Gozy Trojan

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by vvgomez, Mar 17, 2018.

  1. vvgomez

    vvgomez Private First Class

    Hi,

    My internet provider sent me a warning about a virus in my network. Apparently they detected a Gozy trojan virus that I should clean from my system as soon as possible. I noticed the computer was a little slow the last few days, but other than that nothing else showed up that could point to a virus. I will appreciate any help. Please find the attached log and let me know if you need more information.

    Thank you in advance for your time and help.

    vv
     

    Attached Files:

    vvgomez, Mar 17, 2018
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please rerun Hitman and remove these items:
    Potential Unwanted Programs _________________________________________________

    HKLM\SOFTWARE\Classes\Software.OneClickProcessLauncherMachine.1.0\ (BoxoreOU)
    HKLM\SOFTWARE\Classes\Software.OneClickProcessLauncherMachine\ (BoxoreOU)
    HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)
    HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9522B3FB-7A2B-4646-8AF6-36E7F593073C}\ (CouponBar)

    Next, rerun RogueKiller and remove these items:
    ¤¤¤ Registry : 7 ¤¤¤
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8F9DFC07-0BA3-4864-943C-6612794F8488} | DhcpNameServer : 10.1.0.200 10.1.0.201 ([X][X]) -> Found
    [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{A2111136-5270-4D28-9695-997B626CCFC6} | DhcpNameServer : 10.1.128.30 10.1.128.31 ([X][X]) -> Found

    ¤¤¤ Tasks : 9 ¤¤¤
    [Hj.Shortcut] \{05B046D5-567D-413F-BE5B-9E10170C8E64} -- "c:\program files (x86)\google\chrome\application\chrome.exe" (http://ui.skype.com/ui/0/7.24.85.104/en/abandoninstall?page=tsProgressBar) -> Found
    [Hj.Shortcut] \{4DAEAFDC-F7BC-499D-A56E-BF58F2F2725E} -- "c:\program files (x86)\google\chrome\application\chrome.exe" (https://www.skype.com/go/downloading?source=lightinstaller&ver=7.40.0.103&LastError=404) -> Found
    [Hj.Shortcut] \{913AC713-A6C1-4409-8403-BE0A47E1F0B3} -- "c:\program files (x86)\google\chrome\application\chrome.exe" (http://ui.skype.com/ui/0/7.24.85.104/en/abandoninstall?page=tsProgressBar) -> Found
    [Hj.Shortcut] \{C0BE3FDF-8679-47B8-A44C-23D051A491CC} -- "c:\program files (x86)\google\chrome\application\chrome.exe" (http://ui.skype.com/ui/0/7.24.85.104/en/abandoninstall?page=tsProgressBar) -> Found
    [Hj.Shortcut] \{FF5F5ABC-DDCB-42AC-92C2-218D1DFBA7C1} -- "c:\program files (x86)\google\chrome\application\chrome.exe" (https://www.skype.com/go/downloading?source=lightinstaller&ver=7.40.0.103&LastError=404) -> Found

    Reboot and rerun both Hitman and RogueKiller.

    Please download Zemana Malware Removal to your desktop and run it please.

    It auto updates, and you click scan. After it's finished, click on the icon that looks like Cell phone strength bars. High-light the report (by date log was produced) and click on the "Open Report" icon. (looks like a folder). That notepad.txt can then be copied/pasted into another .txt doc and saved. Upload that, please, along with the Hitman and RogueKiller logs.
     
    TimW, Mar 17, 2018
    #2
  3. vvgomez

    vvgomez Private First Class

    Hi TimW,

    Thank you for your soon response. Unfortunately, my HitmanPro trial license expired and apparently removal of viruses and other malicious software is disabled. Should I proceed anyway with the rest instructions?

    Thank you,

    vv
     
    vvgomez, Mar 17, 2018
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes.
     
    TimW, Mar 17, 2018
    #4
  5. vvgomez

    vvgomez Private First Class

    Hi TimW,

    I wasn't able to run Zemana either because my free version has already expired, too. Please find attached logs from Hitman and RogueKiller.

    Thanks,

    vv
     

    Attached Files:

    vvgomez, Mar 17, 2018
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Where did you install vegas pro from? Did you use a code breaker?

    Please download and run Emsisoft Emergency Kit.

    Double click EmergencyKitScanner.exe to install EEK
    When the installation of EEK is complete the Emergency Kit scanner will run.
    NOTE: Make sure to enable PUPs detection.
    Click "Yes" to Update Emsisoft Emergency Kit
    Under "Scan" click-on "Malware Scan".
    IMPORTANT: Do not quarantine or delete anything. We just want the scan log without anything being quarantined or deleted.
    Save the scan log somewhere that you can find it (desktop).
    Exit Emsisoft Emergency Kit.

    Attach the log.
     
    TimW, Mar 17, 2018
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Additional software to run:
    Please download the latest version of FRST the below link.
    Farbar Recovery Scan Tool and save it to your Desktop.

    Note: Make sure you download the proper version ( 32 bit or 64 bit ) for your PC. Only one will run, the correct one. So it you make a mistake and download the wrong one, go back and get the other.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
     
    TimW, Mar 17, 2018
    #7
  8. vvgomez

    vvgomez Private First Class

    That Vega Pro software came from an old company I used to work with thousand of years ago, and honestly I have no idea if they use a code breaker. The software is not installed in my computer, it is stored in a forgotten old laptop backup in a folder on the desktop. I can delete it if that is a problem.
     
    vvgomez, Mar 17, 2018
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No...however, .... will you please get me the logs I requested.
     
    Last edited: Mar 17, 2018
    TimW, Mar 17, 2018
    #9
  10. vvgomez

    vvgomez Private First Class

    Recently, skype launched a new version for Windows 10, which I hate, so I tried to go back to the 2016 skype version from a full installed I had downloaded from the skype site in that moment, but it was impossible to make the 2016 version work. Finally, I discard it and I resigned to use the new version. Now, I notice that the items deleted with RogueKiller are related to skype. Could the old skype installer from 2016 be the culprit of the infection?

    Please find attached the logs.

    Once again, thank you for all your help!

    vv
     

    Attached Files:

    vvgomez, Mar 17, 2018
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please uninstall Zemana. Reboot and go here: https://www.zemana.com/Download

    Scroll all the way to the bottom and at the bottom of column 2 you will find Free AntiMalware. Click on it and download Zemana....install and scan. Attach the log.
     
    TimW, Mar 17, 2018
    #11
  12. vvgomez

    vvgomez Private First Class

    Thank you for the link. That was a long scan, but finally here is the log.
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please right click start / run and type in %appdata% and get me a screen shot of it.

    Save fixlist.txt on your Desktop. Make sure you save it as a txt file.
    • You should now have both fixlist.txt and FRST64.exe on your Desktop.
    • Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).
    • Run FRST64.exe by right clicking on it and selecting Run As Adminstrator
    • Click the Fix button just once and wait.
    • Your computer should reboot after the fix runs.
    • Reconnect your internet connection after reboot so you can come back here to continue.
    • The tool will make a log on the Desktop (Fixlog.txt) please attach this new log to your next reply (attach or paste)
     

    Attached Files:

    TimW, Mar 18, 2018
    #13
  14. vvgomez

    vvgomez Private First Class

    Hi TimW,

    Please find attached screenshots and log. Thank you.
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #14
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, I am not seeing any evidence of Gozi. Have you gotten any other alerts from your ISP?
     
    TimW, Mar 18, 2018
    #15
  16. vvgomez

    vvgomez Private First Class

    Rogers, my ISP, are going to scan my network tomorrow, so I will know for sure.

    On the other hand, since a couple of month I keep getting the following warning from my avast antivirus every time I run the wi fi inspector. I called Rogers and talk with an IT guy and he had no idea why I am getting that results. Apparently, I have the last version of the most updated router. I ran avast from another computer and this warning from the wifi inspection didn't show up, so it is only with my computer.

    Any idea?

    Thanks
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #16
  17. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not a clue.

    Let's do this:
    Let's see if we can figure out what is going on with this. We need this to run and create a log.
    • Download TDSSKiller from Kaspersky directly onto your Desktop
    • Now double click the TDSSkiller.exe file to run it ( if using Vista or Windows 7,8 and 10, do not double click on it but rather, right click and select Run As Administrartor. )
    • If TDSSKiller does not run, try renaming it. To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123tdk.com).
     
    TimW, Mar 18, 2018
    #17
  18. vvgomez

    vvgomez Private First Class

    Here is the log...

    Could a mac pro laptop be infected? Can this virus infect apple devices?
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, Mac's can be infected. I don't know about apple devices. I also have no idea why Avast is reporting an issue with your router on this computer but not another computer running through the same router.

    Your TDSSKiller log is clean. Let's wait until tomorrow for your ISP.
     
    TimW, Mar 18, 2018
    #19
  20. vvgomez

    vvgomez Private First Class

    Also intriguing is that I have one router but the analysis shows two, which are the same with different names and different ips, and one is ok and the other at risk.

    Anyway, I let you know by tomorrow evening if my ISP cut or not my service.

    Thank you for all the time and help you are dedicating with this issue.

    vv
     
    vvgomez, Mar 18, 2018
    #20
  21. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Right click your WiFi icon and choose Network and Internet Services...then click on show available networks. Tell me what you find.
     
    TimW, Mar 18, 2018
    #21
  22. vvgomez

    vvgomez Private First Class

    I can see the name of my own connection ok and a bunch of others I presume are my neighbours' networks. I have listed a couple of vpn connections, but I rarely use them. Nothing that looks odd here.
    But... I have this message in my wi-fi settings...

    *Some settings are hidden or managed by your organization.

    Is that normal?
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #22
  23. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Are your computers networked in a workgroup?

    I would also like to see a screen shot of your "available networks".
     
    TimW, Mar 18, 2018
    #23
  24. vvgomez

    vvgomez Private First Class

    I've just noticed my neighbours are very creative people choosing names for their networks :)
     

    Attached Files:

    vvgomez, Mar 18, 2018
    #24
  25. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    There is a "hidden network" showing. Right click it and see if you can either disable or disconnect from it.

    And you didn't answer about workgroup.
     
    TimW, Mar 18, 2018
    #25
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Networking is not my forte. Disregard my previous post.
     
    TimW, Mar 18, 2018
    #26
  27. vvgomez

    vvgomez Private First Class

    Only option I have is to "connect" and check the box to connect automatically, which is unchecked.
    I had a remote meeting last week using GoToMeeting if that could count...
     
    vvgomez, Mar 18, 2018
    #27
  28. vvgomez

    vvgomez Private First Class

    No problem. I think the culprit was the trojans deleted with Roquekiller and related with skype. This issue with avast wifi warning looks like a bug or a false positive than other thing... we will know for sure by tomorrow. I'll keep you posted.
    Again, thank you so much for your help.
    vv
     
    vvgomez, Mar 18, 2018
    #28
  29. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    No.

    Is Avast a paid for version?
     
    TimW, Mar 18, 2018
    #29
  30. vvgomez

    vvgomez Private First Class

    Unfortunately, it is not.
     
    vvgomez, Mar 18, 2018
    #30
  31. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good....uninstall it. Then run CCLeaner. Reboot and reinstall it. Do a scan.
     
    TimW, Mar 18, 2018
    #31
  32. vvgomez

    vvgomez Private First Class

    I've just ran avast from a mac laptop and the issue showed up again, same thing. The router is vulnerable and needs update its firm. I called Rogers and they think it is just a bug and it is nothing important. The two routes in the avast scan correspond to the 2.4g and 5g option in the router, apparently. So, I will keep everything like that for now. Thanks.
     
    vvgomez, Mar 18, 2018
    #32
  33. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Keep me informed.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Re-enable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8 or 10, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 or 10 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     
    TimW, Mar 18, 2018
    #33
  34. vvgomez

    vvgomez Private First Class

    Great! Thank you!
    vv
     
    vvgomez, Mar 18, 2018
    #34
  35. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You're welcome. :)
     
    TimW, Mar 18, 2018
    #35

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds