Autorun-G worm related

ChemMD · May 8, 2009

Hi. My USB drive was infected with autorun-G worm detected by Avast. The effect was that the USB drive can not be removed either by the "Eject" command or the "safely remove" route so that I just removed it the USB drive physically. I tried to remove the worm using Malware and Avast.

When I searched the forums I saw a thread here that describes "C:/RECYCLER..." popping up. I noticed this pop-up during the booting process after the Windows startup. This computer also takes a long time booting up. I also noted an error message about Windows Explorer.

I followed the suggestions in your threads "READ & RUN ME FIRST" then "Windows XP Cleaning". The unusual thing I noted in the process was that The computer freezes during the re-boot after SuperAntiSpyware step, and Avast antivirus was running when ComboFix was writing the log. (I did follow the disabling the antivirus, antispyware and firewall BEFORE starting ComboFix.

It was not clearly stated in the instructions but I enabled these BEFORE I ran MGtools. AFTER all the four scans, the boot was a bit faster, AND there was an error message from Avast looking for RPC.

Hope you can help.

PS. I deviated from the Windows XP Cleaning procedure in that I did not reinstall Malwarebytes as it was already installed in my desktop before I started the procedure.

Thanks in advance.

chaslang · May 11, 2009

Welcome to Major Geeks!

You should start by running this: Disabling AutoRuns

Now run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below software:
Java 2 Runtime Environment Standard Edition v1.3.1
Viewpoint Media Player <-- should have been uninstalled in step 1 of the READ ME

Now we need to use ComboFix to remove a bunch of malware files.

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box into it:

KILLALL::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74b13750-3171-11da-be4f-000ea680e320}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{80b1fcd2-5c23-11dc-9c40-000ea680e320}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a7ee611d-606e-11da-951e-000ea680e320}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a8e50a7c-1968-11db-980b-000ea680e320}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c062937a-9305-11da-95fd-000ea680e320}]

RegLockDel::
[HKEY_USERS\S-1-5-21-511004874-1923395053-795866784-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a8e50a7c-1968-11db-980b-000ea680e320}\Shell\é*_* "!\command]
@="NETSVCS.EXE"
Click to expand...

Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Also look for files with names like below on your removable drives and your hard disk and delete them if found. Also look on drives of other PCs that you have plugged your infected USB drives into.
New Document.exe
rawdata.exe
RootFolder.com

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

C:\ComboFix.txt

C:\MGlogs.zip

Make sure you tell me how things are working now!

ChemMD · May 13, 2009

Thanks for the next steps. The process went smoothly as you described, except that I did not find any of the three files you mentioned to check for in this laptop and the USB drive.

Here are the attachments you asked for.

Am I now ready to do Step 4 of the Windows XP Cleaning Procedure?

chaslang · May 15, 2009

You're welcome. Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

ChemMD · May 17, 2009

Thanks for continuing to work with me in correcting my problem. I am still having problems.

After reading your response on my logs being clean, I removed the files as described in Windows XP cleaning procedure, and performed Toggle System Restore without incident.

While reading How to Protect Yourself from Malware, I noted a 6 minute freeze in the computer clock during the boot.

I went to Alternative Scans (with the results) as follows:
1. No hidden items found using SophosKit
2. Found 3 infected objects during online scan with Kaspersky Online. The scan froze at 64% complete.
3. I did not scan using Ad-Aware SE free edition because I was unable to download definition updates using Updates and Webupdate.
4. No threats found using Kaspersky Virus Removal Tool (with default areas to scan).

What should be my next step?

ChemMD · May 18, 2009

Hi, again. I repeated Kaspersky Online Scanner 7 scan under Safe Mode. Success! Here's the log.

Thanks again.

chaslang · May 20, 2009

ChemMD said: ↑

Hi, again. I repeated Kaspersky Online Scanner 7 scan under Safe Mode. Success! Here's the log.
Click to expand...

Outlook Express archives have to be cleaned up manually or deleted by you. That is the only way to remove junk from them.

Make sure that you have not reinstalled MyWebSearchWB in any form. Look in Add/Remove programs and uninstall it if found. Otherwise just delete the C:\Program Files\MyWebSearchWB folder.

Don't waste your time with Ad-Aware. Use SUPERAntiSpyware and Malwarebytes from our cleaning instructions. They are both many times better than Ad-Aware.

ChemMD · May 23, 2009

Thanks for you concluding tips. I ended up repeating the Malware Removal for Windows XP. I think I got all of it this time. Working on Protecting against Malware. Have to balance catching malware etc, against slowing down my laptop.

Thanks again.

chaslang · May 24, 2009

You're welcome. Surf safely!

Log in or Sign up

Autorun-G worm related

ChemMD Private E-2

Attached Files:

SASlog.txt

mbam-log-2009-05-08 (12-32-33).txt

ComboFix.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

ChemMD Private E-2

Attached Files:

KasperskyOnlineScanner Log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Autorun-G worm related

ChemMD Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

ChemMD Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

ChemMD Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Useful Searches