Possible Maleware - followed steps already

Discussion in 'Malware Help (A Specialist Will Reply)' started by moonkei, May 11, 2008.

  1. moonkei

    moonkei Private E-2

    So last week, I ran Kaspersky Scan and it picked up Worm.Win32.AutoRun.bdl
    This happened when my wife inserted her SD card into the laptop.

    So Kaspersky cleaned that up for me. (I think.)

    My buddy told me I should try running Trend Micro just to be sure.

    When I ran Trend Micro Housecall, it picked up:
    ADWARE_BESTOFFERS

    I think it's picking up Kaspersky cus the discription says Alias could be:
    PAK:pE_Patch.PFD(Kaspersky)

    The description on their website is pretty vague, and it even says it's possible that it was picked up from Kaspersky. So I'm not sure if this is a threat.
    To be on the "sure" side, I came across this great forum.

    I've followed every step in your FAQ. I've not skipped anything. All the scans have come up Clean so far, no issues. I'm on the last 2 steps in your Walkthrough, and just finished running Combo Fix.

    I'm not sure how to read through this log, so I've attached it hoping you have time for some feedback before I proceed to the next step.

    And thank you guys in advance, your FAQ has been a big help so far, and very easy to follow. :)
     

    Attached Files:

    moonkei, May 11, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    You need to attach all of the requested logs.

    Where did TrendMicro find what it detected? Do you have a log you can attach?

    Is drive F your USB drive. It may have infected files on it. Like the below:
    F:\ntdelect.com <-- in this one the l is a lower case L
    F:\ntdeIect.com <-- in this one the I is a capital i
     
    chaslang, May 11, 2008
    #2
  3. moonkei

    moonkei Private E-2

    I'll have to rescan with Trend Micro again, but as for the SD Drive, that Kaspersky detected the virus from is:

    F:\autorun.inf

    I'll post the log for Trend Micro by tomorrow morning after the rescan. Did you need anything else?

    Thanks,

    Moonkei
     
    moonkei, May 11, 2008
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you look for the files mentioned on ALL drives. Also you need to attacht the other logs requested in the READ & RUN ME.
     
    chaslang, May 11, 2008
    #4
  5. moonkei

    moonkei Private E-2

    I hope I don't sound like I'm trying to skip any steps, if I do, I'm sorry about that.

    I did not save the logs when I did SAS, S&D, & Malewarebytes since they all came out clean. I'm repeating those steps now though, just so you can view those 3 logs. (Will Post ASAP when redone)

    I also ran Trend Micro House call again, Complete Scan and took a screen shot to show you. If you do not wish to view the screen shot or it's against forum policy, I've typed out the 2 Grayware for you here:

    HKLM\SOFTWARE\Classes\TypeLib\{EDDBDEA4-5C07-453F-BE8C-81D738984381}\

    HKCR\TypeLib\{EDDBDEA4-5C07-453F-BE8C-81D738984381}\


    Image:
    http://www.moonkei.com/mal.jpg
     
    moonkei, May 11, 2008
    #5
  6. moonkei

    moonkei Private E-2

    SAS and MBAM log have been attached for you.

    Thanks,

    Moonkei
     

    Attached Files:

    moonkei, May 11, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are still missing the log from MGtools! Did you not work thru the whole procedure to where it specified which logs are required?

    Did TrendMicro remove those registry keys?
     
    chaslang, May 11, 2008
    #7
  8. moonkei

    moonkei Private E-2

    O, I haven't gone to that step yet, I had finished Combo Fix and that was the last scan/first log I attached. I wasn't sure if I should proceed to MGtools or wait on the feedback for the steps I've done.
     
    moonkei, May 11, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    As requested in the READ ME, all steps need to be run and the logs are requested at the very end when all steps have been finished.
     
    chaslang, May 11, 2008
    #9
  10. moonkei

    moonkei Private E-2

    Sorry about the confusion Chaslang, and Thank You for your patience.

    I've ran everything as requested, and it will not let me upload the same files again for you to view easier but I've attached the last one you need.


    MGlogs.zip

    Thank you again for the quick reply, I really appreciate the help.

    Moonkei
     

    Attached Files:

    moonkei, May 11, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean. I just have a couple of minor things you should do.


    Uninstall the below old versions of software:
    Java(TM) SE Runtime Environment 6

    Then reboot your PC.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
    C:\WINDOWS\Temp
    C:\Documents and Settings\Administrator\Local Settings\Temp

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Are you currently having any malware issues?
     
    chaslang, May 12, 2008
    #11
  12. moonkei

    moonkei Private E-2

    I was able to delete what I could in:
    C:\WINDOWS\Temp

    But I could not open this Folder for some reason, it's faded out, and shows 0 bytes.
    C:\Documents and Settings\Administrator\Local Settings\Temp

    When I try to access it, I get a message:
    "C:\Documents and Settings is not Accessible
    Access is Denied"

    -Yes, I did get a success message when I added the fixme.reg

    My Main issues was I wanted to do a thorough check on this laptop after that initial virus from the SD card. Kaspersky didn't pick up anything else after that.

    But, when I ran Trend Micro Housekeeping, I was a little paranoid as to what the "greyware" it picked up was. I'll repost it here to make it easier for you to view. The .jpg is a screen shot of the Trend Micro Scan.


     
    moonkei, May 12, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    But I asked if TrendMicro fixed this. You did not reply. Are you still getting this?
     
    chaslang, May 12, 2008
    #13
  14. moonkei

    moonkei Private E-2

    I did not tell it to Fix it yet, since I didn't want it to affect Kaspersky if that was the issue. I can go ahead and run the scan again when I get home, and tell it to
    clean/delete it this time.

    It's weird because I get the exact same thing detected on my new rig with Trend Micro. I have nothing installed on the new Rig either besides Kaspersky and Window Updates.
     
    moonkei, May 12, 2008
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It may already be fixed from my fixME.reg patch.

    They are not major issues and could just be left overs from some specific application that was installed. Could have been a Smileys type program. See: http://www.trendmicro.com/Vinfo/grayware/ve_graywareDetails.asp?GNAME=ADWARE_BESTOFFERS&VSect=Sn
     
    chaslang, May 12, 2008
    #15
  16. moonkei

    moonkei Private E-2

    moonkei, May 12, 2008
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\cf" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    3. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    4. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    5. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Go to add/remove programs and uninstall HijackThis.
    7. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    8. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    9. After doing the above, you should work thru the below link:
     
    chaslang, May 12, 2008
    #17

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds