Win64/Patched.A removal

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by akasportswear, Oct 19, 2012.

  1. akasportswear

    akasportswear Private E-2

    My AVG has detected the following Win64/Patched.A virus in services.exe. I followed the instructions on the thread and attached the logs. My only issue was with the TDSSKiller log. I could not find it on the C: drive, just the quarantine files. Thank you for the help.
     

    Attached Files:

    akasportswear, Oct 19, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.
    Choose to Delete these files if they are detected:


    • C:\Windows\assembly\GAC_32\Desktop.ini
      C:\Windows\assembly\GAC_64\Desktop.ini
      C:\Windows\system32\services.exe
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF\ (AskBar)
      HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E\ (AskBar)

      Cookies _____________________________________________________________________

      C:\Users\Daves\AppData\Roaming\Microsoft\Windows\Cookies\BGS13LG5.txt
      C:\Users\Daves\AppData\Roaming\Microsoft\Windows\Cookies\HH7FMU7A.txt
      C:\Users\Daves\AppData\Roaming\Microsoft\Windows\Cookies\W1PC60LF.txt

    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [TASK][SUSP PATH] {DFFBA00D-4C18-4F4B-BC69-8A0513E21208} : C:\Windows\system32\pcalua.exe -a "C:\Users\Daves\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SW1YV8UD\ATI_HD_Audio_Win7x64[1].exe" -d C:\Users\Daves\Desktop -> FOUND
      [TASK][SUSP PATH] {EA51CBF8-2564-4CD7-8BA8-59877E8109BE} : C:\Windows\system32\pcalua.exe -a "C:\Users\Daves\Desktop\QuickBooks Pro 2012\QuickBooksPro2012.exe" -d "C:\Users\Daves\Desktop\QuickBooks Pro 2012" -> FOUND
      Place a checkmark each of these items, leave the others unchecked.
      Now press the Delete button.

      Now click the Files/folders tab and locate these detections:

      • [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
        [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
        [Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

        Place a checkmark each of these items, leave the others unchecked.
        Now press the Delete button.
        When it is finished, there will be a log on your desktop called: RKreport[2].txt
        Attach RKreport[2].txt to your next message. (How to attach)

        Now re-scan with both RogueKiller and HitmanPro and attach both those new logs.
     
    TimW, Oct 19, 2012
    #2
  3. akasportswear

    akasportswear Private E-2

    Followed instructions. Only issue is that RougeKiller asked me to reboot. Wound up with several RKreports. Attached them all.
     

    Attached Files:

    akasportswear, Oct 19, 2012
    #3
  4. akasportswear

    akasportswear Private E-2

    Here are the new logs after the rescan. Again for some reason there are two RK logs.
     

    Attached Files:

    akasportswear, Oct 19, 2012
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, RogueKiller indicates it removed the infection, but Hitman is still reporting it. Re-scan with hitman and remove these if found:
    C:\Windows\assembly\GAC_32\Desktop.ini
    C:\Windows\assembly\GAC_64\Desktop.ini
    C:\Windows\system32\services.exe --> when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace

    Attach the new log and then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).
    Attach both the new Hitman log as well as the new C:\MGLogs.zip.
     
    TimW, Oct 20, 2012
    #5
  6. akasportswear

    akasportswear Private E-2

    Hitman run and files deleted. Services file replaced.Here are the logs.
     

    Attached Files:

    akasportswear, Oct 21, 2012
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download ComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it is running or it may stall the program.
     
    TimW, Oct 21, 2012
    #7
  8. akasportswear

    akasportswear Private E-2

    Uh oh.....
    Ran Combo Fix without a hitch.
    Program Rebooted and prepared log.
    Tried to acces Internet to send log. IE, Safari and Chrome all give the following message:

    "Illegal opraion attempted on a registry key hat has been marked for deletion"

    Then it says:

    "Can't open this item. Do you want to remove this item"

    Sending this message from an IPad.

    Thx
     
    akasportswear, Oct 21, 2012
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just reboot.
     
    TimW, Oct 21, 2012
    #9
  10. akasportswear

    akasportswear Private E-2

    Thanks, here are the logs.
     

    Attached Files:

    akasportswear, Oct 21, 2012
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good. Combo replaced the infected services.exe which is what I hoped it would do.

    Now use windows explorer to find and delete:
    c:\programdata\szmucfkfuwyrqiw

    Tell me how things are running now.
     
    TimW, Oct 22, 2012
    #11
  12. akasportswear

    akasportswear Private E-2

    Removed and deleted the file.
    Should I rerun any of the Malware detectors?
    There are two files named desktop.ini on the desktop that were never there before.
     
    akasportswear, Oct 22, 2012
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    They will go a way when we do our final cleanup:

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link:
      • How to Protect yourself from malware![/URL]
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Oct 23, 2012
    #13
  14. akasportswear

    akasportswear Private E-2

    Machine has been running fine.
    Completed steps 1 through 6.
    Working through step 7
     
    akasportswear, Oct 28, 2012
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know. Safe surfing. :)
     
    TimW, Oct 29, 2012
    #15
  16. akasportswear

    akasportswear Private E-2

    One last thing, the two desktop.ini's are still there. AVG wants to forcibly remove them but warn of instability if removed. Is it okay to forcibly remove?

    Thx
     
    akasportswear, Oct 30, 2012
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you run the McClean.bat? That should have reset your system to hide system files.
     
    TimW, Oct 30, 2012
    #17
  18. akasportswear

    akasportswear Private E-2

    Step Six, in the order written.
     
    akasportswear, Oct 30, 2012
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Then just go to the control panel / folders / view and recheck that system files are hidden.
     
    TimW, Oct 31, 2012
    #19
  20. akasportswear

    akasportswear Private E-2

    All done.

    Thanks for all the help.
     
    akasportswear, Oct 31, 2012
    #20
  21. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Nov 1, 2012
    #21

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds