Help with finishing removal of "winscrmde" trojan virus

Discussion in 'Malware Help (A Specialist Will Reply)' started by chuckk67, Nov 18, 2012.

  1. chuckk67

    chuckk67 Private E-2

    I have been having an issue with the trojan horse listed above, but after following your guide on malware removal, it appears that the file "svchost.exe" that was associated with the malware has been removed after running TDSSKiller. My concern is that hitmanpro found another trojan and the guide recommended that I do not remove anything unless instructed to do so by one of your malware removal experts. I have attached the logs for the scans. Any help on how to finish removing the threat would be greatly appreciated.

    P.S. TDSSKiller is the only scan I allowed to remove results according to the guide and Malwarebytes I had tried to run previously and it was unable to remove the virus effectively.
     

    Attached Files:

    chuckk67, Nov 18, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Files/folders tab and locate these detections:

    • [ZeroAccess][FILE] @ : C:\Windows\syswow64\config\systemprofile\AppData\Local\{45c71ccd-3582-8ade-de5c-c942665fa6e8}\@ --> FOUND
      [ZeroAccess][FOLDER] U : C:\Windows\syswow64\config\systemprofile\AppData\Local\{45c71ccd-3582-8ade-de5c-c942665fa6e8}\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\Windows\syswow64\config\systemprofile\AppData\Local\{45c71ccd-3582-8ade-de5c-c942665fa6e8}\L --> FOUND
      [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
      [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Rescan with HitmanPro.
    Choose to Delete these files if they are detected:

    • C:\Windows\assembly\gac_32\Desktop.ini
    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Now after a reboot, rescan with both RogueKiller and Hitman and attach those logs as well.

    Be sure to tell me how things are running now.
     
    TimW, Nov 19, 2012
    #2
  3. chuckk67

    chuckk67 Private E-2

    I ran all the scans post reboot. Nothing came up. It looked like Rogue killer removed everything the first time around. Thank you so much for your help. I really appreciate that you guys take the time to do this. This is the first time I have gotten hit with really bad malware. Do you recommend using certain scans regularly? Or is it better to do a case by case scenario? Not that I am hoping I get another malware problem or anything.

    Again.. THANK YOU!
    Chuck :-D
     

    Attached Files:

    chuckk67, Nov 20, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Nov 20, 2012
    #4
  5. chuckk67

    chuckk67 Private E-2

    Again, thanks for the help so far. I was about to follow the steps you suggested, but randomly decided to run MalwareBytes again. I have attached the log, but it appears that the trojan is still in my system file of windows even though I do not see it acting within my task manager when I look at the processes running. (The last time I could see it using up system resources). I am hesitant to remove it via malwarebytes as the last time I did that the windows file began to use up resources as described above. Like it was activated somehow by the removal.

    Should I use TDSSKiller to remove it? I haven't had it run a scan yet, but the last time it successfully removed the file. If I do, how can I prevent this file from appearing again?

    Thanks for any help of course.
     

    Attached Files:

    chuckk67, Nov 24, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Have MBAM fix it. Then run TDSSKiller and attach the log.
     
    TimW, Nov 24, 2012
    #6
  7. chuckk67

    chuckk67 Private E-2

    Okay, ran MBAM as instructed and no threats showed up on TDSSKiller. Here is the log. I don't know why that virus came back. I haven't even used this computer for internet access.
     

    Attached Files:

    chuckk67, Nov 24, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Is everything running good now?
     
    TimW, Nov 25, 2012
    #8
  9. chuckk67

    chuckk67 Private E-2

    It looks like that fixed everything. Thanks again! I assume I can just go through the wrap-up steps you had recommended previously? I will keep running MalwareBytes to see if that pops up again. I hope it doesn't.

    Thanks! :-D
     
    chuckk67, Nov 25, 2012
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know. Safe surfing. :)
     
    TimW, Nov 26, 2012
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds