New thread. attached the right logs this time...

Discussion in 'Malware Help (A Specialist Will Reply)' started by kilo85, Oct 8, 2012.

  1. kilo85

    kilo85 Private E-2

    Ok, Really sorry to start another thread but after spending the last 4 hours in the Malware removal forum i decided that the first post i made would of been little help to anyone..

    so i have re scanned and followed the "Vista and Win 7 Malware Removal/Cleaning Procedure" to the letter. Unfortunately i am still infected.

    I have scanned and attached the logs as requested..

    a few issues to note:

    While using MGtools i had this message pop up:


    nslookup.exe - ordinal not found. the ordinal 1108 could not be located in the dynamic

    link library WSOCK32.dll.

    I dont know what this means, or if it is important. advice on this would be appreciated.

    also, another problem i have is i am not sure what i need to do about creating the batch files in the "how to use MGtools" thread. i dont know what im supposed to do with the possible error messages. where are the batch files? what do i do with them?

    quote:

    "At a later time to get new logs as requested, you can individually run any of the batch files by double clicking on them from a Windows Explorer window. Windows Explorer is easily opened by right clicking Start and selecting Explore. The batch file will create a new log and will also update the MGlogs.zip file with each new log created. The person helping you may either request the MGlogs.zip file or any of the individual log files created by the scans. If you rerun GetLogs.bat (which is the easiest thing to do), it will create new logs to be easely uploaded via the MGlogs.zip file."

    this confused me somewhat, as i am not sure what i am supposed to do, so i did nothing..


    I hope i got it right this time. If any more info is needed please let me know and i will get on the case.. I will be checking back every hour or so, so any reply's will be seen quickly.

    thanks, and i hope all this makes sence :confused
     

    Attached Files:

    kilo85, Oct 8, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator) When it opens, press the Scan button Now click the Registry tab and locate these detections:
    Place a [TASK][SUSP PATH] {09F09557-A399-43C4-A96D-FD921B94E5A4} : C:\Windows\system32\pcalua.exe -a C:\Users\Soundbox\Desktop\dotnetfx35.exe -d C:\Users\Soundbox\Desktop -> FOUND
    [TASK][SUSP PATH] {69176FCE-F2FB-4D4E-8814-D1364CE0789B} : C:\Windows\system32\pcalua.exe -a C:\Users\Soundbox\Desktop\agsetup.exe -d C:\Users\Soundbox\Desktop -> FOUND
    [TASK][SUSP PATH] {A5A07A44-7BA2-4624-8DF4-4117784674A0} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F31BYRQN\Saitek_P880_Pad_SD6_32[1].exe" -d C:\Users\Soundbox\Desktop -> FOUND
    [TASK][SUSP PATH] {D7E5FF75-B84F-4C1E-B255-024F8BB47488} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\852WYXWW\dotnetfx3_x64[1].exe" -d C:\Users\Soundbox\Desktop -> FOUND
    [TASK][SUSP PATH] {E7FEDD25-DFCD-41E0-9515-2828883DC093} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NXWYJF6I\Smart_Technology_7_0_2_7_32bit[1].exe" -d C:\Users\Soundbox\Desktop -> FOUND
    [TASK][SUSP PATH] {FC763D6B-165A-4C19-8888-E86CD28B5C5E} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\Desktop\New folder (2)\NI Massive 1.1.5 -AiR\Massive Setup PC.exe" -d "C:\Users\Soundbox\Desktop\New folder (2)\NI Massive 1.1.5 -AiR" -> FOUND
    [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND
    [HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND
    [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
    [HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND
    [HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
    [HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    [HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    [HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
    [HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    checkmark each of these items, leave the others unchecked. Now press the Delete button.

    Now click the Files/folders tab and locate these detections:
    [ZeroAccess][FILE] @ : C:\Windows\Installer\{013b9ae1-15f4-8b14-88f2-8da4d100aa7d}\@ --> FOUND
    [ZeroAccess][FOLDER] U : C:\Windows\Installer\{013b9ae1-15f4-8b14-88f2-8da4d100aa7d}\U --> FOUND
    [ZeroAccess][FOLDER] L : C:\Windows\Installer\{013b9ae1-15f4-8b14-88f2-8da4d100aa7d}\L --> FOUND
    [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
    [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
    [Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND
    Place a checkmark each of these items, leave the others unchecked. Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt Attach RKreport[2].txt to your next message. (How to attach) Do not reboot your computer yet.
    Rescan with HitmanPro. Choose to Delete these files if they are detected:
    • C:\Windows\assembly\GAC_32\Desktop.ini C:\Windows\assembly\GAC_64\Desktop.ini C:\Windows\Installer\{013b9ae1-15f4-8b14-88f2-8da4d100aa7d}\U\80000000.@ C:\Windows\Installer\{013b9ae1-15f4-8b14-88f2-8da4d100aa7d}\U\80000032.@
    Ignore all other detections. Afterwards, click the Next button. HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Now re-scan with both RogueKiller and HitmanPro and attach those new logs.
     
    Last edited: Oct 8, 2012
    TimW, Oct 8, 2012
    #2
  3. kilo85

    kilo85 Private E-2

    Hi Tim.

    First of all thank you immensely for taking the time to help me out.. its really appreciated so thanks a million

    I have managed to find and remove all the stuff from the registry, but now i am having problems trying to delete the stuff in the files/ folder tab. There is no check box i can see and i have been looking for a while. is this something to do with the flashing "zero access" i can see, or am i using an older version of RougeKiller? is there any way round this?

    i have got no further than deleting the stuff in the RougeKiller registry tab, never the less i have attached a RougeKiller log.

    thanks

     

    Attached Files:

    kilo85, Oct 8, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I also wanted you to run Hitman.
     
    TimW, Oct 8, 2012
    #4
  5. kilo85

    kilo85 Private E-2

    ok, sorry.

    here are the two logs.

    i still dont think i have deleted everything i should have.. i cant find the GAC_32desktop.ini infection.

    please advise.

    thanks
     

    Attached Files:

    kilo85, Oct 9, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button

    Now click the Registry tab and locate these detections:

    • [SUSP PATH] setup.exe -- C:\Users\Soundbox\AppData\Local\Temp\CR_B6351.tmp\setup.exe -> KILLED [TermProc]
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.


    Now click the Files/folders tab and locate these detections:

    • [TASK][PREVRUN] {00C98BD1-D70C-472F-A36A-91F6D099BB6B} : C:\Windows\system32\pcalua.exe -a C:\WINDOWS\st6unst.exe -c -n "C:\Program Files (x86)\BaseHead Inc\BaseHead - SFX Database 2.5\ST6UNST.LOG" -> NOT SELECTED
      [TASK][PREVRUN] {046E7723-9A41-43AB-81AD-D2A2B17781A1} : C:\Windows\system32\pcalua.exe -a D:\Setup.exe -d D:\ -> NOT SELECTED
      [TASK][PREVRUN] {0969A01F-7538-4D13-9AB4-062C36B4CA29} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\Documents\Install packs\massive\NI.Massive.V1.1.4.VSTi\Massive 1.1.4 Setup.exe" -d "C:\Users\Soundbox\Documents\Install packs\massive\NI.Massive.V1.1.4.VSTi" -> NOT SELECTED
      [TASK][PREVRUN] {1ECF83A7-D9CA-43AE-BCCA-385C5690027C} : C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/113900 -> NOT SELECTED
      [TASK][PREVRUN] {27EC8666-4501-48AF-BB6E-14A9E7F5434B} : C:\Windows\system32\pcalua.exe -a C:\Users\Soundbox\Downloads\setup.exe -d C:\Users\Soundbox\Downloads -> NOT SELECTED
      [TASK][PREVRUN] {5BE62146-2C62-47B0-B570-37490B258C5B} : C:\Windows\system32\pcalua.exe -a D:\SetupAssistant.exe -d D:\ -> NOT SELECTED
      [TASK][PREVRUN] {7FA88906-8422-4CAA-9DFC-8547529034FE} : C:\Windows\system32\pcalua.exe -a D:\Setup.Exe -d D:\ -> NOT SELECTED
      [TASK][PREVRUN] {8157875E-16E6-401F-956C-EE262683946C} : C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Flux\Plug-ins\install\vcredist_x86.exe" -d C:\Windows\SysWOW64 -c /q -> NOT SELECTED
      [TASK][PREVRUN] {A035E35C-C617-48A8-AF47-183FDF6E8A25} : C:\Windows\system32\pcalua.exe -a "C:\Users\Soundbox\Documents\Install packs\VSTi\CamelCrusherWin_v1_41.exe" -d "C:\Users\Soundbox\Documents\Install packs\VSTi" -> NOT SELECTED
      [TASK][PREVRUN] {A10185F6-B464-4CE6-909D-5D41838F7B67} : C:\Windows\system32\pcalua.exe -a "C:\Program Files\Steinberg\VstPlugins\MIDI Drivers\usbdriverspc\Drivers_Install.EXE" -d "C:\Program Files\Steinberg\VstPlugins\MIDI Drivers\usbdriverspc" -> NOT SELECTED
      [TASK][PREVRUN] {D2A17C3C-8EE2-41FD-A5F6-497E85AB271C} : C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\ArmA 2\uninstall.exe" -d "C:\Program Files (x86)\ArmA 2" -> NOT SELECTED
      [TASK][PREVRUN] {E9F516C7-7DD2-468F-879D-1C267A98E1F3} : C:\Windows\system32\pcalua.exe -a F:\NATHAN\hxxpthepiratebay.orgtorrent4017429S.T.A.L.K.E.R._Shadow_of_Chernobyl_1.0005_Update_including_Crack\stk-ww-10005.exe -d F:\NATHAN\hxxpthepiratebay.orgtorrent4017429S.T.A.L.K.E.R._Shadow_of_Chernobyl_1.0005_Update_including_Crack -> NOT SELECTED
      [HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> NOT SELECTED
      [HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> NOT SELECTED
      [HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> NOT SELECTED
      [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> NOT SELECTED
      [HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> NOT SELECTED
      [HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> NOT SELECTED
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Now re-scan with RogueKiller and attach the new logs.
     
    TimW, Oct 9, 2012
    #6
  7. kilo85

    kilo85 Private E-2

    hey

    once again thanks for the help.

    the logs are attached.

    i could not find or delete this location

    SUSP PATH] setup.exe -- C:\Users\Soundbox\AppData\Local\Temp\CR_B6351.tmp\setup.exe -> KILLED [TermProc]

    please advise
     

    Attached Files:

    kilo85, Oct 10, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    * C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    TimW, Oct 10, 2012
    #8
  9. kilo85

    kilo85 Private E-2

    here is the MGlogs .zip

    Everything seems to be running ok, no more browser re directions or problems that i know of.

    is there anything else you can recommend me to do?

    thanks again, think you saved me a lot of headache! :)
     

    Attached Files:

    kilo85, Oct 10, 2012
    #9
  10. kilo85

    kilo85 Private E-2

    sorry. i posted the MGlogs.zip before running the GetLogs.bat

    i have attached a new MGlogs.zip that i got after i ran GetLogs.bat.

    please ignore previous post

    thanks!
     

    Attached Files:

    kilo85, Oct 11, 2012
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Use windows explorer to find and delete:
    C:\Users\Soundbox\AppData\Roaming\Microsoft\Windows\Templates\5ui6jf553a341xd
    C:\Users\Soundbox\AppData\Roaming\Microsoft\Windows\Templates\9595e621

    Attached is bfe.zip
    Inside is:
    Extract bfe.reg to your desktop.
    Double-click bfe.reg and allow it to merge into the registry. If you get a "successfully merged into registry" type of message, reboot your PC and see if you can turn on BFE, or if it is already turned on.
    You can run these commands from the command prompt.
    • net start bfe
    • sc qc bfe

    If the service is still not running:

    Run regedit:
    1. Browse to the location for the BFE service in the registry (HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy), right click and select permissions. (note: HKLM is short for HKEY_LOCAL_MACHINE_
    2. In the “Permissions for Policy” window, click advanced | Add.
    3. Once the “Select Users, Computers or Group” box appears, change the “From this location:” to point to the local machine name.
    4. After changing the search location, enter “NT Service\BFE” in the “Enter the object name to select” box and click “Check names” – this will allow you to add the BFE account.
    5. Give the following privileges to the BFE account:
    Query Value
    Set Value
    Create Subkey
    Enumerate Subkeys
    Notify
    Read Control
    After adding the BFE account to the registry key, please try to start the Base Filtering Engine service.

    Tell me how things are running now.
     
    TimW, Oct 11, 2012
    #11
  12. kilo85

    kilo85 Private E-2

    Hi again.

    I did as you said. but a few things i may have done wrong.

    problems i am having are:

    when i click start, open "run" and type in either "net start bfe" or "sc qc bfe" i get the black run box open for a fraction of a second then it closes down again.... i am not sure if this means it is already running or that it cannot open.. please advise.

    also, i followed your direction to the "HKLM\System\CurrentControlSet\Services\BFE\Parameters\Policy" and there are 2 other files inside the "policy", i was not sure which folder to select "permissions" for so i made the changes on that folder, i did this by right clicking the policy folder and changing the search location & entering NT Service\BFE in the “Enter the object name to select” box

    i Have attached a screenshot

    one more thing..

    the last step you outlined, quote: "After adding the BFE account to the registry key, please try to start the Base Filtering Engine service."

    do you mean i run the "net start bfe", and the "sc qc bfe" commands from the command prompt? if so then i am still having the same result where the black command screen pops up for a second, then disappears.

    thanks again for the help. sorry i am a bit of a novice when it comes to this stuff, i hope i am not ranting or being unclear
     

    Attached Files:

    • 1.jpg
      1.jpg
      File size:
      95.5 KB
      Views:
      2
    • 2.jpg
      2.jpg
      File size:
      97.3 KB
      Views:
      2
    Last edited by a moderator: Oct 12, 2012
    kilo85, Oct 12, 2012
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You should only need to go to Start / run / and type in:
    services.msc

    When the window opens, scroll to the BFE service and set it to auto.
     
    TimW, Oct 12, 2012
    #13
  14. kilo85

    kilo85 Private E-2

    ok, it was already set to auto

    is that everything?
     
    kilo85, Oct 13, 2012
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link:
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Oct 13, 2012
    #15
  16. kilo85

    kilo85 Private E-2

    Ok i have done all that..

    i cant thank you enough for helping me get rid of that nasty malware, you're a real lifesaver TimW!!

    also, im wondering if the "bfe.reg" file on my desktop is safe to delete? i am assuming i can delete it but want to be sure...



     
    kilo85, Oct 14, 2012
    #16
  17. kilo85

    kilo85 Private E-2

    Actuality, I think i may have spoke too soon.

    Now for some reason every half hour or so my PC Freezes up suddenly and i have to force a restart..

    its really quite annoying, do you have any idea why my PC is doing this? this has only started happening since yesterday.

    i did install privatefirewall. could that be why?

    thanks
     
    kilo85, Oct 15, 2012
    #17
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It's possible, but you would need to pursue that issue in the software forum.
     
    TimW, Oct 15, 2012
    #18
  19. kilo85

    kilo85 Private E-2

    ok my bad, i turned it off and i have not had any more problems

    once again thanks for all the help!
     
    kilo85, Oct 15, 2012
    #19
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Oct 16, 2012
    #20

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds