Trojan Agent and Trojan Downloader

Today I downloaded the latest version of MalwareBytes, using the link from MG.
On full scan it detected the following:

Trojan Agent
Trojan Downloader.

What should I do?

Also though the scan has finished, when I tried to exit MalwareBytes, it came up with a message that MB is still running and if I attempt to exist I shall lose results of scan. This seems strange since I have been using MB for years, and never encountered this message.
Is this malware or is this some problem with the new version?

Please advise. Thanks

 

I did exit. But the message that came up said something like: MB is still scanning your system. If you exit now, you will lose all data.
I just pressed Yes to exit and that was it.

I have attached the logs also. Thanks.

 

Here's the log file for combofix.

 

Hi,

I'm currently reviewing your logs, please be patient as there is a lot of information to review.

 

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:

Code:

KILLALL::

Folder::
C:\Program Files\AskBarDis

Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
[-HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
  
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Couple of things I wanted to ask:

I did attach ComboFix.txt and MGlogs.zip folder in my previous emails, so
a Will the new files be different from the older ones.
b The new log file will also appear in C: where the older logs from ComboFix and MGlogs are still present. Is that okay or should I change something.

One other thing I ran the entire Read and Run malware removal guide. The only step I forgot to carry out is the toggle system restore. I realised that after sending the logs.
Should I do it now or later after I get your instructions.

In the meantime I'll also follow your instructions below. Thanks a bunch thiisu.

 

once you run C:\MGtools\GetLogs.bat

They will produce all new logs, including the combofix.txt log

Don't toggle system restore just yet, I want to make sure the latest logs are clean

 

Hi. Thanks for the quick response. Appreciate it.

Please see logfiles for Combofix and MGtools attached.

Thanks again.

 

Perfect, analyzing now

How is the computer running now?

 

I haven't run MalwareBytes so far, since I didn't want to do anything that you wouldn't advise.

The computer is running fine. Like I said in the initial email, it was MalwareByte's new version's behavior that got me thinking.

Plus, one thing I didn't mention was that my Hotmail account was apparently hacked, the same day. At least it was sending out spam to all my email contacts. That had never happened before though I've had this account for years. I immediately changed password. So far it seems okay, haven't heard any new complaints from my contacts.
Thanks thisisu. You've been very helpful. Awaiting your reply.

 

Do you want me to run MB.

 

Your initial MB log was clean, however, if you had some difficulty running it before, try to do a quick scan with it.

Upon completion, Attach the latest MB log

Some malware infections will do this, on the bright side, I don't see anymore malware in your logs, but please be patient because I'd like to check with another member of the malware team before we proceed to the final procedures.

Thank you for your continued patience

 

One problem I faced yesterday after running the combofix and MGtools was the inability to access Majorgeeks.com
Does that have anything to do with malware.

 

Very unlikely based on your logs

Did mbam find anything? Can you please run a quick scan and attach the log

 

I ran a quick scan. The log is attached.

I then ran a full scan. I once again found the following:

Trojan Agent
Trojan Downloader.

I took no action against the scan results.

MalwareBytes did not save the log as it usually does. And I didn't save it to another location thinking that MB would do so.

After the full scan I wanted to exit the program, and again I got the original message that "A scan is in progress. exiting the program would result in loss of scan data." These are not the exact words, but to that effect.

Apparently there is still something wrong.

 

Your quick scan mbam log is clean.

The message you are getting is normal when you do a full scan and don't take any action against the results of mbam. Most likely, it is picking up infected restore points, which we are about to flush in our final steps

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

 

I cannot find HijackThis in add remove. Is that a concern, or should I proceed to next step without doing add remove of HijackThis.

 

Proceed to the next step.

You're OK Thanks for double checking though

 

Hi Thisisu,

Gone through the steps you advised me to do, and am finished with those.

Any final steps that I should do. What about the full scan results from MB, showing the Trojans.

 

Upload the mbam full log here, I'd like to see what it's detecting.

 

Hi,

Here's the full scan log.
On exit I got the same message that a scan is in progress, do not exit. Never got that with the old version of MB.

Thanks Thisisu. You've been great.

 

Code:

c:\program files\typingmaster\[COLOR="Red"]run the patch.exe[/COLOR] (Trojan.Downloader) -> No action taken.

This is from a torrent. A .exe hacktool/bypass to get full benefits of the program I'm guessing.

I don't know where you downloaded this from, some of these are safe and some aren't. We don't recommend that you download any torrents as this is how a lot of people get malware in the first place.

Sometimes mbam, and other virus removal tools will detect some of our repair tools as hacktools/trojans, these are called false positives.

I don't see the torrent you downloaded doing anything out of the ordinary from your logs, but just a friendly reminder, BE CAREFUL!

How to Protect yourself from malware!

 

I got the software from a friend and have used it for over a year. It has'nt caused me any problems so far.

Thisisu, can we now say that the Trojan Downloader is not causing me any problems, and that I need not take any action.

If so, I'd just like to say youve been great help, more than that actually. Thanks a thousand and finally I can smile.

Is it safe to smile?

 

Safe to smile :celebrate

 

Will do so at once. Thanks:-D