Infected with win32\Kryptic Trojan

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by hvdb, Mar 15, 2012.

  1. hvdb

    hvdb Private E-2

    Hello,

    Since 1 week I seem to have problem with a trojan. My avg scanner detected

    infection: trojan horse SHeur4.TOJ
    malware: win32\Kryptic.ACFL

    today also

    infection: trojan horse Generic27.ARSE
    malware: win32\Kryptic.ABVZ

    I followed the XP malware removal guide and here are the logs files. The problem was not solved by running all these tools

    Could you help me?

    Hvdb
     

    Attached Files:

  2. hvdb

    hvdb Private E-2

    and final log
     

    Attached Files:

  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!


    Uninstall the below old versions of software:
    Java(TM) 6 Update 29
    Java(TM) SE Development Kit 6 Update 23

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. hvdb

    hvdb Private E-2

    Ok,

    I followed all the steps and here are the log files. During combofix, I temporarily disabled AVG.

    After running combofix, a reboot had to be done, and AVG starts with reboot. Immediatly after reboot, AVG gave again the same error that win32/Kryptic was detected...

    Seems not to be solved yet...
     

    Attached Files:

  5. hvdb

    hvdb Private E-2

    Also in C:WINDOWS\SYSTEM32\ directory there is again a new dll file:

    C:\WINDOWS\system32\18444350041.dll
     
  6. hvdb

    hvdb Private E-2

    and got also attached error now from AVG...
     

    Attached Files:

  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As stated in the READ & RUN ME, you will have to uninstall AVG now to avoid having it get in our way. Once we have totally cleaned your PC, you will be able to reinstall it. So uninstall it now, while I look thru your new logs.
     
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  9. hvdb

    hvdb Private E-2

    Ok,

    Have retried with all AVG services stopped, this worked perfectly as i am a bit afraid of uininstalling. This time, after reboot combofix ran without any interference from AVG.

    Find attached the 2 log files requested, and also the warning windows firewall showed after the reboot generated by combofix. Basically it says Windows firewall has blocked certain fucntions of windows explorer. It has blocked the program to accepts incoming connections from network or internet. I choose the option to keep blocking.
     

    Attached Files:

  10. hvdb

    hvdb Private E-2

    Also, a new "suspicious" dll file appears in

    C:\WINDOWS\system32\857189341.dll

    Created after combofix has run. Combofix.txt was created at 9:56, the dll file was created at 9:57...
     
  11. hvdb

    hvdb Private E-2

    Also got AVG warning (after I re-enabled the avg services) not immediatly but an hour later.
     

    Attached Files:

  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Items in system restore are not currently problems. We will fix/remove them when we get to final instructions.

    You may still have to remove AVG. We will see. It is not protecting you from this infection anyway and it is obviously incapable of remving it. ;)



    Please download OTL by OldTimer.
    • Save it to your desktop.
    • Double click on the OTL icon on your desktop. (If running Vista or Win7 right-click and select Run as Administrator)
    • Check the "Scan All Users" checkbox.
    • Check the "Standard Output".
    • Change the setting of "Drivers" and "Services" to "All"
    • Copy the text in the code box below and paste it into the Customs Scans/Fixes text-field.
      Code:
      netsvcs
      /md5start
      afd.sys
      atapi.sys
      csrss.exe
      dhcpcsvc.dll
      explorer.exe
      lsass.exe
      nsiproxy.sys
      regedit.exe
      services.exe
      svchost.exe
      tcpip.sys
      tdx.sys
      userinit.exe
      winlogon.exe
      /md5stop
      %systemdrive%\*.*
      %systemdrive%\MGtools\*.*
      %systemroot%\*. /mp /s
      %systemroot%\system32\*.sys /90
      %systemroot%\system32\*.exe /lockedfiles
      %systemroot%\system32\drivers\*.sys /lockedfiles
      %windir%\assembly\GAC\*.ini
      %windir%\assembly\GAC_MSIL\*.ini
      %windir%\assembly\gac_32\*.ini
      %windir%\assembly\gac_64\*.ini
      %windir%\assembly\temp\*.ini
      %windir%\assembly\tmp\u /s
      %allusersprofile%\application data\*.exe
      hklm\system\currentcontrolset\services\dhcp
      hklm\system\currentcontrolset\services\afd
      hklm\system\currentcontrolset\services\tdx
      hklm\system\currentcontrolset\services\tcpip
      hklm\system\currentcontrolset\services\nsiproxy
      hklm\software\microsoft\windows\currentversion\run
      hklm\software\microsoft\windows\currentversion\runonce
      
    • Now click the Run Scan button.
    • Two reports will be created:
      • OTL.txt <-- Will be opened
      • Extra.txt <-- Will be minimized
    • Attach both OTL.txt and Extras.txt to your next message. (See how to attach)

    Also run GMER per the below and attach the log:

    GMER - running with a random name
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    One more request! Please put a copy of the C:\WINDOWS\system32\857189341.dll file into a ZIP file and attach it to your next message.
     
  14. hvdb

    hvdb Private E-2

    Just to be sure I don't lose it during cleanup, here is already the dll file in rar format.
     

    Attached Files:

    Last edited: Mar 17, 2012
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

  16. hvdb

    hvdb Private E-2

    OK,

    as requested the different log files
     

    Attached Files:

  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Now shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
    • Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
    • Copy the text in the code box below and paste it into the [​IMG] text-field.
    Code:
    :OTL
    O4 - HKU\S-1-5-21-117609710-1220945662-682003330-1004..\Run: [Antivirus Protection 2012 SM] C:\Documents and Settings\Hans Vanderbeke\Application Data\Antivirus Protection 2012\securitymanager.exe File not found
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} [URL]http://download.eset.com/special/eos/OnlineScanner.cab[/URL] (OnlineScanner Control)
    [2012/03/17 09:52:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Hans Vanderbeke\Application Data\Security
    [2012/03/13 21:17:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programma's\STOPzilla
    [2011/11/16 21:40:00 | 000,197,632 | ---- | C] (Microsoft) -- C:\Program Files\Common Files\OnlineFilesManager.dll.old
    [2011/11/16 21:40:00 | 000,197,632 | ---- | C] (Microsoft) -- C:\Program Files\Common Files\OnlineFilesManager.dll
    [2012/03/17 16:00:00 | 000,001,176 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-117609710-1220945662-682003330-1004UA.job
    [2012/03/17 15:54:00 | 000,001,044 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2012/03/17 09:57:18 | 000,025,272 | ---- | M] () -- C:\WINDOWS\System32\857189341.dll
    [2012/03/17 09:40:24 | 000,002,042 | ---- | C] () -- C:\Documents and Settings\Hans Vanderbeke\Menu Start\Programma's\Antivirus Protection 2012.lnk
     
    :Files
    c:\documents and settings\Hans Vanderbeke\Application Data\Security\security.bin
    C:\Program Files\Common Files\Data\hd2D_module.dat.vir
    C:\Program Files\Common Files\OnlineFilesManager.dll
    C:\Program Files\Common Files\OnlineFi
    C:\WINDOWS\system32\857189341.dll    
    C:\Documents and Settings\Hans Vanderbeke\Local Settings\temp\tmpA.tmp
    :Reg
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "Antivirus Protection 2012 SH"=-
    "Antivirus Protection 2012 SM"=- 
    :Commands
    [PURITY]
    [EMPTYTEMP] 
    [EMPTYFLASH]
    
    [REBOOT]
    • Now click the [​IMG] button.
    • If the fix needed a reboot please do it.
    • Click the OK button (upon reboot).
    • When OTL is finished, Notepad will open. Close Notepad.
    • A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
    • Attach this log to your next message. (See: How to attach)
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the log from OTL
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  18. hvdb

    hvdb Private E-2

    Here the requested logs...
     

    Attached Files:

  19. hvdb

    hvdb Private E-2

    For the moment, symptoms seem to have disappeared.

    Do the logs confirm all is OK?

    Hvdb
     
  20. hvdb

    hvdb Private E-2

    The only thing that came back was the attached error.
     

    Attached Files:

  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes. And the below will remove the items from System Restore that you see with AVG


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  22. hvdb

    hvdb Private E-2

    OK thanks, will follow the advice.

    Any idea what was actually the source of my infection?
     
  23. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your problems were due to Antivirus Protection 2012. You would know better than I where you picked it up. The quick answer on where you picked it up is "The Internet". ;)
     
  24. hvdb

    hvdb Private E-2

    Internet of course,

    I only have no idea via which way this Antivirus Protection 2012 came in?

    Is it by executing a downloaded file (in which case we would be able to know from which file) or by playing a downloaded move (should also traceable) or by just "surfing" the web ?
     
  25. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Things like this can occur by downloading and running infected programs. It can also be included with various rogue codec packages that people sometimes install because they want to view some videos. It can also occur when accessing certain websites ( even without clicking on anything, scripts can still run ). Even sites you think are clean, may not be. Google and other big search engines sites do not police every link they reference and many times people get infected following various search hits. In short, as I said, "The Internet". Which is why you need good protection and everyone using PCs needs to develope safe surfing habits. ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds