Logs attached - Any help appreciated

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Danny92, Apr 16, 2011.

  1. Danny92

    Danny92 Private E-2

    Hello guys, I've used the forums a few times before now and I'm having a few problems at the moment with some malware so I thought it best to seek advice.

    I've followed the malware removal guide and have collated all of the necessary logs (please find attached), however I ran into some problems with RootRepeal (as I saw somewhere else, I will make a note of the error and discuss with a trained helper later on).

    Any help would be much appreciated and I thank you in advance.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now let's use ComboFix to remove a bunch of malware files.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::
    
    File::
    c:\documents and settings\Dad\Application Data\hFnOKi2.js
    c:\documents and settings\NetworkService\Application Data\GryaSsX.js
    c:\documents and settings\Dad\Application Data\teFHH.js
    c:\documents and settings\NetworkService\Application Data\oJWOmP.js
    c:\documents and settings\NetworkService\Application Data\YJVNoxwYY.js
    c:\documents and settings\NetworkService\Application Data\icZOv4UQ.js
    c:\documents and settings\NetworkService\Application Data\uvLtnG4.js
    c:\documents and settings\NetworkService\Application Data\eMLxp.js
    c:\documents and settings\NetworkService\Application Data\IMygvPcA.js
    c:\documents and settings\NetworkService\Application Data\su8P2fwf.js
    c:\documents and settings\Dad\Application Data\YuUkA.js
    c:\documents and settings\NetworkService\Application Data\cXWxqfz4l.js
    c:\documents and settings\NetworkService\Application Data\fMwAf.js
    c:\documents and settings\NetworkService\Application Data\cj8Yt2.js
    c:\documents and settings\NetworkService\Application Data\NPNTJk4.js
    c:\documents and settings\NetworkService\Application Data\oCCvjlq1.js
    c:\documents and settings\NetworkService\Application Data\tS0zTvZte.js
    c:\documents and settings\NetworkService\Application Data\rBtuI.js
    c:\documents and settings\NetworkService\Application Data\dlJU3MpXfW.js
    c:\documents and settings\NetworkService\Application Data\wvMMwAgg.js
    c:\documents and settings\NetworkService\Application Data\eP8sXf.js
    c:\documents and settings\NetworkService\Application Data\qgG2mPk6tr.js
    c:\documents and settings\NetworkService\Application Data\s8gxXWsE.js
    c:\documents and settings\NetworkService\Application Data\yQGnPI5.js
    c:\documents and settings\NetworkService\Application Data\d6Uc9.js
    c:\documents and settings\NetworkService\Application Data\UuzA1gPBpm.js
    c:\documents and settings\NetworkService\Application Data\Qu8am6T.js
    c:\documents and settings\NetworkService\Application Data\eW2ToZ.js
    c:\documents and settings\NetworkService\Application Data\Y0kPom1uY.js
    c:\documents and settings\NetworkService\Application Data\obyyJoFjyZ.js
    c:\documents and settings\NetworkService\Application Data\K20e1KSF4.js
    c:\documents and settings\NetworkService\Application Data\kfThmEie8.js
    c:\documents and settings\NetworkService\Application Data\sggBBtkl.js
    c:\documents and settings\NetworkService\Application Data\RzU1QO2r8.js
    c:\documents and settings\Dad\Start Menu\Programs\Startup\hgpopjyu.exe
    C:\hgpopjyu.exe
    c:\windows\TEMP\54.tmp
    c:\windows\TEMP\31.tmp
    c:\windows\TEMP\60.tmp
    c:\windows\TEMP\90.tmp
    c:\windows\TEMP\67.tmp
    c:\windows\TEMP\8D.tmp
    c:\windows\TEMP\4E.tmp
    c:\windows\TEMP\62.tmp
    c:\windows\TEMP\4F.tmp
    c:\windows\TEMP\52.tmp
    c:\windows\TEMP\5D.tmp
    c:\windows\TEMP\51.tmp
    c:\windows\TEMP\5A.tmp
    c:\windows\TEMP\3C.tmp
    c:\windows\TEMP\34.tmp
    c:\windows\TEMP\6F.tmp
    c:\windows\TEMP\3F.tmp
    c:\windows\TEMP\55.tmp
    c:\windows\TEMP\81.tmp
    c:\windows\TEMP\6A.tmp
    c:\windows\TEMP\70.tmp
    c:\windows\TEMP\46.tmp
    c:\windows\TEMP\6B.tmp
    c:\windows\TEMP\37.tmp
    C:\Program Files\xovbytmu\hgpopjyu.exe
    C:\Documents and Settings\LocalService\Local Settings\Application Data\beatcgtl.log
    C:\Documents and Settings\LocalService\Local Settings\Application Data\higgajqt.log
    C:\Documents and Settings\LocalService\Local Settings\Application Data\hvqfkvbh.log
    C:\Documents and Settings\LocalService\Local Settings\Application Data\qqkbvbxo.log
    C:\Documents and Settings\LocalService\Local Settings\Application Data\uwqhkxph.log
    C:\Documents and Settings\LocalService\Local Settings\Application Data\wshewwtn.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\beatcgtl.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\higgajqt.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\hvqfkvbh.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\qqkbvbxo.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\uwqhkxph.log
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\wshewwtn.log
    C:\Documents and Settings\Dad\Application Data\hFnOKi2.js
    C:\Documents and Settings\Dad\Application Data\tdfboxu1woig1bspv1dicande1breqz2
    C:\Documents and Settings\Dad\Application Data\teFHH.js
    C:\Documents and Settings\Dad\Application Data\YuUkA.js
    C:\Documents and Settings\Dad\Local Settings\Application Data\beatcgtl.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\fkabysyw.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\higgajqt.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\hvqfkvbh.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\qqkbvbxo.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\uwqhkxph.log
    C:\Documents and Settings\Dad\Local Settings\Application Data\wshewwtn.log
    C:\Documents and Settings\All Users\Application Data\23846708
    
    Folder::
    C:\Program Files\xovbytmu
    
    Registry::
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\25342c38]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\2e9d4920]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\33331ad0]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\4281a320]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\49c4e550]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\61179b20]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\673092f0]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\71d31d08]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\73898340]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\78dae668]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\80884ef0]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\9168e478]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\95ebeb00]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\9847d8c8]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\a27a040]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\af247fe0]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\b0b260c8]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\ba3ecf58]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\c041f618]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\c4f9b320]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\d7769b80]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\d802500]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\d899c9b8]
    
    [-HKEY_LOCAL_MACHINE\System\ControlSet002\Services\e4d7b370]
    
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "Userinit"="C:\WINDOWS\system32\userinit.exe,"
    
    
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the previous file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    [​IMG]
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!


    Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

    • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
    • Click the Start Scan button.
    • Do not use the computer during the scan
    • If the scan completes with nothing found, click Close to exit.
    • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_14.17.05_log.txt) will be created and saved to the root directory ( usually Local Disk C ).
    • Attach this log to your next message


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

    Then attach the below logs:
    * TDDSKiller log
    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
  3. Danny92

    Danny92 Private E-2

    Hello Tim, first of all let me thank you for getting back to me, I can't explain how tedious it has been getting over the past week or so!

    I followed the combofix stage as you said, however it is telling me that my version of ComboFix is corrupt (when I've used it before? :S). This is after creating the .txt file and drag and dropping it on to the ComboFix icon as you directed, and after downloading the latest update.

    I didn't want to proceed by myself as I always end up making things worse! lol

    If you could advise me accordingly that would be great. Just to let you know I'm from England so my replies might be a bit delayed but I'll try my best to work to your times.
     
  4. Danny92

    Danny92 Private E-2

    I have run all of the relevant scans as you asked however I cannot even open my web browser now to attach the files.

    Not too sure what to do from here?
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Transfer the logs to a different computer and attach them that way. As for ComboFix, I hope you installed the latest version from the Read and Run First instructions.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds