Need help with log-evaluation

Hello,

I got an email from my hosting service that said that "It appears that malicious code has been uploaded to your account via FTP using a stolen username and password".

They told me to clean my computer using the instructions found here: http://forums.majorgeeks.com/showthread.php?t=35407

I have tried to do that and now I have 4 logs. I didn't succeed with the RootRepeal. It just stopped working.

I will attach the logs and I hope someone can help me.

Thanks,
Bradebiz

 

Hi and welcome to Major Geeks, bradebiz!

http://img850.imageshack.us/img850/4746/programsandfeatureswin7.gif From Programs and Features (via Control Panel), please uninstall the below:

• Java(TM) 6 Update 22
• WhiteSmoke

http://img839.imageshack.us/img839/3005/combofixicon.gif Now we need to make use of ComboFix by sUBs

• Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop but do not run it!
  • If it is not on your desktop, the below will not work.
• Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
• Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]DirLook::[/COLOR]
C:\Program3
[COLOR="DarkRed"]File::[/COLOR]
C:\Users\Gudrun\AppData\Local\Temp\230787.od
C:\Users\Gudrun\AppData\Local\Temp\CVR8583.tmp.cvr
[COLOR="DarkRed"]FileLook::[/COLOR]
C:\Windows\system32\lpremove.exe
[COLOR="DarkRed"]Folder::[/COLOR]
C:\Users\Gudrun\AppData\Local\{40673D1A-04FF-430A-973D-D6781B55FC01}
C:\Users\Gudrun\AppData\Local\{7A489CBB-9BF8-4678-8EFD-B1E6CB24E928}
C:\Users\Gudrun\AppData\Local\{8D11AA1B-B90C-493C-8FDF-DDF641BE3961}
C:\Users\Gudrun\AppData\Local\{99D242B5-69EC-4A7E-9E86-9A9BB37315DD}
C:\Users\Gudrun\AppData\Local\{AD97C01F-8D6A-491F-97CE-82892E64E587}
C:\Program Files\WHITESMOKE
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[COLOR="DarkRed"]Registry::[/COLOR]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{20B5E272-CE75-4AC3-97D6-FE38ED77259C}]

• Save the above as CFScript.txt and make sure you save it to the same location (should be on your desktop) as ComboFix.exe
• At this point, you must exit all browsers now before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your desktop.
• Now use your mouse to drag CFScript.txt on top of ComboFix.exe.
  http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
• This shall launch ComboFix.
  Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
• Allow ComboFix to update itself if prompted.
• When it finishes, a log will be produced at C:\ComboFix.txt
  Note: If after running ComboFix you discover none of your programs will open up because you receive the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
• Attach this log to your next message. (How to attach items to your post)

http://img685.imageshack.us/img685/3557/tdsskiller.gif Now we need to run TDSSKiller by Kaspersky
Follow the instructions here and attach your log when you are finished. (How to attach items to your post)


Please download MBRCheck by GeeksToGo to your desktop.
See the download links under this icon http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

• Double click MBRCheck.exe to run (Vista and Win7 right click and select Run as Administrator)
• It will show a Black screen with some information that will contain either the below line if no problem is found:
  • Done! Press ENTER to exit...
• Or you will see more information like below if a problem is found:
  • Found non-standard or infected MBR.
  • Enter 'Y' and hit ENTER for more options, or 'N' to exit:
• Either way, just choose to exit the program at this point since we want to see only the scan results to begin with.
• MBRCheck will create a log named similar to MBRCheck_07.16.10_00.32.33.txt which is random based on date and time.
• Attach this log to your next message. (How to attach items to your post)

http://img51.imageshack.us/img51/6489/javaicon.gif Now install the current version of Sun Java from: Sun Java Runtime Environment

http://img822.imageshack.us/img822/6835/baticon.gif Now run C:\MGtools\GetLogs.bat by double-clicking it (Vista and Win7 right-click and select Run as Administrator)
Then attach C:\MGlogs.zip to your next message. (How to attach items to your post)
Notes:

• This will automatically update all the logs inside MGlogs.zip
• Make sure you click Accept on the License Agreement from Trend Micro HiJackThis - v2.0.4 twice if prompted.

 

Hi and thanks for your reply!

Yesterday night I uninstalled the two programs and then used the CFScript and the ComboFix.

This morning I started with the TDSSKiller, but I forgot to shut down Norton's antivirus etc. software. I also forgot to right click on the TDSSKiller program (I'm using Vista), so I don't know if the result is correct.

With the rest I think I did right.

Now there might be a problem with the MGlogs.zip, since I had it "work" for about 4 hours, but already after some minutes I saw the following result - and then nothing more happened:

-------------------------------------------------
32 bit Windows OS found

Running scan with GetUnKeys.bat - 08/11/2006 by Chaslang and ShadowPuterDude

32 bit Windows OS found
Updating: GetUnKey.txt <160 bytes security> <deflated 88%>

Running scan with GetRunKey.bat - <c> 01/28/2006 By Chaslang

Note: Ignore any error messages about not finding registry keys!
Just wait for the program to finish running!!

Updating: runkeys.txt <160 bytes security> <deflated 80%>

**************** WARNING *************************
If you see a popup saying that:
SteelWerX WhoAmI application has stopped working
Do not click the Cancel button that first appear. Wait for
the Close program button to appear and click it to continue
**************** WARNING *************************


Thanks,
Bradebiz

 

It looks like your Master Boot Record (MBR) may be infected as well. To be safe I think we should restore a clean copy.

Do you have your Windows Vista DVD? We need it to restore a clean MBR.
If you do not have your Vista DVD, you can create one with the Recovery Console (which is really all we need), here: Download Windows Vista 32-Bit (x86) Recovery Disc

MBR infections are only worsening and sometimes (rarely) make the computer unbootable after attempting to correct it. We recommend that you back up your data before hand. Then continue with the below if you wish to attempt to remove this infection:

Read the following: How to use the Command Prompt in the Vista Windows Recovery Environment

Once you get to the Command Prompt section (Figure 6. Command Prompt in the Windows Recovery Environment)

• Now type in: bootrec /fixmbr and press ENTER afterwards.
• Note: There is only a SPACE after bootrec
• Now you will see:
• http://img19.imageshack.us/img19/4114/operationcompletedsucce.png
• Type exit and press ENTER.
• Now restart your computer WITHOUT booting off the DVD again (don't press a key when it says... "press any key to boot from cd/dvd...")

Once back in Windows.. Re-run MBRCheck and attach its latest log.

http://img651.imageshack.us/img651/733/mgtools.png Now download a new MGtools to the root of your C:\ drive (not to your desktop!).
Refer to the following: Using MGtools
Attach MGlogs.zip if it creates this time. (How to attach items to your post)

LET ME KNOW HOW THE PC IS RUNNING AFTER YOU HAVE COMPLETED THESE STEPS​

 

I made the backup this morning and downloaded the Windows Vista recovery disc and read the instructions.

When I tried to boot with the disc nothing happened it just continued to load the normal way.

Then I tried to boot without the disc to "slowly tap the F8 key..." as was written in the "How To Use The Command Prompt...", but nothing happened - it just loaded the normal way again.

Could it be that the CD Emulation programs are disabled?

I don't find the original disc for Windows Vista.

Thanks for your help!

 

Did you unzip/extract the Vista_Recovery_Disc.iso from .zip file you downloaded?

You may have burned it as a Data disc which would explain why it does not boot off Cd/Dvd.

Here are the steps to burn it is an Image.

Please download ImgBurn to your desktop.
See the download links under this icon: http://forums.majorgeeks.com/chaslang/images/MGDownloadLoc.gif

Install ImgBurn by double-clicking SetupImgBurn_2.5.6.0.exe
Don't install the Ask toolbar that tries to install itself by default. (uncheck all of their boxes)

• After Installation
• Double-click Vista_Recovery_Disc.iso
• Insert a blank CD-R or DVD-R.
• Press the Write button.
• Wait as the CD/DVD is being created, when finished, try booting off of this CD/DVD.

Now boot off this CD/DVD and complete the steps outlined in my prior post. Let me know how the PC is running afterwards.

 

Hello,

The DVD is still ignored and the "normal" logging in happens.

The files I see on the DVD are:
2 file folders: boot and sources
1 file: bootmgr

Thanks!

 

Let me know if the DVD is still ignored after you do the following:

When the DVD is in the tray,
Reboot your PC
At the HP splash screen (see below)
http://pickledpc.com/wp-content/uploads/2009/10/hp_splash1.jpg
Press the Esc key on your keyboard
This should take you to the Boot Menu
From here you should be able to select your DVD rom drive.
Note: According to your logs, it is named: Optiarc DVD RW AD-7561S ATA Device

After you press ENTER after highlighting the DVD-Rom drive, be ready to press any key on the keyboard (feel free to press a bunch of keys) when you see the below:
http://www.bleepstatic.com/tutorials/vista-repair-options/boot-from-cd-prompt.jpg

If nothing is wrong with your DVD rom drive or DVD, it will boot off the DVD you created.

Let me know the outcome.

 

Hi and thanks for your help and patience!

I deleted the MGtools and the old folder (I don't know if that was right).
After disabling the Norton AV I downloaded the new MGtools and run it but I forgot again to right click and run it as an Administrator!

In any case I find that my PC runs very well and faster than before.

Hope I haven't done too many errors.

Thanks again!

 

You're welcome. Your latest logs are clean. MBR is fixed as well.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!