EDM - adware

gregdil · May 23, 2015

Hello,

An employee infected a new Windows 7 computer with some adware.
Ran all the scans with no problems and now things are back to normal.
Log files are attached.

Thanks for your help!

Greg

Kestrel13! · May 23, 2015

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\fegukygy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\nsb772.tmpfs) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /svc) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /medsvc) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\gupycegy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\jnsh3108.tmp) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\rycimizu (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\hnsw4583.tmp) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fegukygy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\nsb772.tmpfs) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /svc) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /medsvc) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\gupycegy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\jnsh3108.tmp) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\rycimizu (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\hnsw4583.tmp) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\fegukygy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\nsb772.tmpfs) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\globalUpdate (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /svc) -> Found

[PUP] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\globalUpdatem (C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /medsvc) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\gupycegy (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\jnsh3108.tmp) -> Found

[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\rycimizu (C:\Users\EDM\AppData\Roaming\4C4C4544-1432139095-5410-805A-C3C04F383432\hnsw4583.tmp) -> Found

Place a checkmark next to each of these items, leave the others unchecked.
Now press the Delete button.

...and the same for this entry on the task tab please....

[Suspicious.Path] \\NetEngine -- "C:\ProgramData\NetEngine\bin\D10\netengine.exe"

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run Malware Bytes please and have it remove anything else it may find.

Re run Hitman Pro and have it remove all that it finds.

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running!

gregdil · May 25, 2015

Hi Kestrel

In the process of running Rogue Killer I was prompted that an update was available. I installed the update version 10.7.0.0 and ran the scan.

The report is attached.

None of the registry entries or task that you want me to remove are present in the new RK scan.

Was updating RK a mistake? (Sorry if it was!)
Shall I continue w/ the Malware Bytes, Hitman Pro, JRT, and MG scans?

Thanks,

Greg

Kestrel13! · May 25, 2015

Yes, continue on, Greg.

gregdil · May 25, 2015

Hi Kestrel,

New logs for Malware Bytes, Hitman Pro, JRT, and MGLogs scans that were run today.

On reboot after Hitman Pro, the following message appeared between boot screens:
#37 FAIL [error code]
Not sure if it is relevant.

Malware Bytes is running in the background now and a pop up warning that Malicious Web Sites were blocked appears from time to time.
Not sure if it is relevant to the issue or just Malware Bytes working like it should.

Everything else seems fine so far.

Thanks again,

Greg

Kestrel13! · May 25, 2015

Re run Hitman Pro just so I can see if anything remains. Attach log please if it finds anything.

gregdil · May 26, 2015

Hi Kestrel,

Hitman Pro came back clean this time!
Everything looks good

Thanks for your help!

Greg

Kestrel13! · May 26, 2015

Hang on.

Uninstall this:

globalupdate Helper

Did it uninstall smoothly?

gregdil · May 26, 2015

Hi Kestrel

I do not see globalupdate Helper in the control panel -> add or remove programs. It is not in the uninstall tab of cCleaner either.

I checked for it in Google Chrome and IE extensions but it was not in either of those places.

So, I'm not sure exactly how to uninstall it.

I did find a couple files on the hard drive:
C:\Windows\Prefetch\GLOBALUPDATE.EXE-AFA6DA21.pf
C:\Windows\Prefetch\GLOBALUPDATECRASHHANDLER.EXE-3B319581.pf

Greg

gregdil · May 26, 2015

Hi Kestrel,

Sorry for the double post.

I just checked the Malwarebytes quarantine and PUP.Optional.GlobalUpdate.* is all over it.
I've deleted all the quarantined files.

Thanks again,

Greg

Kestrel13! · May 26, 2015

This key remains, are you comfortable deleting it yourself from the Windows Registry?

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

gregdil · May 27, 2015

Hi Kestrel,

I've deleted that registry entry.

These files are no longer there (not sure if that has to do with the registry entry or clearing Malwarebytes quarantine):
C:\Windows\Prefetch\GLOBALUPDATE.EXE-AFA6DA21.pf
C:\Windows\Prefetch\GLOBALUPDATECRASHHANDLER.EXE-3B319581.pf

Thanks again,

Greg

Kestrel13! · May 27, 2015

Most welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

gregdil · Jun 1, 2015

You guys are the best!

Donation on the way!

Greg

Kestrel13! · Jun 1, 2015

Thankyou very much indeed, we really appreciate it!

Log in or Sign up

EDM - adware

gregdil Private E-2

Attached Files:

RKreport_SCN_05222015_104215.log

20150522_EDM_MBytes1.txt

TDSSKiller.3.0.0.44_22.05.2015_12.46.41_log.txt

HitmanPro_20150522_1401.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

Attached Files:

RKreport_SCN_05252015_104516.log

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

Attached Files:

20150525_EDM_MBytes2.txt

HitmanPro_20150525_1215.log

20150525_EDM_JRT_Report1.txt

20150525_EDM_MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

gregdil Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

gregdil Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member