Thanks!

Discussion in 'Malware Help (A Specialist Will Reply)' started by oldgearhead, Jun 2, 2008.

  1. oldgearhead

    oldgearhead Private E-2

    The early warning signs went from subtle to very annoying:
    • At startup Windows Firewall would be turned off.
    • System Restore could not be accessed.
    • Most links displayed in the Google search results page would be re-directed to either porn or junk software sites.

    At first I was pretty sure this was a “Banker C (ntos.exe)” infection, because the Windows\System32\Drivers\Etc\Hosts file had several entries pinned to 127.0.0.1 (Localhost). I removed the extra entries and restored 127.0.0.1 Localhost as the only active line. I also checked Windows\System32\Drivers\Etc\Lmhosts, and it contained no active entries. Also there were a couple of separate entries in the ‘Etc’ folder: tmvsthfss.bin and tmvsthfud.bin. I renamed these. However, they are probably just part of an anti-virus ‘dos-like’ scan.

    I did a virus scan using CA. Since the scan didn’t turn up much of anything, I un-installed CA, went to one of the ‘Big Box’ stores and purchased a copy of TrendMicro Antivirus Plus 2008. This is where the story gets interesting. After I installed the TrendMicro, I discovered it was unable to connect to either TM’s registration or their Update server. The message returned was “No internet connection detected”. However, Hotsheet, eBay, the major retail sites, and all of the news services could be accessed normally. Next I discovered I could not ‘ping’ or access many of the major anti-virus site like: TrendMicro, Major Geeks, Symantec, CA, and etc.

    I was getting nowhere fast, so I downloaded your tools and started in:
    CCleaner - would run for a few minutes then re-root the PC. This happened in either ‘normal’ or ‘safe’ mode.

    SUPERAntiSpyware – This ran fine after the two kernel references were unchecked.

    Spybot – ran normally.

    Malwarebytes – Had to be renamed before it would install. Even then it would only run in ‘Safe’ mode.

    Combofix – Windows locked on its wallpaper after Combofix was running for a while. I waited 20 minutes and did a hard-button re-boot. I noticed the clock had not reset and I couldn’t find the log. So, I ran it again. Even though the clock was not reset until a couple of re-boots later, I did find a log file. Furthermore, TrendMicro found it’s servers as soon as I enabled it, and I could access both Symantec, and Trend Micro’s web pages.

    MGtools – No surprises it ran as documented.

    CCleaner - also runs normally now.

    Thanks for your excellent help. The issues I still have to deal with are: System Restore, that pesky Adobe ‘apdproxy.exe’, and two Windows updates (KB928365 & KB928366) for .NET that won’t install. These problems may not be directly related to the browser hijack. Logs are attached…
     

    Attached Files:

    oldgearhead, Jun 2, 2008
    #1
  2. oldgearhead

    oldgearhead Private E-2

    ..and the other two logs are attached..
     

    Attached Files:

    oldgearhead, Jun 2, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcomet to Major Geeks!

    The tm stands for TrendMicro! ;)

    It still did not run properly. We will be trying again below with a different procedure.

    What are the problems?

    Do you know what the below folder and file are for?
    Code:
    2006-10-03 01:53 10,240 --sha-w C:\WINDOWS\rnapxs\rnapxs.dat
    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall the below old versions of software:
    Java 2 Runtime Environment, SE v1.4.2

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe"
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
    O23 - Service: Server lanmanserverRasMan (lanmanserverRasMan) - Unknown owner - C:\WINDOWS\TEMP\3.tmp.exe (file missing)
    O23 - Service: PPCtlPriv - Unknown owner - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe (file missing)

    After clicking Fix, exit HJT.




    Now we need to use ComboFix , please shutdown as much of TrendMicro as possible before continuing. If the below does not work in normal boot mode, try it in safe boot mode.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot (into normal mode), now install the current version of Sun Java from: Sun Java Runtime Environment

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.



    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jun 2, 2008
    #3
  4. oldgearhead

    oldgearhead Private E-2

    Thanks again for staying with me on this. Its getting late so I won't be doing much tonight. However, I have a couple of answers and issues:
    1) I have no idea what rnapxs is all about.
    2) The disable/remove Messenger executed okay.
    3) Uninstall Java Runtime Environment SE V1.4.2 gave the "The installation sourse for
    this product is not available. Verify the program exits etc, etc, etc." error box.
    Should I try to delete it with Explorer Program Files?
    4) All tries to access System Restore result in an 'Exception Information" box:
    Code: Oxc0000005 Flags: Ox000000000
    Record: Ox000000000000 Address: Oxc000000005c029836
    etc, etc, etc.

    5) All tries to restore System Restore with sr.inf have failed. My PC has the download
    versions of both SP2 and SP3. Should I try to un-install SP3 and try again?

    The good news is I can now view your web-site from the infected PC.
     
    oldgearhead, Jun 3, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Then delete that folder.

    No! Try using this to see if it can uninstall it: Your Uninstaller! 2008

    These are issues for the Software Forum.

    I need to see the new logs from the end of my previous fix.
     
    chaslang, Jun 3, 2008
    #5
  6. oldgearhead

    oldgearhead Private E-2

    1) Removed folder: "rnapxs"

    2) YouUnstaller was sucessful in romoving: "Java 2 runtime Enviornment SE v1.4.2" (Nice Program!)

    3) Hjt repaired the items referenced in your post.

    4) ComboFix: Log was created, but clock is still 24 hour. If its like the last session, another re-boot will fix the clock.

    5) Installed the new Java Runtime

    6) A 'sucess' was indicated after running: Fixme-dot-reg.

    7) Ran CCleaner.

    Logs are attached. PC seems to run fine. However, I haven't checked spent
    much time on it yet.

    What can you tell from the logs?
     

    Attached Files:

    Last edited: Jun 3, 2008
    oldgearhead, Jun 3, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to attach only the logs requested. I did not ask for a HijackThis log. I need the new MGlogs.zip file requested at the end of my previous fix.
     
    chaslang, Jun 3, 2008
    #7
  8. oldgearhead

    oldgearhead Private E-2

    ..sorry, I thought it was the same file. the HJT_2.txt file is the log that was displayed when analyse was complete..

    MGlogs.zip is attached.
     

    Attached Files:

    Last edited: Jun 3, 2008
    oldgearhead, Jun 3, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You were not saving a log at that point. My instructions said
    And we don't need individual HijackThis logs. They are automatically run an put into the MGlogs.zip file.

    You did not allow GetLogs.bat to finish running. As a result, just about everything in it is old. This time make sure you let it finish running. Some to the below may be unnecessary but I cannot know for sure since your logs are not current.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    After clicking Fix, exit HJT.

    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Re-Run the fixme.reg patch that you created last time.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Make sure you let it finish running!!!

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jun 4, 2008
    #9
  10. oldgearhead

    oldgearhead Private E-2

    The PC seems to be fine,
    Here are the files:
     

    Attached Files:

    oldgearhead, Jun 4, 2008
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your problem has spread/mutated into another service name. I'm not sure if this is happening because you may have shutdown or rebooted inbetween posting your logs and me giving you a fix OR if something else is hiding. Please do the below.


    Now we need to use ComboFix again.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    Run this Running GMER to detect rootkits and attach the log

    The get a new MGlogs.zip file and attach it. Also attach the new C:\combofix.txt log.

    Then DO NOT shutdown or otherwise reboot your PC until I get back to you with the next fix.
     
    chaslang, Jun 5, 2008
    #11
  12. oldgearhead

    oldgearhead Private E-2

    Here are the 2 txt files:
     

    Attached Files:

    oldgearhead, Jun 5, 2008
    #12
  13. oldgearhead

    oldgearhead Private E-2

    ...and the MGlogs:

    Do you think its time to un-install TrendMicro?
     

    Attached Files:

    Last edited: Jun 5, 2008
    oldgearhead, Jun 5, 2008
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not unless you are unhappy with it.

    Your ComboFix log is incomplete. Did you have a problem running it? Any error messages? Did it get hung?

    Please shut down TrendMicro and try again. Attach new logs from ComboFix and MGlogs.zip. I don't need you to run GMER again. It did not find anything.
     
    chaslang, Jun 6, 2008
    #14
  15. oldgearhead

    oldgearhead Private E-2

    The last line I saw in the ComboFix blue dos-type window was 'push any
    key to continue'. It didn't seem to hang. However, my clock didn't get
    changed from 24 hour. There are 2 or three combofix.txt files on the PC
    I simply attached the one with some content and the correct date.
    Should I start ComboFix, save as last time, by dragging CFscript to it?

    Should I run MGlogs.exe before attaching the MGlogs.zip file?

    I won't see my home PC again for another 8 hours. But I want to be very
    sure I'm familiar with the next step.

    Again thanks for your continued help in this matter.
     
    oldgearhead, Jun 6, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This normally happens when ComboFix does not finish running properly. You can fix your clock from Control Panel ->Regional and Language Options and then on the Regional Options tab click the Customize button then on the next form click the Time tab. Then change the Time format to what you want. It explains there what the lower case and upper case letters will do. Upper case H is giving you 24 hour clock settings.

    Delete all of the current ComboFix text logs you see.

    Yes.

    No, there is no such file as MGlogs.exe (perhaps you meant MGtools.exe but you should not be running it either). You run GetLogs.bat just like requested back in msg # 9. Then attach the new log.
     
    chaslang, Jun 6, 2008
    #16
  17. oldgearhead

    oldgearhead Private E-2

    I guess I have dumb question: How do I know when Combofix is finished
    running? The very last thing that happens when it runs on my PC is the
    log (Title: log.txt) is displayed the date time and date is correct on the
    log and EOF is displayed at the end. However, nothing happens after the
    log is displayed, and the clock is not returned to 12 hour. I have waited 30
    minutes and nothing else happens, so I close the log file. Is this normal?

    "When finished, it will produce a log (C:\Combofix.txt) for you. You will
    need to attach this log to your next message."

    Requested files are attached.
     

    Attached Files:

    oldgearhead, Jun 7, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay something is stopping ComboFix from running properly. I also just noticed that you are using MSconfig again. You must not use MSconfig to permanently control startups. Please read the info in step 1 of the READ ME again.

    We have one more item to fix.


    Copy the bold text below to notepad. Save it as fixCF.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Make sure that you tell me if you receive a success message about adding the above
    to the registry. If you do not get a success message, it definitely did not work.

    If you are not having any other malware problems, it is time to do our final steps:
    1. You can uninstall SUPERAntiSpyware now.
    2. We recommed you keep Malwarebytes Anti-Malware as a scanner. It uses no resources except a little disk space until you run a scan.
    4. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop & renamed it like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\cf" /u
        • Notes: The space between the cf" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
      • Delete the C:\cf folder from combofix.
    5. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    6. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    9. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    10. Go to add/remove programs and uninstall HijackThis.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Jun 8, 2008
    #18
  19. oldgearhead

    oldgearhead Private E-2

    ..The .reg merge was sucessful. As far as MSCONFIG goes, it was 'normal'
    last time I looked. However, I 'played' with 'Your Unstaller' start-up program
    a bit. Doing this probably changed MSCONFIG.

    Computer seems fine. I'll make another stab at repairing 'System Restore'.

    Thanks again!
    JRS (aka: oldgearhead)
     
    oldgearhead, Jun 10, 2008
    #19
  20. oldgearhead

    oldgearhead Private E-2

    Wow! "System Restore" is working! Even though I had everything ready,
    WIN_XP and SP2 cds to try to re-install it, I didn't have to. It just started
    working after cleaning out all the Malware...

    Thank you, Thank you..
     
    oldgearhead, Jun 10, 2008
    #20
  21. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jun 10, 2008
    #21

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds