MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Malware Removal
Register FAQ Members List Calendar Casino Mark Forums Read

Malware Removal Malware removal forum. Please see the READ ME FIRST thread before you post. Forum is staffed by a small number of volunteers, please be patient.


Reply
 
Thread Tools Display Modes
  #1  
Old 08-13-12, 08:30
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Virus?

Hello,

I went to a tumblr site to look at a picture and then Commodo alerted me about a threat. Commodo tried to remove it but then said it could not remove all of it. Commodo asked if I needed help, I selected no That was at 10:00PM last night.. Anyway, I ran Super Anti Spyware and Malwarebytes--both found nothing. But I kept getting alerts from Commodo. Then later AvG had an alert of infection as a Trojan horse BackDoor.Hupigon5.CJWJ in a Wild Tangent games folder at around 12 a.m. this morning. When I investigated into what alerted Commodo I found 2 specific iles that I could not delete in username\appdata\local\temp\1ijfuweuf.exe--Commodo found this suspicicious and a similar file in the same directory - 2jfuweif.exe. I cannot delete both. Commodo also found rugu.exe in appdata\roaming\fuupu\rugu.exe. suspicious and I cannot delete that either. I think all these files were accidentally downloaded when I clicked the site. I have done the scans--MB found nothing. But Rogue Killer found some keys---I did not delete anything from them. I have attached my scans.
Attached Files
File Type: txt mbam-log-2012-08-13 (07-54-31).txt (1.8 KB, 1 views)
File Type: log HitmanPro_20120813_0811.log (1.4 KB, 2 views)
File Type: txt RKreport[2].txt (3.0 KB, 3 views)
File Type: zip MGlogs.zip (304.4 KB, 4 views)
Reply With Quote
Sponsored links
  #2  
Old 08-13-12, 14:37
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Download OTL to your desktop.

Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:
:processes
:killallprocesses
:files
C:\Users\Priscilla\AppData\Local\Temp\1jfuweif.exe
C:\Users\Priscilla\AppData\Local\Temp\2jfuweif.exe
C:\Users\Priscilla\AppData\Local\Temp\78E.tmp
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click the OK button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • C:\MGlogs.zip

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #3  
Old 08-13-12, 17:55
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Thank you for your quick reply!! Upon reboot, I stilll see the file 1jfuweif.exe in the same spot. Also the folder Fuupu which is under C:\Users\Username\AppData\Roaming\ containing the suspicious file rugu.exe is still there. Other than that, I have not got any Commodo alerts thus far. I have attached both logs.

EDITED TO ADD: I just realised I ran OTL as well as MG Logs with Commodo on. Should I re-do both and disable Commodo?
Attached Files
File Type: zip MGlogs.zip (304.5 KB, 1 views)
File Type: log 08132012_182354.log (19.9 KB, 1 views)

Last edited by Argan; 08-13-12 at 18:05..
Reply With Quote
  #4  
Old 08-13-12, 18:10
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Quote:
Originally Posted by Argan View Post
Thank you for your quick reply!! Upon reboot, I stilll see the file 1jfuweif.exe in the same spot. Also the folder Fuupu which is under C:\Users\Username\AppData\Roaming\ containing the suspicious file rugu.exe is still there. Other than that, I have not got any Commodo alerts thus far. I have attached both logs.

EDITED TO ADD: I just realised I ran OTL as well as MG Logs with Commodo on. Should I re-do both and disable Commodo?
EDITED AGAIN TO ADD: When I go into the view defense events in Commodo it blocks MG Tools as well as OTL when they target 1jfuweif.exe.
Reply With Quote
  #5  
Old 08-14-12, 13:48
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Please download ComboFix to your desktop. Disable your AV software before we run it.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
Code:
ClearJavaCache::
KILLALL::
File::
C:\Users\Priscilla\AppData\Local\Temp\1jfuweif.exe
C:\Users\Username\AppData\Roaming\rugu.exe
Folder::
C:\Users\Priscilla\AppData\Local\Temp\ichcop
* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe

* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Note: If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below log:
  • C:\MGlogs.zip
  • C:\ComboFix.txt

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
Sponsored links
  #6  
Old 08-14-12, 14:42
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Hi there,

I have run ComboFix as instructed and turned off all protection software. It attempted to place a system restore point and started scanning. It has only completed stage 4 and it seems to have frozen. Do I close the window and re-do the entire process?
Reply With Quote
  #7  
Old 08-14-12, 15:12
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Hi there,

I have run ComboFix as instructed and turned off all protection software. It attempted to place a system restore point and started scanning. It has only completed stage 6 but it's been a hour. How long does it take to finish?
Reply With Quote
  #8  
Old 08-14-12, 17:37
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Ok, the Combo Fix scan was completed. It rebooted my pc and began preparing the log report. I tried to close down Commodo as well as AVG for it to create the log but my pc froze. I waited for an hour before forcing it to restart. I found the combo fix report in C:ComboFix, I dont know if it is complete. I looked to see if the two files- rugu.exe and 1jfuweif.exe were still there and AVG alerted me thus when I clicked the folder of the latter. It also tried to remove it but could not do so. This is the alert:-

Trojan horse PSW.Generic10.IIU

OBJECT OF THREAT IS MISSING. OBJECT DOES NOT EXIST OR IS INACCESIBLE


So, I guess I have a trojan? I ran the GetBat file. I have attached both to this post. What do I do next? I am now anxious to get this file off my pc!
Attached Files
File Type: txt ComboFix.txt (1.3 KB, 3 views)
File Type: zip MGlogs.zip (316.8 KB, 2 views)
Reply With Quote
  #9  
Old 08-15-12, 12:50
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Are you using Comodo with AV protection? If so, you need to uninstall AVG. Let's try OTL again.

Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

Code:
:processes
:killallprocesses
:files
C:\Users\Priscilla\AppData\Roaming\Fuupu 
C:\Users\Priscilla\AppData\Roaming\Fuupu\rugu.exe 
C:\Users\Priscilla\AppData\Local\Temp\1jfuweif.exe
C:\Users\Priscilla\AppData\Local\Temp\253096.od
C:\Users\Priscilla\AppData\Local\Temp\ichcop
:commands
[PURITY]
[EMPTYTEMP]
[RESETHOSTS]
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click the OK button.
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:
  • C:\MGlogs.zip

Make sure you tell me how things are working now!
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #10  
Old 08-15-12, 15:13
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

It seemed OTL did more as I turned off all protection software. By the way, I have Commodo Firewall. I'm not sure if it is also AV. Anyway, when my pc rebooted the 1jfuweif.exe is still there. I went and checked Commodo and in the Defense events , it looked like it blocked OTL from targetting that file. The thing is it was disabled and exited out of berfore OTL. Upon reboot though, it launched but was still disabled. I am confused about this, how could it block OTL if it was disabled? Do I have to do something so that it doesn't automatically launch upon the pc restarting? Anyway, I have attached the required logs.

ETA: I also noticed that when I check Commodo Defense events, AVG will automatically detect the Trojan. Something that also puzzles me.
Attached Files
File Type: zip MGlogs.zip (312.2 KB, 1 views)
File Type: log 08152012_154243.log (7.6 KB, 1 views)
Reply With Quote
Sponsored links
  #11  
Old 08-16-12, 09:38
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Since Comodo is blocking our work, please uninstall it. Then run CCleaner to make sure all traces are gone. Then re-run my last fix.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #12  
Old 08-16-12, 12:17
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Hello,

I checked and it looks like the malignant files are gone!!! I can't believe Commodo was preventing a complete fix! I have attached the logs, thanks!!!
Attached Files
File Type: log 08162012_124134.log (6.3 KB, 2 views)
File Type: zip MGlogs.zip (321.4 KB, 2 views)
Reply With Quote
  #13  
Old 08-16-12, 15:18
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Tell me what malware issues you are still having, if any.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
  #14  
Old 08-16-12, 16:15
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

At the present time, I don't seem to be having any malware issues.
Reply With Quote
  #15  
Old 08-16-12, 16:24
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Good to know.

If you are not having any other malware problems, it is time to do our final steps:
  1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
  2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
  3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
  4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
  5. Go to add/remove programs and uninstall HijackThis.
  6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
    related to MGtools and some other items from our cleaning procedures.
  7. After doing the above, you should work thru the below link:


Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
Sponsored links
  #16  
Old 08-16-12, 16:31
Argan Argan is offline
Private E-2
 
Join Date: Apr 2010
Posts: 25
Thanks: 1
Thanked 0 Times in 0 Posts
Default Re: Virus?

Thanks so much!!!!! Can I re-install Commodo Firewall?
Reply With Quote
  #17  
Old 08-17-12, 13:51
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,740
Thanks: 449
Thanked 4,662 Times in 4,401 Posts
Default Re: Virus?

Yes, you can. Safe surfing and you are most welcome.
__________________
Major cake licker.
YCLAHTW, BYCMHD!!

Major Geeks on Facebook

Major Geeks Newsletter
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Google Redirect Virus, Anti-Virus Programs Not Picking it Up. Slavic Malware Removal 9 08-30-11 17:35
Fake youtube link gave me a virus, disabled spyware/malware/anti-virus aixa817 Malware Removal 5 05-14-09 14:59
trojan horse virus has disabled my symantec anti virus auto protect kirara261980@yahoo.com Malware Removal 1 10-08-07 23:11
Antimalware/Virus Alert! Virus causing no Internet padools11 Malware Removal 9 07-26-06 23:24
virus or spyware blocking anti-virus programs and pages Zeruth Malware Removal 1 02-17-06 23:01


All times are GMT -5. The time now is 23:05.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger