Serious malware infection

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by yellowman7884, Jul 13, 2013.

  1. yellowman7884

    yellowman7884 Private E-2

    Hi. I've recently picked up serious infection of malware on family laptop. Google redirects all search results to pop ups, advertising etc. I have no other browser installed, it won't let me install any other browsers or any of the tools required to check for virus malware or even run the windows security software. Can't access an online scanner due to redirects. I'm lost. Have to use ipad to type this!!!!! Please help
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    What version of windows are you using?
     
  3. yellowman7884

    yellowman7884 Private E-2

    Windows 7 professional. Toshiba laptop 64 bit. Managed to somehow run an online scan through ESET yesterday and among other things it returned sirefef.EZ trojan. When I tried to install any tools from your READ FIRST thread it returns the ".exe contained a virus and was deleted" message.
     
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please do the below so that we can boot to System Recovery Options to run a scan. There will be two options to choose from. One if you do not have your Windows 7 boot DVD and another when you have your DVD.

    For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.
    For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

    Plug the flashdrive into the infected PC.

    Option1: Enter System Recovery Options from the Advanced Boot Options:

    • Restart the computer.
    • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
    • Use the arrow keys to select the Repair your computer menu item.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account an click Next.

    Option2: Enter System Recovery Options by using Windows installation disc:

    • Insert the installation disc.
    • Restart your computer.
    • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
    • Click Repair your computer.
    • Select US as the keyboard language settings, and then click Next.
    • Select the operating system you want to repair, and then click Next.
    • Select your user account and click Next.

    On the System Recovery Options menu you will get the following options:
    • Select Command Prompt
    • In the command window type in notepad and press Enter.
    • The notepad opens. Under File menu select Open.
    • Select "Computer" and find your flash drive letter and close the notepad.
    • In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
      Note: Replace letter e with the drive letter of your flash drive.
    • The tool will start to run.
    • When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)
     
  5. yellowman7884

    yellowman7884 Private E-2

    OK Thanks, had a bit of trouble as had to download from PS3 onto USB, but think that's got it now
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Save fixlist.txt to your flash drive.

    • You should now have both fixlist.txt and FRST.exe on your flash drive.

    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.

    Running MGTools.
     

    Attached Files:

  7. yellowman7884

    yellowman7884 Private E-2

    I'm unable to transfer fixlist.txt file to flashdrive through infected computer. I have no other access to PC/laptop at the moment. Will this be required for further work?
     
  8. yellowman7884

    yellowman7884 Private E-2

    OK, I had to open fixlist and type it and save it on notepad. I managed to then run FRST64 with this fixlist and produce the attached log.

    You said continue with MGTools, however I am unable to install this to the root C:\ Drive
     

    Attached Files:

  9. yellowman7884

    yellowman7884 Private E-2

    OK, sorted now. UAC disabled, MGTools run from root C:\ , and MGlogs attached.
     

    Attached Files:

  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Download OTL to your desktop.

    Double-click OTL.exe to start the program.

    • Copy and Paste the following code into the Custom Scans/Fixes textbox. Do not include the word Code

    Code:
    :processes
    :killallprocesses
    :files
    C:\windows\assembly\GAC_32\Desktop.ini
    C:\windows\assembly\GAC_64\Desktop.ini
    :commands
    [PURITY]
    [EMPTYTEMP]
    [RESETHOSTS]
    [REBOOT]
    
    
    • Then click the Run Fix button at the top.
    • Click the OK button.
    • OTL may ask to reboot the machine. Please do so if asked.
    • The report should appear in Notepad after the reboot. Just close notepad and attach this log form OTL to your next message.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista , Win7 or Win8, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:

    • C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  11. yellowman7884

    yellowman7884 Private E-2

    O K . OTL has been run. log attached - I think (found it in C:\_OTL)
    Getlogs.bat run, and log attached.

    Once I did this, I attempted to download firefox and am continuing to get the ".exe contained a virus and was deleted" message.

    Don't seem to be getting the redirects and advertising which is a good sign though.
     

    Attached Files:

  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Save fixlist.txt to your flash drive.

    • You should now have both fixlist.txt and FRST.exe on your flash drive.

    Now reboot back into the System Recovery Options as you did previously.
    Run FRST and press the Fix button just once and wait.
    The tool will make a log on the flashdrive (Fixlog.txt).
    Please attach this to your next message. (See how to attach)

    Now boot into normal Windows can continue with the below.

    Running MGTools.
     

    Attached Files:

  13. yellowman7884

    yellowman7884 Private E-2

    Right, I have attached both logs from last instruction for your review.
     

    Attached Files:

  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That took care of it.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
  15. yellowman7884

    yellowman7884 Private E-2

    Unfortunately not. Still unable to install any software - "Firefox setup stub 22.0.exe contained a virus and was deleted", and just attempted to open Microsoft security essentials -"windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item".
    Still no redirects or advertising though.
     
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean. I am going to suggest you post in the software forum for further assistance.

    Have you tried uninstalling, running CCleaner and then reinstalling?
     
  17. yellowman7884

    yellowman7884 Private E-2

    Many thanks for your assistance anyway. Much appreciated.

    I tried to uninstall Security Essentials, run CCleaner and Reinstall as you suggested, however Control Panel shows MSE as a blank icon and says that I don't have sufficient privileges to uninstall.
    Regardless, I ran CCleaner and went to Microsoft Security Essentials site to download again but was presented with the same continuous ...contained a virus... that I get when attempting to download any software.

    I will do as you have suggested and repost on the Software thread.
     
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download ComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it is running or it may stall the program.
     
  19. yellowman7884

    yellowman7884 Private E-2

    OK, I had saved combofix to USB drive and unlike other other files, could not transfer to directly to desktop. Only a link to desktop. I know this is not ideal but could not seem to do it any other way.
    I ran it anyway and the log is attached.
     

    Attached Files:

  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Looks like some malware leftovers,so please go to the Read and Run First instructions and get me the requested logs ( RogueKiller and Hitman in particular).
     
  21. yellowman7884

    yellowman7884 Private E-2

    OK all programs run as requested and logs attached
     

    Attached Files:

  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Other than the PUP"s in Hitman, your logs are clean. Let's remove the trash:

    [​IMG] Please download Junkware Removal Tool to your desktop.

    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
  23. yellowman7884

    yellowman7884 Private E-2

    OK. Good news, able to download JRT directly to desktop however it did present the message similar to "JRT is not commonly downloaded and could be harmful to your computer".
    I closed the pop up which had options of Do not Run, and Delete file.
    I have run it and here is the attached log
     

    Attached Files:

    • JRT.txt
      File size:
      2.4 KB
      Views:
      3
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Any remaining issues should be pursued in the software forum.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds