Trojan.Gen.SMH removal assistance. Logs attached

JReesh · Sep 20, 2014

Malwarebytes ran and discovered suspicious items. I allowed it to do what it suggested, but when I attempted to save a log it crashed. I ran it again, but it came up as clean. I see a log in the history, but it is an .xml file and you asked not to attache those so that is why I do not have a Malwarebytes log attached.

I am requesting help b/c my Symantec keeps detecting the trojan and I need help getting rid of it b/c Symantec just quarantines the created files and doesn't seem to be able to find the originating culprit.

Kestrel13! · Sep 20, 2014

Hi and welcome!

May I begin by asking you if you are deliberately set up to use a proxy or not?

JReesh · Sep 21, 2014

Yes, I use privateinternetaccess.com 's proxy for secure browsing.

dr.moriarty · Sep 21, 2014

@JReesh

From the closed MalwareBytes' appl :

At the Dashboard > click on History > then Application Logs

Highlight the newest or preferred dated "Scan Log"

Click on the top left View button

Now click the bottom left Export button and select Text File

Windows Explorer now opens to choose the "Save" filepath.

Close down MalwareBytes'

Click to expand...

JReesh · Sep 21, 2014

Ok, I followed the instructions and EVERY time I try to save a .txt file, the program crashes. I even attempted to "save to clipboard" and it crashed. The only option that worked was saving to an .xml file. I have attached it hoping that it is better than nothing, but I can't get a .txt from the program.

Ok, so I am unable to upload an .xml file to this site so I simply changed it to a .txt by renaming it. It probably totally screwed up the file, but I don't know what else to try. My apologies.

Kestrel13! · Sep 21, 2014

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[Hj.Name|Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-407668556-3109764396-3965425102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows | Load : C:\Users\JASONR~1\AppData\Local\Temp\csrss.exe -> FOUND

[Hj.Name|Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-407668556-3109764396-3965425102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows | Load : C:\Users\JASONR~1\AppData\Local\Temp\csrss.exe -> FOUND

[RegVal.Brok] (X64) HKEY_CLASSES_ROOT\.exe\shell\open\command | : No Data ->

[PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-407668556-3109764396-3965425102-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://search.yahoo.com/?type=937811&fr=spigot-yhp-ie -> FOUND

[PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-407668556-3109764396-3965425102-1000\Software\Microsoft\Internet Explorer\Main | Start Page : http://search.yahoo.com/?type=937811&fr=spigot-yhp-ie -> FOUND

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...and do the same on the Tasks tab for these entries:

[Suspicious.Path] \\65c4673c -- C:\Users\JASONR~1\AppData\Local\Temp\\setup1571283496.exe -> FOUND

[Suspicious.Path] \\IHUninstallTrackingTASK -- CMD (/C DEL C:\Users\JASONR~1\AppData\Local\Temp\IHU36C8.tmp.exe) -> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Please re run Hitman Pro and have it remove all that it finds.

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe And select " Run as administrator " to run it.

Paste the following code under the area. Do not include the word Code.
Code:
:Files
C:\Windows\SysNative\drivers\xqyrj.sys
C:\Users\JASONR~1\AppData\Local\Temp\csrss.exe
C:\Users\JASONR~1\AppData\Local\Temp\setup1571283496.exe
C:\Users\JASONR~1\AppData\Local\Temp\IHU36C8.tmp.exe

:Commands
[emptytemp]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Push the large button.

OTM may ask to reboot the machine. Please do so if asked.

Copy everything in the Results window (under the green bar), and paste it into a text file to ATTACH into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

Download Cleano 0.61

Download it to your desktop, Right click the cleano.exe file and run as admin > and place check marks in the boxes as follows (click on link below to see image)

View attachment 148092
Click clean now and exit the program.

Now re run RogueKiller (just a scan) and attach log.
Same for Hitman.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

JReesh · Sep 21, 2014

On a positive note, all subsequent scans with malwarebytes turn up no malicious items.

JReesh · Sep 21, 2014

Everything went well. I wasn't able to find a couple of those keys to delete, but the rest went well. I am attaching all the files.

Kestrel13! · Sep 22, 2014

Good morning. How are things running at this point?

JReesh · Sep 22, 2014

I came home to a Symantec Endpoint Protection window stating it has quarantined about 30 more iterations of the Trojan.Gen.SMH infection. They have names like dwh73fe.exe, dwh8695.exe, etc. It appears they are all spawning from the same folder C:\Users\Jason Richard\AppData\Local\Temp\

As I'm writing this, more are popping up and being quarantined by Symantec.

Any advice?

Kestrel13! · Sep 23, 2014

Hmm, download Ccleaner Slim, http://www.majorgeeks.com/files/details/ccleaner_slim.html and run it. Do not use the registry scanner, just the cleaner side of things.

Let a day go by, and return back, let me know if symantec keeps finding those.

JReesh · Sep 24, 2014

Symantec's window is constantly open now. Every time I close it, it opens again with another file quarantined. I re-ran CCleaner and it still keeps happening. Malwarebytes occasionally pops up stating it has blocked access to a website and the program identified is rubyw.exe

Kestrel13! · Sep 25, 2014

Private Internet Access Support Files is installed. This is why MBAM alerts you to rubyw.exe.

I would like to see a log from Symantec please showing what it finds.

JReesh · Sep 25, 2014

I attempted to upload a log. I converted the .csv to a .txt and get this message when I upload.

"Your submission could not be processed because a security token was missing.

If this occurred unexpectedly, please inform the administrator and describe the action you performed before you received this error."

Kestrel13! · Sep 25, 2014

Sigh. Then just simply jot down EXACTLY the name of a few files, and their exact file paths please.

JReesh · Sep 26, 2014

The new files all start with dwh and then change from there. dwhc037.exe Original location: C:\Users\Jason Richard\AppData\Local\Temp\

They are all in the same folder:
dwh63f5.exe
dwh2d5c.exe
dwh87a7.exe

These are just a few examples. There are several hundred when I got home today that had been quarantined by Symantec.

Kestrel13! · Sep 27, 2014

Could you please zip up a couple and attach them here for me to look at.

JReesh · Sep 28, 2014

I have no idea how to do this. I can't access the quarantined files from Symantec, other than to delete them permanently. When I go to the Quarantine folder, the files in there end in .vbn and are only around 7kb in size. I can't find the original .exe files that were quarantined.

Kestrel13! · Sep 29, 2014

How do you feel about temporarily disabling your AV for a little while? Then perhaps you can take a look into the temp folder where those files were reported and see if they then exist to zip up and attach here. I'll explain how once you let me know there are any.

Otherwise there's this which looks complicated.

http://support.moonpoint.com/security/antivirus/symantec/quarantine-vbn.php

JReesh · Sep 29, 2014

Ok, I caught a couple of them, but they morph quickly. If I didn't get them zipped up quick enough, they changed from a .exe file to a .tmp file. The folder keeps filling up with a bunch of .tmp files with the names the .exe files had.

Kestrel13! · Sep 30, 2014

Right, I downloaded those to my desktop. My antivirus did not alert. And when I studied the files, I can see they relate to adaware antivirus or browsing protection. Which brings up exclamation marks (sorry I did not notice before) You should NOT be using more than one antivirus!! This is why there's a problem, and why symantec keeps quarantining. They are both fighting for control over files and such as. Clashing with each other.

Uninstall Adware Antivirus now if Symantec is paid for.

JReesh · Oct 2, 2014

Ok, so Adaware is gone, but the files are still popping up.

Kestrel13! · Oct 3, 2014

You uninstalled both? :confused

Ad-Aware Antivirus

Ad-Aware Browsing Protection

JReesh · Oct 4, 2014

No, i only "uninstalled" Ad Aware. I put it in quotes b/c it wouldn't uninstall via windows uninstall. It kept giving me an error when I tried to uninstall it, so I deleted the folder and files manually, with some difficulty I might add. As you probably already guessed, that won't do it. I had to download and re-install Ad Aware from scratch, THEN I was able to uninstall it (I turned off Symantec while installing and uninstalling Ad Aware).

So now I'm an hour or so post uninstall of Ad Aware and Symantec has not popped up any windows yet. I am tentatively hopeful that the problem is solved. If it pops up any more windows again, I will respond to this thread and let you know.

Thank you for the help.

Kestrel13! · Oct 4, 2014

You are most welcome.

Trojan.Gen.SMH removal assistance. Logs attached

JReesh Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

dr.moriarty Malware Super Sleuth Staff Member

JReesh Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

JReesh Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JReesh Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches