Virus still somewhere

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by ugean, Jul 6, 2014.

  1. ugean

    ugean Private First Class

    Hello,

    Back again, been a while. I've been through this process before and you guys are great! Whatever I have seems to be giving me difficulties saving logs. I could not get RogueKiller or HitmanPro to save the logs. I would click on save logs but it didn't do anything. I searched the whole computer and could not find anything.

    What is happening: Every few hours AVG comes up with at least 1 sometimes half a dozen threats found. I click the protect me and delete the files from the vault, run a full system scan which comes back clean. Couple hours later it happens again. Sometimes Maleware Bytes and SuperAnti Spyware will find things but several times they don't either. Finally I came back to you guys. No browser redirects no slowness or any real problems just AVG finding it. One way I can make AVG find it is to reboot the computer. Upon boot every time AVG will find threats.

    Any help is greatly appreciated!
     

    Attached Files:

    ugean, Jul 6, 2014
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you attach a log from AVG?

    Also, rerun both RogueKiller and Hitman and have them both remove what they find. Then see if you can save a log.
     
    TimW, Jul 6, 2014
    #2
  3. ugean

    ugean Private First Class

    Ok I attached the RK log I figured that out. The hitman still won't let me attach. I think it is because I used it before it says trial expired. I don't think AVG will produce a log but I can see prior scan results but no way to export it that I know of.
     

    Attached Files:

    ugean, Jul 8, 2014
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rerun RogueKiller and have it fix these items:
    Code:
    ¤¤¤ Registry Entries : 24 ¤¤¤
[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | upfst_us_139.exe : C:\Users\Server 1\AppData\Local\fst_us_139\upfst_us_139.exe -runonce  -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ALSysIO -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALSysIO -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ALSysIO -> FOUND
¤¤¤ Scheduled tasks : 5 ¤¤¤
[Suspicious.Path] Digital Sites.job -- C:\Users\SERVER~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE (/Check) -> FOUND
[Suspicious.Path] [URL="file://\\Digital"]\\Digital[/URL] Sites -- C:\Users\SERVER~1\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE (/Check) -> FOUND
[Suspicious.Path] [URL="file://\\{1D430814-A523-4A19-8E3D-444990568943"]\\{1D430814-A523-4A19-8E3D-444990568943[/URL]} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\Server 1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5NG6KKQJ\Firefox%20Setup%209.0.1[1].exe" -d "C:\Users\Server 1\Desktop") -> FOUND
[Suspicious.Path] [URL="file://\\{8FC37D9F-1BF9-4BA5-9FAA-A8E880CBEEEE"]\\{8FC37D9F-1BF9-4BA5-9FAA-A8E880CBEEEE[/URL]} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\Server 1\Downloads\FlexRAID-2.0-Preview11-Setup.exe" -d "C:\Users\Server 1\Downloads") -> FOUND
[Suspicious.Path] [URL="file://\\{95B6E51C-7112-49D5-B01C-8761365D5DC8"]\\{95B6E51C-7112-49D5-B01C-8761365D5DC8[/URL]} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\Server 1\Downloads\RAR.Password.Recovery.v1.1.RC.17.porte.exe" -d "C:\Users\Server 1\Downloads") -> FOUND
    Then run Hitman and copy and paste into notepad the results. Attach that to your next reply.

    Reboot and rescan with RogueKiller and attach that as well.

    Tell me what issues you are having.
     
    TimW, Jul 8, 2014
    #4
  5. ugean

    ugean Private First Class

    Here are the screenshots. Just rebooted and running roguekiller again right now. AVG is popping up constantly now.
     
    ugean, Jul 8, 2014
    #5
  6. ugean

    ugean Private First Class

    Well that converted it to a .txt file with no pictures. How do I get these screen shots to you?
     

    Attached Files:

    ugean, Jul 8, 2014
    #6
  7. ugean

    ugean Private First Class

    Here is the new log after deleting that stuff and rebooting.
     

    Attached Files:

    ugean, Jul 8, 2014
    #7
  8. ugean

    ugean Private First Class

    I hope this is readable.
     

    Attached Files:

    ugean, Jul 9, 2014
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No,,it is not readable. Did you have AVG fix what it found?

    You still need to run RogueKiller and fix these:
    Code:
    ¤¤¤ Registry Entries : 25 ¤¤¤
[Suspicious.Path] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce | upfst_us_139.exe : C:\Users\Server 1\AppData\Local\fst_us_139\upfst_us_139.exe -runonce  -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ALSysIO -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ALSysIO -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ALSysIO -> FOUND
     
    TimW, Jul 9, 2014
    #9
  10. ugean

    ugean Private First Class

    Yes I always have AVG clean the infections it finds. Removed those again, rebooted, reran roguekiller attached is the log. I saw those things in there again so I hit delete on them again.
     

    Attached Files:

    ugean, Jul 9, 2014
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). Attach the new C:\MGLogs.zip.
     
    TimW, Jul 10, 2014
    #11
  12. ugean

    ugean Private First Class

    attached.
     

    Attached Files:

    ugean, Jul 10, 2014
    #12
  13. ugean

    ugean Private First Class

    Also just ran a malewarebytes scan and it found things again. attached is the log.
     

    Attached Files:

    ugean, Jul 11, 2014
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    MBAM just found a bunch of PUP's.


    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
     
    TimW, Jul 11, 2014
    #14
  15. ugean

    ugean Private First Class

    well i booted up my computer and my desktop says my copy of windows is not genuine. ran the program here is the log.
     

    Attached Files:

    • JRT.txt
      File size:
      3.5 KB
      Views:
      2
    ugean, Jul 11, 2014
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware in your logs. As to the genuine issue, just input the product code from the sticker on the back of your machine. For additional assistance with that, post in the software forum.

    What issues are you still having?
     
    TimW, Jul 11, 2014
    #16
  17. ugean

    ugean Private First Class

    I rebooted and AVG came right up with two threats. and the not genuine thing went away. I wish there was a way for me to pull these results out of AVG. I can go back through and see them all but cant get them to export.
     
    ugean, Jul 11, 2014
    #17
  18. ugean

    ugean Private First Class

    ugean, Jul 11, 2014
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you tell me what files were flagged?
     
    TimW, Jul 11, 2014
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The very first MGlogs.zip showed the below junk installed. It should be uninstalled

    This is where the fst_us_139 stuff is coming from.
     
    chaslang, Jul 11, 2014
    #20
  21. ugean

    ugean Private First Class

    uninstall using roguekiller?
     
    ugean, Jul 12, 2014
    #21
  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). Attach the new log.
     
    TimW, Jul 12, 2014
    #22
  23. ugean

    ugean Private First Class

    Ran it. It completed successfully. Attached are new logs.
     

    Attached Files:

    ugean, Jul 12, 2014
    #23
  24. ugean

    ugean Private First Class

    I rebooted AVG still found two things upon startup. I copied the paths to a txt file and attached. Also ran roguekiller logs attached and a new get logs attached. What are these virus' doing? Do I need to be worried about these identity theft with these? More than usual? Or are these more they type that are using my computer as a spam mailer?
     

    Attached Files:

    ugean, Jul 12, 2014
    #24
  25. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Download OTM by Old Timer and save it to your Desktop.

    • Right-click OTM.exe And select " Run as administrator " to run it.
    • Paste the following code under the [​IMG] area. Do not include the word Code.

    Code:
    :Processes
explorer.exe

:files
c:\users\server 1\appdata\locatemp\gpupd53c167e51.exe
c:\program files (x86)\getprivate
c:\users\server 1\appdata\locatemp\gpupd53c167e20.exe
C:\Users\Server 1\AppData\Local\Temp\*.*
C:\Windows\TEMP\*.*

:Commands
[start explorer]
[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
    • Push the large [​IMG] button.
    • OTM may ask to reboot the machine. Please do so if asked.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.

    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach this log file to your next message.
     
    TimW, Jul 12, 2014
    #25
  26. ugean

    ugean Private First Class

    Ok attached is the the log. I did have to disable AVG it picked up OTM as a virus and didn't even ask to remove it just would. I couldn't copy what was in the green part before it rebooted I had to select yes to the reboot. I was able to find the log file and get it attached but as I did I saw AVG pop up (it restarted on boot up) that it was removing OTM. Good news no other AVG popups.
     

    Attached Files:

    ugean, Jul 12, 2014
    #26
  27. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
    TimW, Jul 13, 2014
    #27

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds