Daughters Laptop

Discussion in 'Malware Help (A Specialist Will Reply)' started by cabbiinc, Feb 12, 2015.

  1. cabbiinc

    cabbiinc Staff Sergeant

    My daughter was in Job Corps. My mother paid for a new laptop for her. There wasn't any wifi or internet in Job Corps so it was common to swap USB sticks with god knows what on it. So even if you had AV software (she had Avira) it was never ever current, and neither were the MS updates.

    Now she's graduated and has regular use of internet with her laptop. Please look at the attached logs and advise. Thanks in advance.

    (edit: I know that you don't ask for Hijack This logs but it ran with MGTools so I included the txt file. Ignore it if you want. Also TDSSKiller didn't find anything nor produce a log.)
     

    Attached Files:

    cabbiinc, Feb 12, 2015
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there. :)

    We can begin by you re running Hitman Pro and letting it remove everything that it finds.

    Now by the looks of the log, you did not let Malware Bytes fix all it found, so re run it and let it do so. Attach new log for me to see of what it has removed please.




    http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:

    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52} -> Found
    • [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Windows\CurrentVersion\Run | Gameo : C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.exe
    • [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Windows\CurrentVersion\Run | Gameo : C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.exe "C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.dat" mode:minimized -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Northern Themes Service (C:\Users\Sabryna\AppData\NTSFile\NTS.exe -svcname=Northern Themes Service) -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Northern Themes Service (C:\Users\Sabryna\AppData\NTSFile\NTS.exe -svcname=Northern Themes Service) -> Found
    • [PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.SearchPage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found
    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found

    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.

    ...and same for these on Tasks tab:

    • [Suspicious.Path] UpdaterEX.job -- C:\Users\Sabryna\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found
    • [Suspicious.Path] WSE_Astromenda.job -- C:\Users\Sabryna\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found
    • [Suspicious.Path] \\gameo_update -- C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.exe (C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.dat update:update) -> Found
    • [Suspicious.Path] \\TidyNetwork Update -- C:\Users\Sabryna\AppData\Local\TidyNetwork\petnupdate.exe (CID=trmix12 NAME=TidyNetwork AUTOGUID={6F0D1C0F-1F83-3CED-CAA0-42BB146443DE}) -> Found
    • [Suspicious.Path] \\UpdaterEX -- C:\Users\Sabryna\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found
    • [Suspicious.Path] \\WSE_Astromenda -- C:\Users\Sabryna\AppData\Roaming\WSE_AS~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found


    ...and the same for these in Host File tab...

    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 media.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 api.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.betterinstaller.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.filebulldog.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 inno.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 nsis.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.file2desktop.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.goateastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.guttastatdk.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.inskinmedia.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.oibundles2.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.playbryte.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.llogetfastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.montiera.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.msdwnld.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.mypcbackup.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.ppdownload.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.riceateastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.shyapotato.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.solimba.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.tuto4pc.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.appround.biz
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bigspeedpro.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bispd.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.cdndp.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.download.sweetpacks.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.dpdownload.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.visualbee.net

    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.





    http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.


    • Now re run Hitman (just a scan) and attach log.
    • Same for RogueKiller.
    • Next...
    • Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
    • Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!
     
    Kestrel13!, Feb 12, 2015
    #2
  3. cabbiinc

    cabbiinc Staff Sergeant

    Done and done.

    It seems there's some still here and some not. Trying to decipher which is which isn't easy. I'm marking the ones I can find as green and the ones I can't find as red. Doesn't mean it's not there just that I'm not seeing it with my aging eyes.

    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{051E9166-B275-4683-907B-372FAE22BC7C} -> Found
    • [PUP] (X64) HKEY_CLASSES_ROOT\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52} -> Found
    • [Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Windows\CurrentVersion\Run | Gameo : C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.exe I found no instances of this
    • [Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Windows\CurrentVersion\Run | Gameo : C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.exe "C:\Users\Sabryna\AppData\Roaming\Gameo\gameo.dat" mode:minimized -> Found I found two identical instances of this and checked them both
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Northern Themes Service (C:\Users\Sabryna\AppData\NTSFile\NTS.exe -svcname=Northern Themes Service) -> Found
    • [Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Northern Themes Service (C:\Users\Sabryna\AppData\NTSFile\NTS.exe -svcname=Northern Themes Service) -> Found
    • [PUM.HomePage] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.HomePage] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.istart123.com/?type=hp&t...id=HGSTXHTS541075A9E680_140219JD12091A0AD83AX -> Found
    • [PUM.SearchPage] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found
    • [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found
    • [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-1926996400-3191054640-2753329545-1001\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.istart123.com/web/?type=ds&ts=1422905592&from=wpm0202&uid=HGSTXHTS541075A9E680_140219JD12091A0AD83AX&q={searchTerms} -> Found

    There's no check box for these. I suspect when I hit the Delete button for the previous it deleted these as well. I'm showing the ones in green which I can see and the ones in red which I can't find. Assuming it erased all I hope I didn't screw things up.
    Only the list of Host Files that you gave me are shown. I think I dodged a bullet on that one.

    I didn't see the report anywhere so I clicked report.



    The home page for Chrome is still istart123.com, other than that it seems to be a spry computer again. Although I despise the Win8 interface and couldn't tell you if there was too much amiss other than it being MUCH faster. Thanks
     

    Attached Files:

    Last edited: Feb 13, 2015
    cabbiinc, Feb 13, 2015
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    On the Host File tab - in RogueKiller, these still show and they need to be removed. ;)

    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 media.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 tracking.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 api.opencandy.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.betterinstaller.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 installer.filebulldog.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 inno.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 nsis.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.file2desktop.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.goateastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.guttastatdk.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.inskinmedia.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.oibundles2.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.insta.playbryte.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.llogetfastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.montiera.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.msdwnld.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.mypcbackup.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.ppdownload.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.riceateastcach.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.shyapotato.us
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.solimba.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.tuto4pc.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.appround.biz
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bigspeedpro.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bispd.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.bisrv.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.cdndp.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.download.sweetpacks.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.dpdownload.com
    • [C:\Windows\System32\drivers\etc\hosts] 0.0.0.0 cdn.visualbee.net


    To clean up Google Chrome do this:

    Using Revo Uninstaller uninstall the below:
    1. Google Chrome
    2. Google Drive
    3. Google Update Helper

    Reboot the machine, now reinstall Google Chrome.

    Re scan again with RogueKiller (just a scan this time) and attach that log too.

    Let me know how G. Chrome is behaving.
     
    Kestrel13!, Feb 14, 2015
    #4
  5. cabbiinc

    cabbiinc Staff Sergeant

    Uninstalled and reinstalled Google Chrome. Uninstalled Google Drive. Couldn't find Google Update Helper.

    Rebooted and scanned with RougeKiller. Log attached.

    Thanks so much.
     

    Attached Files:

    cabbiinc, Feb 14, 2015
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Kestrel13!, Feb 15, 2015
    #6
  7. cabbiinc

    cabbiinc Staff Sergeant

    A well running computer is a beautiful thing. Thanks for all your work. It's running great.
    Entry removed and log attached.

    Thanks again
     

    Attached Files:

    cabbiinc, Feb 15, 2015
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Good to hear! :) Ready for final steps?
     
    Kestrel13!, Feb 15, 2015
    #8
  9. cabbiinc

    cabbiinc Staff Sergeant

    Yes, I think I am ready for the final steps. Thanks again.
     
    cabbiinc, Feb 16, 2015
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore​
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:
     
    Kestrel13!, Feb 17, 2015
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds