Desktop Computer Infected

TomLLLLL · Mar 22, 2016

Hi, I was downloading what I thought was a windows media file but when I tried to play it, I got a virus.

The symptoms of the virus include:
Computer is downloading programs without my permission. At first I was able to go to the control panel and remove then, but now they are no longer showing up there (ie.WeatherBug program).

Google chrome won't open saying the application failed to start becasue its side by side configuration is incorrect.

McAfee keeps blocking a program from running called Artemis!B1C04A8882D1

I have gone thru the run me first and am uncertain if any new programs have been downloaded since and also need help getting rid of the remaining programs.

Thanks for the help

Kestrel13! · Mar 22, 2016

Hello there, and a warm welcome to Majorgeeks. I am just reviewing your logs and will post back with a response soon.

Kestrel13! · Mar 22, 2016

WebOptimum <<< Uninstall this if you can using Revo Uninstaller If you cannot, just continue on with next steps...

I'd like you to re run Hitman Pro, activate/enable the free trial, and then let it remove all that it finds.

Next, re run Malware Bytes and let it remove anything else it *may* find.

Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\SecureWebChannel -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\SP Global -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\WIN -> Found

[PUP] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b608cc98-54de-4775-96c9-097de398500c} -> Found

[Suspicious.Path|VT.Backdoor.Win32.Agent.gprn] (X64) HKEY_USERS\S-1-5-21-3736828203-796322993-1323128906-1001\Software\Microsoft\Windows\CurrentVersion\Run | Pritc : C:\Users\Thomas\AppData\Local\Temp\is-GPOTA.tmp\print.exe [-] -> Found

[Suspicious.Path] (X64) HKEY_USERS\S-1-5-21-3736828203-796322993-1323128906-1001\Software\Microsoft\Windows\CurrentVersion\Run | Chromium : "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session [x][x][x][x] -> Found

[Suspicious.Path|VT.Backdoor.Win32.Agent.gprn] (X86) HKEY_USERS\S-1-5-21-3736828203-796322993-1323128906-1001\Software\Microsoft\Windows\CurrentVersion\Run | Pritc : C:\Users\Thomas\AppData\Local\Temp\is-GPOTA.tmp\print.exe [-] -> Found

[Suspicious.Path] (X86) HKEY_USERS\S-1-5-21-3736828203-796322993-1323128906-1001\Software\Microsoft\Windows\CurrentVersion\Run | Chromium : "c:\users\thomas\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session [x][x][x][x] -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...Same for these on the Tasks tab...

[PUP] %WINDIR%\Tasks\ENANJHXLHOVSUDQA.job -- C:\ProgramData\Service5191\Service5191.exe -> Found

[Suspicious.Path|VT.UDSangerousObject.Multi.Generic] %WINDIR%\Tasks\Price Fountain.job -- C:\Users\Thomas\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found

[Suspicious.Path] %WINDIR%\Tasks\SOCZF1.job -- C:\ProgramData\CoffeeFeed\CoffeeFeed.exe -> Found

[Suspicious.Path|VT.PUP.Optional.DealPly] \PFExe -- C:\Users\Thomas\AppData\Local\PriceFountain\pricefountain.exe -> Found

[Suspicious.Path|VT.UDSangerousObject.Multi.Generic] \Price Fountain -- C:\Users\Thomas\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE (/Check) -> Found

[Suspicious.Path] \runTask -- %TEMP%/Updater.exe (/install) -> Found

[Suspicious.Path] \SOCZF1 -- C:\ProgramData\CoffeeFeed\CoffeeFeed.exe -> Found

...and these on the Files/Folder tab...

[PUP][File] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WeatherBug®\WeatherBug® Update.lnk [LNK@] C:\ProgramData\{FA77A43D-F6ED-4924-87B5-517C061388C6}\WeatherBugSetup.exe /update /shw -> Found

[Tr.DNSPatcher|VT.Unknown][File] C:\Windows\System32\dnsapi.dll -> Found

[Tr.DNSPatcher|VT.Unknown][File] C:\Windows\SysWOW64\dnsapi.dll -> Found

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Re run Hitman Pro (just a scan) and upload FRESH log.
Same for RogueKiller.
Please re run TDSSKiller, and upload the FRESH log.
Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

...and finally...

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: Make sure you download the correct version for your PC. Only the correct version will work.

Double-click to run it. When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.

The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

TomLLLLL · Mar 22, 2016

Hey Kestrel thanks for the help. I am currently in the process of going thru you're instructions and have a question. I downloaded the revo uninstaller, but I couldn't find web optomium.

I then moved on to hitman pro where I signed up for the free trial and ran it as an admin. Now it says it partially removed the malicious software and wants me to reboot to complete removal. It also gives me the option to just close out of it. Your instructions didn't say to reboot yet and I just want to double check which option to choose with you.

Kestrel13! · Mar 22, 2016

Yes Tom, go ahead and reboot, that's fine

TomLLLLL · Mar 22, 2016

Ok, Just finished running thru the instructions. The only issue I had was when I ran rouge killer and was looking to delete the files you said to not all of them were there... I think hitman pro might have picked them up first. Besides that everything looks good, the unwanted programs are gone and my pc seem back to normal.

I've attached the KRreport2, JRT, Hitman(Fresh), TDSSkiller(Fresh) and the MGlogs (fresh). I will upload the FRST and RKreport (Fresh) in a following post

TomLLLLL · Mar 22, 2016

The final 2 documents. FRST and a fresh RKreport.

Thanks again for the help.

Kestrel13! · Mar 22, 2016

Hi there. Do you also have the Addition.txt from running FRST? I would like to see that as well, please. Best to be thorough. I am glad things are running better, however there is still some work to do here. I'm in the UK though, and it's my bedtime now. I am going out for a few hours tomorrow, so will post back to you at the soonest opportunity.

TomLLLLL · Mar 22, 2016

Yeah sorry. Forgot to attach it. Have a goodnight.

Kestrel13! · Mar 23, 2016

Hello there. I am back, reviewing the logs now. Will post back very soon.

Kestrel13! · Mar 23, 2016

NOTE: This script was written specifically for this user for use on this particular computer. Running this on another machine may cause damage to your operating system.
Download Fixlist.txt

Save fixlist.txt on your Desktop. Make sure you save it as a txt file.

You should now have both fixlist.txt and FRST64.exe on your Desktop.

Now I want you to disconnect your PC connection to the internet by unplugging the cable ( if it is wireless then temporarily shutdown the wireless network ).

Run FRST64.exe by right clicking on it and selecting Run As Adminstrator

Click the Fix button just once and wait.

Your computer should reboot after the fix runs.

Reconnect your internet connection after reboot so you can come back here to continue.

The tool will make a log on the Desktop (Fixlog.txt) please upload this new log to your next reply.

Then attach the below logs:

Fixlog.txt

Also at this point, I want to double check the status of things by having you run another scan with FRST like in my last message and attach the new FRST.txt and Addition.txt logs.

Next... Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

TomLLLLL · Mar 23, 2016

Thanks. Just got in for the night. I'll run it first thing in the morning.

TomLLLLL · Mar 24, 2016

Good Morning. I ran FRST64 fix and had no issues with it. Below are all the logs.

Kestrel13! · Mar 24, 2016

Hi there

I have to pop out for a little while soon, so as I do, post back and explain to me how things are running.

TomLLLLL · Mar 24, 2016

The computer is running great!!! The speed is as I remember it and there have been no new hidden downloads since we started. There are just a few things that I'd like to ask you about.

The 1st is when I was trying to remove the programs thru the control panel before I came here, I also removed Google Chrome because I thought the virus was coming thru it. Is it ok that I re-download chrome?

2nd a few of my excel files were copied I think, but the copies are only 1kb and have a ~$ in from of them, should I just delete them?

Lastly it looks their are some leftover remnants of the virus still in my downloads folder. There is a MediaDownloader.exe last modified about an hour after my computer was infected as well as a desktop.ini from about the time I got infected. The file desktop.ini is also in my music, picture and video libraries.

Thank you so much for all this help you've given me, I greatly appreciate it.

Kestrel13! · Mar 24, 2016

TomLLLLL said: ↑

Is it ok that I re-download chrome?
Click to expand...

I don't recommend using it, personally. Time and time again I see people posting here with problems with google chrome redirects and pop ups, and more and more frequently they are becoming harder problems to fix. Choice is yours though of course.

TomLLLLL said: ↑

and have a ~$ in from of them, should I just delete them?
Click to expand...

That is something to ask about in the software forum.

Desktop.ini files are fine, they are showing because during our procedures hidden files and folders were set to show. This will reverse when you follow final steps. The files will disappear from your view.

You are so welcome for the help, glad you're running nicely again. Final steps below...

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

TomLLLLL · Mar 24, 2016

I went through your final instructions and updated my antivirus, everything is back to normal. Thanks again for all your help.

Kestrel13! · Mar 24, 2016

Most welcome, Tom. Safe surfing!

Desktop Computer Infected

TomLLLLL Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TomLLLLL Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TomLLLLL Private E-2

Attached Files:

TomLLLLL Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TomLLLLL Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

TomLLLLL Private E-2

TomLLLLL Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TomLLLLL Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

TomLLLLL Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member