Rootkit, Trojan, Fake AV Scam, etc.

Discussion in 'Malware Help (A Specialist Will Reply)' started by Rich Robbin, May 18, 2012.

  1. Rich Robbin

    Rich Robbin Private E-2

    After posting an ad on a automobile website, I received several emails from obvious scammers. Within in a day, a fake anti-virus box appeared on my Dell laptop. I took the bait, sending them payment information. Immediatly coming to my senses I cancelled that credit card. This "cure the virus" box continued to appear, and within another day, my main Dell PC (connected to the same router) began to display similiar problems. I then contacted a friend who'd helped me in the past who immediately discovered (by running Malwarebytes) that both units were severly infected with a variety of rootkits and trojans at which time he told me of your site.

    We disconnected the laptop from the router and set it aside, then moved
    on to the main computer. First I read "Read And Run Me First" then ran
    the scans indicated in your instructions (except RootRepeal because I could not get it to go), but the unit still doesn't seem to be "running right"
    (slow and sluggish w/occasional pop-ups, like it's still partially infected)

    So in short, what do you guys think? Anything more I can do to get
    it up to snuff? Thanks much in advance.
     

    Attached Files:

  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!

    Do you have your Windows XP boot CD? There is a good chance that an infected partition was put on your hard disk. See the one highlight in red in the list below.
    Code:
    Partition Disk #0, Partition #0 
    Partition Size 47.03 MB (49,319,424 bytes) 
    Partition Starting Offset 32,256 bytes 
    Partition Disk #0, Partition #1 
    Partition Size 145.46 GB (156,189,841,920 bytes) 
    Partition Starting Offset 49,351,680 bytes 
    [COLOR=red][B]Partition Disk #0, Partition #2 
    Partition Size 3.50 GB (3,758,952,960 bytes) 
    Partition Starting Offset 156,239,193,600 bytes[/B][/COLOR] 
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Be sure to answer my question below about your boot disk but also do the below to help somewhat with performance issues.

    Do you still have Ad-Aware 2007 installed? I see it running but I don't see it in the installed programs list. This is too old and very inadequate anyway. It should be uninstalled to avoid wasting any system resources on it. Uninstall it now if installed.

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - (no file)
    O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - (no file)
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

    After clicking Fix, exit HJT.



    Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box into it:
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    If after running Combofix you discover none of your programs will open up because you recieve the following error: Illegal operation attempted on a registry key that has been marked for deletion then you will need to reboot your computer which will normally fix this problem.
    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).



    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
  4. Rich Robbin

    Rich Robbin Private E-2

    Sorry for not responding sooner (busy as h*** on this
    end) thanks for such a quick reply. I do indeed have the boot disc
    and will follow your further instructions as soon as possible.
    Thanks again!
     
  5. Rich Robbin

    Rich Robbin Private E-2

    G'morning ... per your instructions we ran analyse.exe and CF fix plus getlogs.bat (logs attached for your comment and further instructions). Happy to report the unit seems to running faster/better, like its "old self" again. Thank you VERY much!
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Back in message # 2 I asked if you have your Windows XP boot CD. I'm still concerned about that partition. If you PC is still running okay then we may just ignore this. If however you are still having any problems, removal of this partition would be our next step. So are things still good?

    Note that me previous fix did not remove any malware. It just removed some unnecessary stuff. And you did not remove Ad-Aware 2007 as requested. Also you did not make the CFScript.txt file properly. It was empty. Thus nothing at all was fixed / removed. Thus there really should not be any change in behavior.
     
  7. Rich Robbin

    Rich Robbin Private E-2

    We realized we ended up with an empty ComboFix script so we re-ran correctly (we hope) and have attached the log, plus I do have the Windows XP boot CD (right here on my desk). The unit is running much better but seems to still be not quite right. Will appreciate your looking over the logs for anything else you'd like us to do. Again, THANKS for sharing your considerable expertise and valuable time with us.
     

    Attached Files:

    • log.txt
      File size:
      15.4 KB
      Views:
      3
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    Now boot off of the newly created GParted CD.
    http://img534.imageshack.us/img534/5492/gpartedsplash011010.th.png
    You should be here...
    Press ENTER
    http://img819.imageshack.us/img819/7286/gpartedkeymaps.th.png
    By default, do not touch keymap is highlighted. Leave this setting alone and just press ENTER.
    http://img404.imageshack.us/img404/9840/gpartedlanguage.th.png
    Choose your language and press ENTER. English is default [33]
    http://img140.imageshack.us/img140/7958/gpartedgui.th.png
    Once again, at this prompt, press ENTER
    You will now be taken to the main GUI screen below
    http://img32.imageshack.us/img32/1122/gpartedo.th.png
    According to your logs, the partition that you want to delete is 3.50 GB ( GiB )
    Click the trash can icon to delete and then click Apply.
    You should now be here confirming your actions:
    http://img233.imageshack.us/img233/1533/gpartedsteps.th.png
    Now you should be here:
    http://img696.imageshack.us/img696/8471/gpartedsuccessclose.th.png
    Is boot next to your OS drive? According to your logs, your OS drive is the [ 145.46 GB ] GiB sized partition.
    http://img194.imageshack.us/img194/7753/gpartedboot.th.png
    If boot is not next to your OS drive under Flags, right-mouse click the OS drive while in Gparted and select Manage Flags

    In the menu that pops up, place a checkmark in boot like the picture below:
    http://img196.imageshack.us/img196/3483/gpartedmanageflagsboot.th.png
    Now press the Close button to save these changes.
    Now double-click the http://img715.imageshack.us/img715/641/gpartedexit.png button.
    You should receive a small pop up like this:
    http://img88.imageshack.us/img88/8986/gpartedexitreboot.png
    Choose reboot and then press OK.



    Not boot your PC from your Windows XP boot CD, use it to boot to the Recovery Console and execute the following commands pressing ENTER after each:
    • fixmbr
    • fixboot
    • exit << this will reboot your PC. Just boot into Windows normally!
    Once back in Normal Windows


    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs (See: How to attach):
    • C:\MGlogs.zip
     
  9. Rich Robbin

    Rich Robbin Private E-2

    Ran gparted then deleted the partition you were concerned about,
    also updated mgtools; log included. As always, thanks much!
     

    Attached Files:

  10. Rich Robbin

    Rich Robbin Private E-2

    P. S. forgot to mention we also went to the recovery console and executed
    the fixmbr and fixboot commands you suggested and it went fine.
     
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Okay that partition is now gone. So how things are working now?​
     
  12. Rich Robbin

    Rich Robbin Private E-2

    Hey there ... computer seems to be running fine thanks
    to your help ... again, many thanks and all the best!
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
  14. Rich Robbin

    Rich Robbin Private E-2

    Just completed the "final steps" so looks like I'm good to go ... can't thank you enough for your great help and your tremedous website!! -Rich
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds