Desktop koobface

Discussion in 'Malware Help (A Specialist Will Reply)' started by bcbrian, Apr 30, 2010.

  1. bcbrian

    bcbrian Private E-2

    This pc had the rogue program Antivirus Soft spring up suddenly. I had originally tried removing with MalwareBytes and SAS, and neither found the infection. I had manually removed antivirus soft entries from the registry and used Avira to do repeated scans (in safe mode for each user account, then in normal windows for each account). It continually finds files named 3t*.htm (long names with various numbers or letters), and they were always appearing in Network Services\Local Service\Temporary Internet Files\ie.5 folder; I deleted every ie.5 folder I could find on the computer, but even after scans were finishing with nothing found, it often pops up the notification of blocking access to one of these same files. I did an online scan with Housecall that ID'ed and removed Koobface. The Avira notices still have been coming up. I went through the steps in Read and Run me first and am posting the logs. The computer did reboot while Combofix was running but I finished it anyway. Thanks for your help.
     

    Attached Files:

  2. bcbrian

    bcbrian Private E-2

    The last log is attached.
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    The only thing I would question is a file installed back in Feb.:
    C:\Documents and Settings\Owner\Local Settings\Application Data\eliwlk --> If you don't know what it is, delete it.

    Tell me exactly what Avira is complaining about. The exact path to the files.
     
  4. bcbrian

    bcbrian Private E-2

    I deleted the eliwlk (empty folder). I can't say that Avira is still throwing out warnings, because they seemed to have stopped since the previous scans, although the PC hasn't been used for anything else since then. The path of the files that were causing warnings is C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\* (with the * representing a random folder) and the specific file names all seemed to be named 3tAC*.htm. It may be cleared now, but I attached the avguard.log if you wish to see the warnings yourself. (I cut out earlier dates and divided it into 2 files to stay within size limit). This is not from scans; it is logs from the real time guard.
     

    Attached Files:

    Last edited: May 1, 2010
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Then you need to open each of those temp internet folders and delete all that is inside them.

    Example:
    Open C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\N334E4N3 --> control + A then delete.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds