Essential Cleaning?

rpole · May 17, 2011

Got this fake anti-virus the other day. popped up, said my 'puter was infected and started running a scan. stopped it and it stopped but said my 'puter wasn't safe. kept starting up again on it's own. tried to scan w/ my anti-virus, no threats found on a really quick scan.

ran through the R&RMF steps for XP.

SAS ran and found several things and removed them. no Essential Cleaning after that.

MBAM said nothing detected.

could not get ComboFix to run. Said I had to remove my anti-virus (it was disabled at the time). I removed the anti-virus but was not able to uninstall my firewall. tried several times and tried combo several more times w/ the firewall disabled but no luck.

MGTools ran, got the processdll.exe error. installed .NET after reading further down then reran MGTools. (hopefully that was ok).

Thought everything was good, had no issues, nothing popping up, nothing out of the ordinary. toggled system restore after thinking everything was ok. was about to reinstall my AV but saw the 'alternative scans' and figured I'd try one to see what was found. ran ESET online and it found 4 or 5 Java/trojandownloader variants and removed them. not sure what that was about but figured I'd post my logs and have them checked.

rpole · May 17, 2011

here is the ESET log.

Thanks!!!!

Kestrel13! · May 18, 2011

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

File::
C:\Documents and Settings\All Users\Application Data\o1087AeFeAeA5256
Folder::
C:\32788R22FWJFW.0.tmp
DirLook::
C:\rp
Registry::
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}]
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

If after running Combofix you discover none of your programs will open up, and you recieve the following error: "Illegal operation attempted on a registry key that has been marked for deletion". Then the answer is to REBOOT the machine, and all will be corrected.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

rpole · May 18, 2011

Thanks Kestrel!! At work now, will try when I get home. As noted in my original post, I was not able to get ComboFix to run. My AV is uninstalled but I was unable to uninstall my firewall. every time I tried to uninstall it it'd make it part way then give me an error and say it couldn't be removed. I do have it disabled. ComboFix says it won't continue running because of my AV or security suite (don't remember exactly what it said). we'll see what happens when I try later.

Kestrel13! · May 18, 2011

Agh! My bad...

Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe And select " Run as administrator " to run it.

Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.
Code:
:reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}]

:files
C:\Documents and Settings\All Users\Application Data\o1087AeFeAeA5256
C:\32788R22FWJFW.0.tmp

:Commands
[emptytemp]
[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.

OTM may ask to reboot the machine. Please do so if asked.

Copy everything in the Results window (under the green bar), and paste it into notepad, save it as something appropriate and attach it into your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

rpole · May 18, 2011

should I try ComboFix first or just move on w/ the new instructions?

Thanks again.

Kestrel13! · May 18, 2011

Stick to the new instructions now.

rpole · May 18, 2011

Hi Kestrel. Sorry to get to this so late. and, sorry for the following questions/confusion.

I downloaded OTM to my desktop. when I right click on it, there is not 'run as administrator' option. just 'run as.....' when I clicked that I got the normal open file pop up with either 'run' or 'cancel' as options. I chose run. when doing so it asks which user account I want to use to run the program. it's either the current user or another and gives me the option to put in a username and password. I chose current user. there was a check box that says 'protect my computer and data from unauthorized program activity'. I left that checked since I wasn't sure. then I copied and pasted your instructions and hit MoveIt. after it asked to reboot my PC, I clicked yes or whatever but it never rebooted? the results basically say it was unable to do anything. I'm not sure if that was because of how I ran it, or if it is because I left that check box checked, or??? I didn't run TDSSKiller just in case this needs to be cleaned up first. here's the results from OTM....

rpole · May 18, 2011

I rebooted and there was nothing in the results box. (not sure if there should have been or not?). when I just double click and go to run it, I don't get the option w/ the check box. I was tempted to run it that way but figured I'd wait to be sure.

Kestrel13! · May 19, 2011

Carray on and run TDSSKiller. Then do not forget this part!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

rpole · May 19, 2011

finally able to sit down tonight. downloaded TDSSkiller to my desktop and ran. no issues running and it said no threats were found. log attached.

oops, dang it, will get the getlogs file in a sec. sorry.

rpole · May 19, 2011

here is the MGTools log. there was one warning while it ran.

C:\Qoobox\quarantine\registry backups.... then right after a zip warning saying name not matched. then a zip error 'nothing to do'. not sure if that's important or not, will probably show up in the logs, but wanted to mention it.

as always....Thank You!

rpole · May 20, 2011

Hey Kestrel. just a quick note, any further instructions I won't be able to get to until Monday at the earliest. I'm heading out of town this evening. Nothing to report on the infected PC, it hasn't been on since my last post and will remain off until I get back to the next instructions.

Thanks, have a good weekend!!

Kestrel13! · May 21, 2011

C:\32788R22FWJFW.0.tmp <--- delete this folder.

Tell me how things are running when you return on monday. I think we can wrap up very soon.

rpole · May 23, 2011

I removed that folder. then I reinstalled my AV and enabled my firewall. I've been on for a little bit and browsing and everything seems good.

Kestrel13! · May 23, 2011

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Essential Cleaning?

rpole Private E-2

Attached Files:

SASlog.txt

mbam-log-2011-05-17 (11-58-43).txt

rrlog.txt

MGlogs.zip

rpole Private E-2

Attached Files:

ESETSscan.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Attached Files:

OTM1.txt

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Attached Files:

TDSSKiller.2.5.1.0_19.05.2011_20.47.56_log.txt

rpole Private E-2

Attached Files:

MGlogs.zip

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Essential Cleaning?

rpole Private E-2

Attached Files:

rpole Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Attached Files:

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Attached Files:

rpole Private E-2

Attached Files:

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

rpole Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches