I think I have some malware but not sure

Discussion in 'Malware Help (A Specialist Will Reply)' started by SailZoom, Nov 23, 2012.

  1. SailZoom

    SailZoom Private E-2

    You guys helped me get read of a really hard to kill virus/malware a few years ago so I hope you have the answer now.

    I'm not sure what you want me to post. All I know is comodo firewall pops up a warning now and then with Windows/temp/ds1ef.tmp

    It is always like this up to the ds and .tmp but the rest of the filename is always different. Kinda reminds of that hard to kill virus I had before. What doc do I need to get for you?

    Thanks Mike
     
    SailZoom, Nov 23, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Nov 23, 2012
    #2
  3. SailZoom

    SailZoom Private E-2

    I tried to download RogueKiller 8.3.0 but norton jumped up and said it was not safe and deleted it??
     
    SailZoom, Nov 23, 2012
    #3
  4. SailZoom

    SailZoom Private E-2

    Norton says yr24bzwr.exe.part suspicious.cloud.7.ep detected by download insight

    then olhdzjdt.exe.part suspicious.cloud.7.ep detected by download insight

    and says it's a heuristic virus
     
    SailZoom, Nov 23, 2012
    #4
  5. SailZoom

    SailZoom Private E-2

    ok I ignored it and ran them anyway. I found funmoods that installed with belarc from cnet using some softronic? install they had and it didn't really find anything else other than tracking cookies.

    So I'll have to wait and see if it pops up again.

    Mike
     

    Attached Files:

    SailZoom, Nov 24, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    MGTools did not run to completion. Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't
    double click, use right click and select Run As Administrator). Attach the new C:\MGLogs.zip.

    http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.

    Tell me what issues you are having.
     
    TimW, Nov 24, 2012
    #6
  7. SailZoom

    SailZoom Private E-2

    Have to wait top see if it pops up again sometime.
     

    Attached Files:

    SailZoom, Nov 25, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your MGLogs again did not populate. Tell me what issues remain.
     
    TimW, Nov 25, 2012
    #8
  9. SailZoom

    SailZoom Private E-2

    I ran mgtools again and got this it did not show any errors. Also Norton ran something in background and ? tried to run again see bmp. It changes the file name all the time. I think you are going to tell me mgtools didn't finish and I'll say it looks like it finishes.

    Tried to attach the desktop print but too big so here it is

    comodo ds30.bat is trying to modify a protected file or directory ds30.bat could not be recognized and it is about to modify the contents of c:\windows\temp\ds2f.tmp. you must make sure it is safe

    so what is this?
     

    Attached Files:

    SailZoom, Dec 2, 2012
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you
    are finished):


    Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.
    cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>
    GetRunKey <-- this will try to run all one scan from MGtools.
    Tell me what error messages, if any, you see.
    ShowNew <-- this will try to run all another scan from MGtools.
    Tell me what error messages, if any, you see.
     
    TimW, Dec 3, 2012
    #10
  11. SailZoom

    SailZoom Private E-2

    I ran it and getrunkey said it could not find a specified file then zipped runkeys.
    ShowNew ran and zipped newfiles, ffdata & winfiles I'm attaching
     

    Attached Files:

    SailZoom, Dec 5, 2012
    #11
  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware in those logs. Let's do one more thing to eliminate malware as the cause of your issues:

    Go here and run this:

    eSet Online Scan.
     
    TimW, Dec 6, 2012
    #12
  13. SailZoom

    SailZoom Private E-2

    ok here it is
     

    Attached Files:

    SailZoom, Dec 6, 2012
    #13
  14. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Well, that only found one thing. Run CCLeaner and tell me what issues remain.
     
    TimW, Dec 7, 2012
    #14
  15. SailZoom

    SailZoom Private E-2

    I ran ccleaner how do I see if any problems remain?
     
    SailZoom, Dec 8, 2012
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Just use the computer and see if any issues arise. Let me know.;)
     
    TimW, Dec 8, 2012
    #16
  17. SailZoom

    SailZoom Private E-2

    ok like I said in a earlier post it randomly pops up a temp file that wants to change a directory and I only know because comodo says do you want to let this happen.

    Thanks for the help
     
    SailZoom, Dec 8, 2012
    #17
  18. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Can you tell me what the file is? And have you run CCleaner in an attempt to delete the file?
     
    TimW, Dec 9, 2012
    #18
  19. SailZoom

    SailZoom Private E-2

    It's never the same and from c:\windows\temp\ds2f.tmp so it can't be found and have run ccleaner a couple times. Haven't seen it lately
     
    SailZoom, Dec 10, 2012
    #19
  20. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since you can't find it and Comodo is keeping it in check, I wouldn't worry about it.

    We can try one more thing:

    Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Vista and Windows 7 users Right-click OTL and choose Run as Administrator)
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    Attach both of these logs into your next reply.
     
    TimW, Dec 11, 2012
    #20
  21. SailZoom

    SailZoom Private E-2

    ok here it is I will have a new malware question tomorrow but since we've done all this I'll do it here because it may have shown I don't have it
     

    Attached Files:

    SailZoom, Dec 14, 2012
    #21
  22. SailZoom

    SailZoom Private E-2

    It seems that our malware search should have caught this I hope or you can tell me to start a new thread.

    I just saw a notice about bank accounts getting hacked by Project Blitzkrieg or “Gozi Prinimalka how do I know if I have it?
     
    SailZoom, Dec 15, 2012
    #22
  23. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware. What issues do you still have, if any?
     
    TimW, Dec 15, 2012
    #23
  24. SailZoom

    SailZoom Private E-2

    none now but it's sporadic so let's say it's gone - thanks alot
     
    SailZoom, Dec 15, 2012
    #24
  25. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let me know if it happens again.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Dec 16, 2012
    #25
  26. SailZoom

    SailZoom Private E-2

    ok thanks I think you got it whatever it was haven't seen it - you guys are good
     
    SailZoom, Dec 19, 2012
    #26
  27. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know. Safe surfing. :)
     
    TimW, Dec 19, 2012
    #27

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds