Computer infected with Win64/Patche.B Trojan

Discussion in 'Malware Help (A Specialist Will Reply)' started by Ryan8888, Aug 17, 2012.

  1. Ryan8888

    Ryan8888 Private E-2

    Good afternoon,

    I seem to have picked up this infection on my computer, my ESAT Nod 32 antivirus software picks it up but can't eliminate it. I'm at a total loss on how to get rid of the infection.

    Any help would be greatly appreciated!

    Thanks!

    Ryan
     
    Ryan8888, Aug 17, 2012
    #1
  2. Ryan8888

    Ryan8888 Private E-2

    I followed the Malare read me and managed to get these logs. I'll attach them to this post. Also it seems I've also got the Sirefef virus as well as it popped up as a threat while I was scanning.

    Any help is greatly appreciated!

    Thanks

    Ryan

    Here is the first log, the rest are attachments

    RogueKiller V7.6.6 [08/10/2012] by Tigzy
    mail: tigzyRK<at>gmail<dot>com
    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows Vista (6.0.6002 Service Pack 2) 64 bits version
    Started in : Normal mode
    User: Ryan [Admin rights]
    Mode: Scan -- Date: 08/17/2012 13:59:26

    ¤¤¤ Bad processes: 1 ¤¤¤
    [SUSP PATH] Runservice.exe -- C:\Windows\runservice.exe -> KILLED [TermProc]

    ¤¤¤ Registry Entries: 15 ¤¤¤
    [SUSP PATH] HKCU\[...]\Run : nrsct ( "C:\Users\Ryan\AppData\Roaming\nrsct.dll",FromMemory) -> FOUND
    [SUSP PATH] HKCU\[...]\Run : splses ( "C:\Users\Ryan\AppData\Roaming\splses.dll",Number_Coerce) -> FOUND
    [SUSP PATH] HKCU\[...]\Run : idind ( "C:\Users\Ryan\AppData\Roaming\idind.dll",SyntaxError) -> FOUND
    [SUSP PATH] HKCU\[...]\Run : neqlg ( "C:\Users\Ryan\AppData\Roaming\neqlg.dll",init_io) -> FOUND
    [SUSP PATH] HKUS\S-1-5-21-2468988567-2473214758-1854903448-1000[...]\Run : nrsct ( "C:\Users\Ryan\AppData\Roaming\nrsct.dll",FromMemory) -> FOUND
    [SUSP PATH] HKUS\S-1-5-21-2468988567-2473214758-1854903448-1000[...]\Run : splses ( "C:\Users\Ryan\AppData\Roaming\splses.dll",Number_Coerce) -> FOUND
    [SUSP PATH] HKUS\S-1-5-21-2468988567-2473214758-1854903448-1000[...]\Run : idind ( "C:\Users\Ryan\AppData\Roaming\idind.dll",SyntaxError) -> FOUND
    [SUSP PATH] HKUS\S-1-5-21-2468988567-2473214758-1854903448-1000[...]\Run : neqlg ( "C:\Users\Ryan\AppData\Roaming\neqlg.dll",init_io) -> FOUND
    [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
    [HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    [HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    [HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
    [HJ] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
    [HJ] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤
    [ZeroAccess][FOLDER] U : c:\windows\installer\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\U --> FOUND
    [ZeroAccess][FOLDER] L : c:\windows\installer\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\L --> FOUND
    [ZeroAccess][FILE] @ : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\@ --> FOUND
    [ZeroAccess][FOLDER] U : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\U --> FOUND
    [ZeroAccess][FOLDER] L : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\L --> FOUND
    [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND
    [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND

    ¤¤¤ Driver: [NOT LOADED] ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    127.0.0.1 localhost


    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: TOSHIBA MK3252GSX +++++
    --- User ---
    [MBR] 74f2cff45b5fd8b3c7f6c12757019e4f
    [BSP] 4b314049cc507ea6f5e327c387c26c5c : Windows Vista MBR Code
    Partition table:
    0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 Mo
    2 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 290204 Mo
    User = LL1 ... OK!
    User = LL2 ... OK!

    +++++ PhysicalDrive1: Ut165 USB2FlashStorage USB Device +++++
    --- User ---
    [MBR] 860c557474028fcea52ff32ed43e78c6
    [BSP] 57de141d57357ed99d87f8b49c434431 : MBR Code unknown
    Partition table:
    0 - [XXXXXX] UNKNOWN (0x72) [VISIBLE] Offset (sectors): 778135908 | Size: 557377 Mo
    1 - [XXXXXX] UNKNOWN (0x65) [VISIBLE] Offset (sectors): 168689522 | Size: 945326 Mo
    2 - [XXXXXX] UNKNOWN (0x79) [VISIBLE] Offset (sectors): 1869881465 | Size: 945326 Mo
    3 - [XXXXXX] UNKNOWN (0x0d) [VISIBLE] Offset (sectors): 2885681152 | Size: 27 Mo
    User = LL1 ... OK!
    Error reading LL2 MBR!

    Finished : << RKreport[1].txt >>
    RKreport[1].txt
     

    Attached Files:

    Ryan8888, Aug 17, 2012
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please attach your logs in the future!!

    Rescan with HitmanPro. Choose to Delete these files if they are detected:
    [ZeroAccess][FOLDER] U : c:\windows\installer\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\U --> FOUND
    [ZeroAccess][FOLDER] L : c:\windows\installer\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\L --> FOUND
    [ZeroAccess][FILE] @ : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\@ --> FOUND
    [ZeroAccess][FOLDER] U : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\U --> FOUND
    [ZeroAccess][FOLDER] L : c:\users\ryan\appdata\local\{83fbc6f5-f2f1-2edf-6691-1945d9266eee}\L --> FOUND
    [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_32\desktop.ini --> FOUND
    [ZeroAccess][FILE] Desktop.ini : c:\windows\assembly\gac_64\desktop.ini --> FOUND
    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * HitmanPro log
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Aug 17, 2012
    #3
  4. Ryan8888

    Ryan8888 Private E-2

    Hi Tim,

    Things seem to be working much better. The antivirus software isn't detecting the infection anymore. I reran the hitman pro and none of those files were there.

    I then reran the MGtools and got the following logs

    Thanks again for your help!

    Ryan
     

    Attached Files:

    Ryan8888, Aug 17, 2012
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.

    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Attach the new HitmanPro log and tell me how things are running.
     
    TimW, Aug 17, 2012
    #5
  6. Ryan8888

    Ryan8888 Private E-2

    The Computer seems to be running fine right now. I just ran the scan and here is the log.

    Thanks!

    Ryan
     
    Ryan8888, Aug 17, 2012
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You didn't attach the log. ;)
     
    TimW, Aug 17, 2012
    #7
  8. Ryan8888

    Ryan8888 Private E-2

    Ooops sorry!

    Here it is
     

    Attached Files:

    Ryan8888, Aug 17, 2012
    #8
  9. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good. Now tell me what malware issues you may still be having, if any.

    Is your firewall working?
     
    Last edited: Aug 18, 2012
    TimW, Aug 18, 2012
    #9
  10. Ryan8888

    Ryan8888 Private E-2

    Hey Tim,

    My firewall seems to be working fine. I'm not having any issues with makware at the moment. The virus scanner doesn't find any problems when I run a scan. the only odd thing I have is that there is a desktop.ini icon on my desktop, I thought that was part of a virus, should I delete it?

    Thanks

    Ryan
     
    Ryan8888, Aug 18, 2012
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0


    That will remove the desktop.ini file. :)
     
    TimW, Aug 18, 2012
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    It's been brought to my attention that your firewall is not running:
    Code:
    Checking Windows Firewall Service -MpsSvc- State 
.
   Windows Firewall Service is NOT running  
        C:\Windows\system32\FirewallAPI.dll exists  
=====================================================================================  
Checking Windows Firewall Authorization Driver Service -mpsdrv- State 
.
   Windows Firewall Authorization Driver Service is NOT running  
        C:\Windows\system32drivers\mpsdrv.sys exists
    Download http://majorgeeks.com/Tweaking.com_-_Windows_Repair_Portable_d7222.html]Windows Repair[/URL] by Tweaking.com and unzip the contents into a newly created folder on your desktop.

    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.


    After reboot, check to see if your firewall is working. To do that, please run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\MGlogs.zip
     
    TimW, Aug 19, 2012
    #12
  13. Ryan8888

    Ryan8888 Private E-2

    Hi Tim,

    Here is the log as requested.

    Thanks!

    Ryan
     

    Attached Files:

    Ryan8888, Aug 20, 2012
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That fixed it. You can now do the final cleanup, if you haven't already done it.
     
    TimW, Aug 21, 2012
    #14
  15. Ryan8888

    Ryan8888 Private E-2

    All done!

    Thanks for all of your help Tim,

    It was greatly appreciated.

    Ryan
     
    Ryan8888, Aug 21, 2012
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Aug 21, 2012
    #16

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds