Got the FBI pay $200.00 malware

Xitherius · Nov 8, 2012

Thanks in advance for your help.
Whenever we tried to open IE the screen would fill up with an FBI warning that suggested we had downloaded illegal material and there was a fine that we needed to pay in order to get the use of the internet back.
This machine is running windows xp sp3.
This is only happening on one profile and the profile does not have admin privileges so I could not run some of the programs on that profile. The rest of the profiles have no issues.
It seemed like everything was ok until we tried to log into our webmail. We use earthlink, juno and sac state email. All three of these are getting the same results.
Now whenever we log into a webmail site we can't see our links like for creating an email or attaching things to the email and sometimes IE just freezes up and we have to use the task manager to get out of it.
I tried uninstalling IE 8 and reinstalling it and that did not change anything.
I think there may be something in the registry that is still messed up but I'm out of my depth here.
Thank you,

Xitherius

Kestrel13! · Nov 8, 2012

What happened with HitmanPro? Can you run that please and attach the log.

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Files/Folder tab and locate these 4 detections:

[ZeroAccess][FILE] n : C:\RECYCLER\S-1-5-21-1229272821-220523388-839522115-1005\$57f04a86bf7128ae3815c0e35b45c283\n --> FOUND

[ZeroAccess][FILE] @ : C:\RECYCLER\S-1-5-21-1229272821-220523388-839522115-1005\$57f04a86bf7128ae3815c0e35b45c283\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-1229272821-220523388-839522115-1005\$57f04a86bf7128ae3815c0e35b45c283\U --> FOUND

[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-1229272821-220523388-839522115-1005\$57f04a86bf7128ae3815c0e35b45c283\L --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

What's inside this folder?
C:\Documents and Settings\All Users\Application Data\036DFF590009EDE7012B1C287B07D287

Delete this file unless you know what it is for.
C:\Documents and Settings\All Users\Application Data\cstsm.pad

Re run RogueKiller now (just a scan) and attach log once done.

Let me know how things are running.

Xitherius · Nov 8, 2012

Oops, sorry about that I ran it and neglected to attach it. Here is the hitman pro log.
Thanks,
Xitherius

Xitherius · Nov 8, 2012

Here are the 2 roguekiller log files.
There are 2 files in that folder
036DFF590009EDE7012B1C287B07D287
and
036DFF590009EDE7012B1C287B07D287.ico

I removed that other file and emptied my recycle bin.

Thank you,
Xitherius

Kestrel13! · Nov 8, 2012

Run Hitman and have it delete all it finds. Then tell me how your machine is behaving please.

Xitherius · Nov 8, 2012

Thank you for your assistance.
I ran Hitman and deleted everything it found. I am still having the problem with IE where in webmail the links are there but the picures for the links are not. There are just the boxes with the red x's in them.
It is just on the one profile. The rest of the profiles are working fine.
Thank you again,
Xitherius

Kestrel13! · Nov 9, 2012

You can ask about that in the software forum if you like.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Xitherius · Nov 11, 2012

There is still that problem. Are you telling me the malware is gone and the problem is not from malware and I'm on my own to get it fixed?

Kestrel13! · Nov 11, 2012

No you will not be on your own. You will have the guys and gals in software to help you. Your logs were clean at last check, so this is not a malware issue.

Log in or Sign up

Got the FBI pay $200.00 malware

Xitherius Private E-2

Attached Files:

mbam-log-2012-11-04 (15-20-34).txt

MBRCheck_11.04.12_08.51.01.txt

MGlogs.zip

RKreport[1]_S_11042012_02d1516.txt

TDSSKiller.2.8.15.0_04.11.2012_15.45.53_log.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Xitherius Private E-2

Attached Files:

HitmanPro_20121104_1554.log

Xitherius Private E-2

Attached Files:

RKreport[2]_D_11082012_02d1438.txt

RKreport[3]_S_11082012_02d1442.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Xitherius Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Xitherius Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member