Maliscious Intent

Hello all,
Have a problem here with a "new computer". Inadvertently downloaded a nasty virus(s) and now can't get rid of them.
Need a stepping off point to be able to post them, if anyone can help.
Norton keeps telling me it quarantined "Trojan.Paccyn!inf" among others. I've ran several scans but at first was unable to even gain access to the internet.
after starting in "safe mode" I was able to run some scans and clear a few things up but the problem is still there and persistent. Need Help:eek

 

Hi 31BravoMP!

Please complete as much of this as possible: READ & RUN ME FIRST Malware Removal Guide

All of the instructions for how to run the programs and how to attach the logs are in the that link

 

Malwarebytes' Anti-Malware 1.51.2.1300
[edit: thisisu > inline log removed]


SUPERAntiSpyware Scan Log
[edit: thisisu > inline log removed]

Hopefully, I followed your instructions correctly and you can pull what information you need from the attached and posted files. Please let me know what more I can provide if necessary...Thanks for your help in this matter.

 

Please attach the logs instead of pasting them in the reply.

Also.. attach the MGlogs.zip (c:\MGlogs.zip) and the log from running RootRepeal.

If you had trouble running the above, let me know.

 

sorry, had a hard time locating some of those "logs", so I pasted them...included this time is the .zip file you requested. Can't seem to locate the RootRepeal log

 

Think I located the RootRepal log however it's a .rar file and upload attachment keeps saying "invalid file"

 

From Programs and Features (via Control Panel), please uninstall the below:

• Ad-Aware
• Java 2 Runtime Environment, SE v1.4.2_07
• Java(TM) 6 Update 20

Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)


Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon

• Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (How to attach items to your post)

Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]DDS::[/COLOR]
Trusted Zone: //about.htm/
Trusted Zone: //Exclude.htm/
Trusted Zone: //LanguageSelection.htm/
Trusted Zone: //Message.htm/
Trusted Zone: //MyAgttryCmd.htm/
Trusted Zone: //MyAgttryNag.htm/
Trusted Zone: //MyNotification.htm/
Trusted Zone: //NOCLessUpdate.htm/
Trusted Zone: //quarantine.htm/
Trusted Zone: //ScanNow.htm/
Trusted Zone: //strings.vbs/
Trusted Zone: //Template.htm/
Trusted Zone: //Update.htm/
Trusted Zone: //VirFound.htm/
Trusted Zone: mcafee.com\*
Trusted Zone: mcafeeasap.com\betavscan
Trusted Zone: mcafeeasap.com\vs
Trusted Zone: mcafeeasap.com\www
[COLOR="DarkRed"]Driver::[/COLOR]
Lavasoft Kernexplorer
Lbd
Lavasoft Ad-Aware Service
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\myClean.bat
c:\windows\system32\DRIVERS\Lbd.sys
c:\windows\Tasks\Ad-Aware Update (Weekly).job
c:\windows\system32\drivers\mfetdik.sys
c:\windows\system32\drivers\mferkdk.sys
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bat.bat
C:\Windows\temp\TMP0000015DDB2667E743C68429
C:\{4DCC06D5-9F97-4FE2-A534-52D1B4A65E02}
[COLOR="DarkRed"]Folder::[/COLOR]
c:\windows\$NtUninstallKB57691$
c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
c:\programdata\ParetoLogic
c:\program files\Lavasoft
c:\users\Parent\AppData\Roaming\DriverCure
c:\users\Parent\AppData\Roaming\ParetoLogic
c:\program files\Common Files\McAfee
c:\users\Parent\AppData\Roaming\McAfee
c:\program files\McAfee
c:\programdata\McAfee
C:\Users\Parent\AppData\Local\Conduit
C:\ProgramData\Lavasoft
C:\Program Files\Conduit
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}]
"SuggestionsURL_JSON"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}]

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

MGtools.exe should have been run from C:\MGtools.exe

Download Junction by Mark Russinovich to your desktop.

• Extract junction.exe to your desktop.
• Now press and hold the Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  cmd /c %userprofile%\desktop\junction -s c:\ >%userprofile%\desktop\junction.txt
  
• When it's finished, there will be a log called junction.txt on your desktop.
• Attach this log to your next message. (How to attach items to your post)

Now install the current version of Sun Java from: Sun Java Runtime Environment

Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Note: This will automatically update all the logs inside MGlogs.zip

 

Hopefully I was able to follow all instructions to the letter and provide you with the necessary files, thanks for your help.

 

Can you find that .zip up the following file for analysis?

If you need help doing this, follow the below instructions:

If you do not know, could you please get this file: winstart.bat into a zipped file and attach it for me in your next post? To do this, see the below:

• Press and hold the Windows key on your keyboard, then press the letter r on your keyboard.
• This opens the Run dialog box.
• Then copy the below bold text and paste it into the Open: text-field and press ENTER.
  
• When it's finished, there will be a file called collect.zip in the at the root of the C: drive. (C:\collect.zip)
• Attach collect.zip to your next message.(How to attach items to your post)

How are things running now? The rest of your logs look good.

 

Attached is the aforementioned .zip file you requested...Things "seem" to be ok now, no unwanted virus alerts popping up and the browsers don't seem to be "auto-starting" like before. However, I've noticed that there are some files that are "locked" and when I attempt to open them I receive "unable to open-access denied" Folders include but not limited to: Documents and Settings, Favorites, Application Data just to name a few. Any thoughts on this would be greatly appreciated, Thanks!

 

You're right, I saw this just forgot to address it.

This should help if not let me know and we can try another tool.

Please download RogueKiller by Tigzy to your desktop.

• See the download links under this icon:
• Double-click RogueKiller.exe to run it. (Vista and Win7 right-click and select Run as Administrator)
• When it opens, press the number 6 and press ENTER.
• Be patient while this is working.. When it is finished a report will appear in Notepad.
• Attach RKreport[1].txt to your next message. (How to attach items to your post)
  Note: It will be at whichever location you ran RogueKiller from. I asked that you put it on your desktop, so it should be there.
• You can now type the number 0 and press ENTER to exit RogueKiller.

 

Ok, thanks for addressing that issue, had to shut down norton prior to running as the first 2 attempts it would not allow the program to run; also had to update program prior to running-attached is the log file it produced.

 

Are you having any other issues?

 

Other then not having access to certain folders i.e. "documents and settings" among others, no...no other issues at the moment, everything seems fine.

 

You're on Windows 7, those folders will be inaccessible. They were for Windows XP.

All your documents are in C:\users

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!