Installed Trojan through Java update

ronster11 · Nov 8, 2012

Hello I seem to have installed a nasty Trojan through a fake Java update. I have done the steps in the Read & Run Me First thread. (will attach all logs) The reason I am posting this thread is because I am not sure the Trojan is gone. I ran a scan with Microsoft Security Essentials and it didnt find anything however when I checked the history their was a list of quarantined Trojans: (which I removed)
Trojan:Win32/Alureon.gen!AD Severe Quarantined
Trojan:Win64/Alureon.gen!F Severe Quarantined
Trojan:Win32/Orsam!rts High Quarantined
Trojan:Win64/Alureon.gen!L Severe Quarantined
I also keep getting the Java update pop up. When I first started to try and remove this I ran Microsoft Security Essentials and it found an Alureon Trojan MSE asked me to download Windows Defender offline which I had to do manually no success. Then I ran malwarebytes and it found SVCHOST.EXE but it didnt remove it even though the log said it was successfully removed. So I am unsure if steps 1-4 in the Vista & Win & Malware Removal/Cleaning Procedure cleaned my PC. Can anyone help? Thanks in advance.

ronster11 · Nov 8, 2012

I had to post one more reply to add one more log.

ronster11 · Nov 8, 2012

One more reply for one more log. Forgot HitmanPro.

Kestrel13! · Nov 9, 2012

Rerun Hitman and have it delete anything it finds,

Is this running purposely?
(camera monitoring software)

[RUN][SUSP PATH] HKLM\[...]\Run : spc1300 (C:\Windows\vspc1300.exe) -> FOUND

RogueKiller may or may not detect these:

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Files/Folder tab and locate these 3 detections:

[ZeroAccess][FILE] @ : C:\Windows\Installer\{8a2f86eb-7640-6cda-ddf1-f1e1a1a172a9}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{8a2f86eb-7640-6cda-ddf1-f1e1a1a172a9}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{8a2f86eb-7640-6cda-ddf1-f1e1a1a172a9}\L --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Delete this (do not confuse it with services.exe)

C:\Windows\SysNative\services.exe.1E5DCB4EFC5E61E1

Rerun MalwareBytes and attach the log if it finds anything.
Rerun TDSSKiller and attach the log.
Scan with RogueKiller and attach the log from that too.
Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

ronster11 · Nov 11, 2012

Thank you for replying Kestrel13. I worked 7 days this week so I havent had time to rerun the scans you mentioned but I will post back as soon as I run them. I didnt want you to think I had given up. Thanks once again.

Kestrel13! · Nov 11, 2012

No worries, I'll be here.

ronster11 · Nov 14, 2012

Hello Kestrel13! Here is the info of the rescans I will attach MGtools log in next post hopefully I didnt miss anything.

ronster11 · Nov 14, 2012

I ran hitman pro deleted file it found will attach log
ran roguekiller nothing under files found.
Yes. [RUN][SUSP PATH] HKLM\[...]\RUN : SPC1300 (C:\WINDOWS
\VSPC1300.EXE)-> FOUND is running purposely (MY WEBCAM)
could not find C:\Windows\SysNative\services.exe.1E5DCB4EFC5E61E1 in the root drive.
Ran malwarebytes and SVCHOST.EXE keeps coming up which is the one that concerns me. See attached logs.
TDSSkiller found nothing see attached log.
Reran MGtools I am attaching log.
Do I need to be concerned about SVCHOST.EXE or is malwarebytes just picking up leftover traces of trojan. My computer runs good I dont get any redirects when Im online nothing seems to be wrong. But from what Ive read from SVCHOST.exe my usernames and passwords can be comprimised. Let me know what you think. Thanks once again.

Kestrel13! · Nov 14, 2012

Run the below.

http://img827.imageshack.us/img827/1263/frst.gif For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Choose your language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this log to your next reply. (How to attach)

ronster11 · Nov 14, 2012

Here is Farbar recovery scan. On a different note what is the easiest way to find this thread. I log on go click on Majorgeeks.com find my user name then I click on my stastics and then I click on the title of this thread. Do you know a faster way?

Kestrel13! · Nov 15, 2012

I just look at USER CP > Subscribed threads.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

Re run Malware Bytes. Still being detected or not?

ronster11 · Nov 15, 2012

Hello Kestrel13! after I re-ran yesterdays scan I ran MalwareBytes again and it only found something in TDSSkillers quarantine folder I'll atach log. I ran MalwareBytes againg right now and it didnt find anything. Should I still run Farbar scan (FRST64) and Fixlist.txt?

Kestrel13! · Nov 16, 2012

No, no need if MBAM no longer detects.

if all is well...

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

ronster11 · Nov 17, 2012

Hello Kestrel13! I ran Microsoft Security Essentials full scan it didnt find anything. I also ran MalwareBytes full scan and it didnt find anything. So it looks like the computer is finally clean. I will go through the final steps and review the How to protect yourself from malware! Is their a good and affordable antimalware that you recommend? Thank you once again for all your help. You truly are a Super Malware Fighter!!!!!!!!!!!!!!:major

Kestrel13! · Nov 18, 2012

Glad your all sorted, Ron.

Installed Trojan through Java update

ronster11 Private E-2

Attached Files:

ronster11 Private E-2

Attached Files:

ronster11 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ronster11 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ronster11 Private E-2

Attached Files:

ronster11 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ronster11 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

ronster11 Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

ronster11 Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member