AVG Reporting a services.exe Trojan

Korban3 · Aug 6, 2012

I'm using AVG Antivirus and it repeatedly reports that there is a Trojan running under services.exe, at C:/Windows/System32/services.exe. It's system critical, so is not removed. The only option AVG offers is to ignore it.
I'm running the READ & RUN ME FIRST procedures first.
Posting the logs said procedures request in this thread before I start asking about the Trojan itself. Is that ok?

Korban3 · Aug 6, 2012

Two logs from the "Fixing Google Redirection/hijacking and other redirection problems" thread procedures.
These two are the GooredFix and MBRCheck logs.

Korban3 · Aug 6, 2012

Alright, READ AND RUN ME FIRST is done. Here's the last batch of logs.

I am still having a problem. The Trojan in services.exe is triggering AVG notices fairly often. I also still have some warnings about the GAC_64 and GAC_32 Desktop.ini files. Where should I go from here?

Kestrel13! · Aug 7, 2012

http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

Korban3 · Aug 7, 2012

Here's the log.

Kestrel13! · Aug 7, 2012

Delete these files if they exist:

C:\Users\Shayne\AppData\Roaming\Microsoft\Windows\Templates\1729997856
C:\Users\Shayne\AppData\Roaming\Microsoft\Windows\Templates\5o48ru8o10a702
C:\Windows\SysWOW64\sho48C6.tmp
C:\Windows\SysWOW64\sho7DAE.tmp
C:\Windows\SysWOW64\sho9054.tmp
C:\Windows\SysWOW64\shoB6D7.tmp
C:\Windows\SysWOW64\shoEB69.tmp
C:\Windows\SysWOW64\shoEE76.tmp

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

-------------------------------

Now re-run RogueKiller - no fix just a scan and attach the log.

Re-run FRST - no fix, just a scan and attach the log.

Let me know how things are running at this point.

Korban3 · Aug 7, 2012

Alright, here's the fix log and the two new Rogue Killer and FRST64 logs.

Well, the first thing that happened on normal boot was that Peer Block fired up. I have always had it set to "Start with Windows", but it never did before. I always had to start it up manually, but this time it fired right up.
Microsoft Office Word Starter 2010 was previously crashing when I tried to run it and is now working, although it may have been an issue with AVG blocking it before. Either way, it works now.
After a few minutes of random Google searches and clicking results, I haven't been redirected as I was before.
Also, I was previously having popups appear fairly often and so far haven't had a single one. The URL for these was often one of an ad or link on the page I was visiting at the time, but would then redirect themselves to sketchy, dangerous pages.
I'm also going to say, tentatively, that general system speed has gone up a little bit. May be from RAM being cleared, but everything seems to be responding just a hair faster than it was before.
Nothing else has become evident yet.

Kestrel13! · Aug 8, 2012

You need to run FRST again properly.

Attention: Could not load system hive.ERROR: The process cannot access the file because it is being used by another process.

ATTENTION:=====> THE TOOL IS NOT RUN FROM RECOVERY ENVIRONMENT AND WILL NOT FUNCTION PROPERLY.
Click to expand...

Just a scan no fix and attach log.

Korban3 · Aug 8, 2012

Whoops, sorry about that. Here is a proper log.

Kestrel13! · Aug 9, 2012

Delete this folder. It probably contains a file with a .ico extension.

C:\ProgramData\7531CC920309F8B8EBE471E84F147CE7

Everything still running well? If so...

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Korban3 · Aug 9, 2012

Ok, I was able to locate that folder. FRST had quarantined it to C:/FRST/Quarantine
It also Quarantined a Desktop.ini and a services.exe. I looked under Windows/System32 and my system's services.exe is still there.
Should I delete everything in the Quarantine folder?

Other than that, everything is fixed. AVG no longer complains about the services.exe trojan, I no longer get redirected and I no longer get pop ups on the web. System speed is back to where it was before and it is running more stably like before as well.

Kestrel13! · Aug 9, 2012

You can delete the whole folder. C:/FRST

Korban3 · Aug 11, 2012

My system won't allow me to delete the FRST folder. It says I need permission from SYSTEM to do so.

That's the last of it. Thank you, so much, for helping me out. I really appreciate it! You guys are the greatest!

Kestrel13! · Aug 12, 2012

Download The Avenger by Swandog469, and save it to your Desktop.

Extract avenger.exe from the Zip file and save it to your desktop

Run avenger.exe by double-clicking on it.

Do not change any check box options!!

Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

Folders to delete:
C:/FRST
Click to expand...

Now click the Execute button.

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Log in or Sign up

AVG Reporting a services.exe Trojan

Korban3 Private E-2

Korban3 Private E-2

Attached Files:

GooredFix.txt

MBRCheck_08.05.12_21.34.56.txt

Korban3 Private E-2

Attached Files:

RKreport[1].txt

HitmanPro_20120805_2300.log

MGlogs.zip

mbam-log-2012-08-05 (22-19-04).txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Korban3 Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

Korban3 Private E-2

Attached Files:

Fixlog.txt

RKreport[2].txt

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Korban3 Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Korban3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Korban3 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member