Help needed clearing out the remnants of Windows security/redirect virus

I first started having virus problems many months ago. The fake windows security window popped up telling me the sky was falling but all could be fixed if I purchased their antivirus. This was coupled with the redirecting of all search engine links, the hiding of all my desktop and start menu programs, task manager and windows firewall/defender disabled, etc. I had to boot to safe mode and started cleaning things up. I used all sorts of tools found on various forums where others were having similar problems and eventually I thought I'd cleaned everything up. Fast forward to December and I again started running into some issues. In Firefox I again started getting weird redirections and I suspected I was fully infection free. That's when I stumbled upon this forum and I went through the full READ ME step by step. Now I'm still getting redirected sometime when clicking links in firefox. It only happens about 15% of the time but it's always to a similar page. If I hit ctrl+F5 and re-click the link it will usually work. Also, windows firewall and windows defender seem to be disabled in some way. I'm running Vista and I've got all my logs. Please help.

 

This was the only log showing up in Malwarebytes. I re-installed and ran malwarebytes again just now and that's all that shows up in the logs tab.

 

Hi and welcome to Major Geeks, bmdubpk!

http://img850.imageshack.us/img850/4124/mbam.gif Did you run another scan with MBAM after running MGtools.exe?
You ran MGtools on January 10, 2012

http://img17.imageshack.us/img17/3214/baticonvista7.gif Can you also run the following look.bat file attached to this message as Administrator by right mouse clicking and selecting "Run as Administrator".

Then attach the look.txt log file on your desktop.

 

Yes, I re installed it and ran it today 1/14 when I saw only the two previous logs. The log file is attached.

 

Does MBAM complete successfully? Are you pressing the Quick Scan button when you run (open) it?

 

yes, I can run it again if you'd like and grab a screen shot.

 

Please do
I will prepare a fix for you in the next few minutes

 

Do you know what all these files and folders are on your desktop?

Code:

7cevc.jpg     Mar  7 2011      617127  "7CevC.jpg"
asdf.jpg      Jun 28 2011      121231  "asdf.jpg"
BA101         Oct 17 2011              "BA101"
cfng0.jpg     Nov 23 2011      746957  "CfNg0.jpg"
crx7x.jpg     May 30 2011      373817  "CrX7X.jpg"
g1ndm.jpg     Oct  9 2011      584703  "G1NdM.jpg"
jbgp8.jpg     Apr 21 2011      771251  "JBGp8.jpg"

If not, please delete.

http://img194.imageshack.us/img194/4930/combofix.gif Fixing items using ComboFix
Make sure that ComboFix.exe that you downloaded while doing the READ & RUN ME is on your desktop -- but do not run it.
If it is not on your desktop, the below will not work.
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Open Notepad and copy/paste the text in the below code box into Notepad:

Code:

[COLOR="DarkRed"]KillAll::[/COLOR]
[COLOR="DarkRed"]ClearJavaCache::[/COLOR]
[COLOR="DarkRed"]Driver::[/COLOR]
5689
[COLOR="DarkRed"]File::[/COLOR]
c:\windows\TEMP\5689.sys
c:\windows\isRS-000.tmp
C:\Users\Bmdub\AppData\Local\370173d2u587h743k306j0xyi3v8
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\Templates\370173d2u587h743k306j0xyi3v8
C:\ProgramData\370173d2u587h743k306j0xyi3v8
C:\Users\Bmdub\AppData\Local\d5ie34x6bh5jvr
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\Templates\d5ie34x6bh5jvr
C:\ProgramData\d5ie34x6bh5jvr
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\Templates\l5f2ld1lv2762m1851b1q8m32lw72bihbdsw65
[COLOR="DarkRed"]Folder::[/COLOR]
C:\Windows\$NtUninstallKB2301$
C:\ProgramData\PC Tools
[COLOR="DarkRed"]RegLock::[/COLOR]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[COLOR="DarkRed"]Registry::[/COLOR]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc]
"DisplayName"="@%SystemRoot%\\system32\\FirewallAPI.dll,-23090"
"Group"="NetworkProvider"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
00,65,00,4e,00,6f,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,00,00
"Description"="@%SystemRoot%\\system32\\FirewallAPI.dll,-23091"
"ObjectName"="NT Authority\\LocalService"
"ErrorControl"=dword:00000001
"Start"=dword:00000002
"Type"=dword:00000020
"DependOnService"=hex(7):6d,00,70,00,73,00,64,00,72,00,76,00,00,00,62,00,66,00,\
65,00,00,00,00,00
"ServiceSidType"=dword:00000003
"RequiredPrivileges"=hex(7):53,00,65,00,41,00,73,00,73,00,69,00,67,00,6e,00,50,\
00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,00,65,00,6e,00,50,00,\
72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,75,\
00,64,00,69,00,74,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,00,6f,00,74,00,69,\
00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
53,00,65,00,43,00,72,00,65,00,61,00,74,00,65,00,47,00,6c,00,6f,00,62,00,61,\
00,6c,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,\
65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,00,61,00,74,00,65,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,\
6e,00,63,00,72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,\
00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,00,00
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
6d,00,70,00,73,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
"ServiceDllUnloadOnStop"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\RPC-EPMap]
"Collection"=hex:87,00,01,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Security]
"Security"=hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,84,00,05,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,28,00,15,00,\
00,00,01,06,00,00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,\
0e,a7,8b,eb,ca,7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSSVC]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MPSSVC\0000]
"Service"="MpsSvc"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000000
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="@%SystemRoot%\\system32\\FirewallAPI.dll,-23090"

Save this file as CFScript.txt to your desktop. So now you should have both CFScript.txt and ComboFix.txt on your desktop.
Now use your mouse to drag CFScript.txt on top of ComboFix.exe and then release.
http://softvisia.com/users/Night_Raven/Security/cfsdnd2.gif
This will launch ComboFix.
Note: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Allow ComboFix to update itself if prompted.
When ComboFix finishes, a log will be produced at C:\ComboFix.txt
Attach this log to your next message. (How to attach)

http://img684.imageshack.us/img684/3557/tdsskiller.gif I want you to read and follow these instructions: TDSSKiller - How to run

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

Re-ran malwarebytes and took screenshots. Those files and folder are different wallpapers and a folder I made for my business class. I'm about to run combofix right now.

 

Ran everything like you said. While Getlogs.bat was running an error window popped up so I took a screen shot and attached it as well.

 

http://img406.imageshack.us/img406/3189/windowsrepair.gif Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

• Now open Repair_Windows.exe
• Go to Start Repairs tab.
• Choose "Custom Mode" and press "Start".
• Create a System Restore point if prompted.
• In the Custom Mode window, select the following repair options:
  • Reset Registry Permissions
  • Repair WMI
  • Repair MDAC/MS Jet
  • Repair Hosts File
  • Remove Policies Set By Infections
  • Repair Windows Updates
• Now click the Start button.
• Be patient while the tool repairs the selected items.
• If asked to reboot the computer for the changes to take affect, make sure other tasks in the program are not still running before accepting to restart.

Once you have rebooted your PC...

http://img17.imageshack.us/img17/3214/baticonvista7.gif Run the following file: c:\MGtools\FixWFW.bat by right-mouse clicking it and then selecting Run as Administrator.

Now reboot your PC again.

Test your firewall when you get back into Windows.

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

 

I forgot to mention that you should run c:\MGtools\FixWFW.bat by right-mouse clicking it and then selecting Run as Administrator.

Please do this when you get to that step if you haven't already.

 

Windows firewall is now up and running

while running Getlogs.bat the same notification window popped up that I screen shotted from last time.

 

Let's just make sure nothing is hiding in the hosts file.

http://img805.imageshack.us/img805/9659/rktigzy.gif Please download RogueKiller to your desktop.

Rename RogueKiller.exe to winlogon.exe
Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the number "1" and press ENTER.
When it is finished -- Notepad will open with the report and the log is saved to your desktop.
Attach RKreport[1].txt to your next message. (How to attach)
You can now type the number "0" and press ENTER to exit RogueKiller.

 

Here's the log

 

Some of the malware was not deleted, let's try with another tool:

http://img205.imageshack.us/img205/1894/otl.gif Fix items using OTL by OldTimer

Double-click OTL.exe to run. (Vista/7 right-click and select Run as Administrator)
Shut down your protection software now (antivirus, antispyware...etc) to avoid possible conflicts.
Copy the text in the code box below and paste it into the http://img14.imageshack.us/img14/66/otlcustomfix.png text-field.

Code:

[COLOR="DarkRed"]:files[/COLOR]
C:\Users\Bmdub\AppData\Local\d5ie34x6bh5jvr
C:\Users\Bmdub\AppData\Local\370173d2u587h743k306j0xyi3v8
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\Templates\370173d2u587h743k306j0xyi3v8
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\Templates\d5ie34x6bh5jvr
C:\Users\Bmdub\AppData\Roaming\Microsoft\Windows\l5f2ld1lv2762m1851b1q8m32lw72bihbdsw65
C:\ProgramData\370173d2u587h743k306j0xyi3v8
C:\ProgramData\d5ie34x6bh5jvr
[COLOR="DarkRed"]:commands[/COLOR]
[resethosts]

Now click the http://img3.imageshack.us/img3/407/otlrunfix.png button.
If the fix needed a reboot please do it.
Click the OK button (upon reboot).
When OTL is finished, Notepad will open. Close Notepad.
A log file will be located at C:\_OTL\MovedFiles\mmddyyyy_hhmmss.log, where mmddyyyy_hhmmss is the date of the tool run.
Attach this log to your next message. (How to attach)

http://img17.imageshack.us/img17/3214/baticonvista7.gif Now run C:\MGtools\GetLogs.bat by right-mouse clicking it and then selecting Run as Administrator
This updates all of the logs inside MGlogs.zip.
When it is finished, attach C:\MGlogs.zip to your next message. (How to attach)

Let me know how the system is running after you have completed these steps.

 

I ran OTL like you requested and an error message popped up, after clicking ok I can't tell if the OTL program is hung up or not. It's been over 20 minutes and nothing's changed. I took screen shots of both the error and what it's showing now.

 

Exit out of OTL.

Reboot into Safe Mode.

http://img805.imageshack.us/img805/9659/rktigzy.gif Double-click winlogon.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the number "3" and press ENTER.
When it is finished -- Notepad will open with the report and the log is saved to your desktop.
Attach RKreport[2].txt to your next message. (How to attach)
You can now type the number "0" and press ENTER to exit RogueKiller.

 

here's the log, thank you so much for being so helpful through all of this

 

You're welcome.
This log looks good. Are you having any other malware problems?

http://img17.imageshack.us/img17/3214/baticonvista7.gif Run c:\Mgtools\GetLogs.bat once more so I can review the latest logs.

http://img205.imageshack.us/img205/1894/otl.gif Also check the C:\_OTL\MovedFiles\ directory for any logs from OTL. If you find any (should only be one if it was created), attach them.

 

only issue i've run into is my wireless network disconnected on me quite a few times today and that's not normal but it could be comcast or the router (i'm power cycling the router after I send this. However I did try to run the windows diagnostics and it said it could not run because the dianostics policy service isn't running. When I open the service control manager and attempt to manually start the diagnostics policy service a message comes up saying

"windows could not start the Diagnostic Policy Service service on Local Computer. Error 1079: The account specified for this service is different from the account specified for other services running in the same process."

Not sure if this is at all connected to the virus or removal, but I definitely used to be able to run the diagnose and repair in the past.

 

Source: http://answers.microsoft.com/en-us/windows/forum/windows_vista-performance/error-1079-the-account-specified-for-this-service/d0f13130-f166-4524-a88e-9338963352a9

 

It's now giving me an error 5: access is denied so I'll try to track down more answers from microsoft. But thank you so much for all your help. I'm happy to have this all cleaned up. I'm assuming now it's ok to delete all the extra AV programs I downloaded and to turn UAC back on. Do you have any advice as to what Antivirus/antispyware programs I should be using to hopefully prevent anything like this in the future? I've got superantispyware and microsoft security essentials right now.

 

You're welcome.

Nowadays we're seeing every antivirus company getting destroyed by ZeroAccess and TDL4 rootkits. They are simply not doing their jobs in preventing users from getting infected in the first place.
My recommendation is to find one that is not so overbearing and keep as up to date as possible.
For free antivirus, I use Avast.

More information on recommendations are in the How to Protect yourself from malware! link below

___________________________________________________________

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis if it present
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work through the below link:
    • How to Protect yourself from malware!

Take care and be safe!