snapdo.com/?p=mKO_AwFzX...g_UsZgy7GCcUnxcW8NQ-gZE7t1w_tjbust3rhrVCXwOVA,, -> Found
    • [PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-710523287-181607905-1138711222-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5RjfedSQJ1lAjNtSsvpuAJ_inYg909PNH90f5w5IRbFHjJoJ3gfXdyvCQbhvgmww,,&q={searchTerms} -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs : C:\Users\Elizabeth\AppData\Local\Smartbar\Application\Resources\crdlil64.dll -> Found

    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.

    ...and the same for thisentry on the "Tasks" tab please...


    • [Suspicious.Path] WSE_Lasaoren.job -- C:\Users\ELIZAB~1\AppData\Roaming\WSE_LA~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found
    ...and once again, same for these entries on Web Browsers tab...

    • [PUP][FIREFX:Addon] h1fy6fec.default : Yontoo Layers (Drop Down Deals) [plugin@yontoo.com] -> Found
    • [PUP][FIREFX:Addon] h1fy6fec.default : Start Page [{58d2a791-6199-482f-a9aa-9b725ec61362}] -> Found
    • [PUM.HomePage][FIREFX:Config] h1fy6fec.default : user_pref("browser.startup.homepage", "http://feed.snapdo.com/?p=mKO_AwFzXIpYRbPGr6JN_C9Okvk3V9BHMT-IkVs3eDgJ_Xmy1jzOTiV1WD8zB7obkgj336_KZy6mUsXr439sXzYRCGd6EdBPLU0Jqa3cJBsPS5xJDYD7wi5PcXazMwC4FT5d0YAl6S5r96bOmS9-Gg_UsZgy7GCcUnxcW8NQ-gZE7t1w_tjbust3rhrVCXwOVA,,"); -> Found

    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.



    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.


    • Now Re run RogueKiller and attach a log.
    • Same for Hitman.
    • Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
    • Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!
     
    Last edited: Jan 18, 2015
    Kestrel13!, Jan 18, 2015
    #5
  6. zachawii

    zachawii Private E-2

    Attached Files:

    zachawii, Jan 18, 2015
    #6
  7. zachawii

    zachawii Private E-2

    zachawii, Jan 18, 2015
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Are you still having any issues?
     
    TimW, Jan 18, 2015
    #8
  9. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Are you in normal start up mode? Click start > type msconfig > and check to see if you are indeed in normal start up mode.

    shopperz 2.0.0.452 <<< This junk needs uninstalling please.
     
    Kestrel13!, Jan 19, 2015
    #9
  10. zachawii

    zachawii Private E-2

    I tried uninstalling shopperz, but revo didnt detect it. Programs and features said it couldnt find it.

    No, I am not in normal. The window that popped up said i was in selective startup with load system services checked, load startup unchecked, and orignal boot checked but grayed out. I am not seeing any more symptoms.

    My symtoms originally were

    ---> Disabled proxy, it automaticly renabled itself.
    ---> Ads in places they shouldn't be (ie google)
    ---> Overall slowness

    Thanks for all your help so far, it has really helped.
     
    zachawii, Jan 19, 2015
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You need to be in normal start up mode please. Malware can hide in other modes...so do that and then do this...


    Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
     
    Kestrel13!, Jan 20, 2015
    #11
  12. zachawii

    zachawii Private E-2

    zachawii, Jan 21, 2015
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What issues are you still having, if any?
     
    TimW, Jan 22, 2015
    #13
  14. zachawii

    zachawii Private E-2

    I am not having any more issues, i am just waiting for clarification that everything is running fine, with nothing else in the background
     
    zachawii, Jan 22, 2015
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Jan 23, 2015
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds