malware deleting files every day

Layzie Bone · Sep 11, 2012

Trying to help someone remove some malware from their computer, and usually I'm successful, but this one is really hiding it tracks.

The virus deletes files within folders on his desktop, my documents, favorites...anything contained within his user profile. Data located in other places, such as the root of the 'C' drive are not effected.

The virus does it's dirty work every 24 hours, and the computer in question is left on 24-7.

No malware removal tools are detecting the virus: Malwarebytes, ComboFix, Avast!, TDSSKiller.

The computer otherwise runs normally, surfs the internet fine.

TimW · Sep 11, 2012

Please follow these instructions:

READ & RUN ME FIRST. Malware Removal Guide

Layzie Bone · Sep 12, 2012

Logs are attached for Rouge Killer, MGTools, mbam, and HitmanPro. It appears that files and some (not all) folders are being deleted every 24 hour period (i.e. any new files that are saved are "gone" the next day) from the Desktop, My Documents, Favorites, etc. The computer otherwise appears to run normally, just most all data has been erased from those folders. Data isn't important, software/setup is. Thanks in advance.

TimW · Sep 13, 2012

Download The Avenger by Swandog46 to your Desktop.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][SUSP PATH] HKLM\[...]\Run : Sevas-SSoftwareDefender (C:\Documents and Settings\Administrator\Local Settings\Application Data\Sevas-S\Defender\defender.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Run : Sevas-SSoftwareUpdater (C:\Documents and Settings\Administrator\Local Settings\Application Data\Sevas-S\Updater\updater.exe) -> FOUND
[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot your computer.

Extract avenger.exe from the Zip file and save it to your desktop.

Run avenger.exe by double-clicking on it.

Click OK at the warning to continue to use The Avenger

Do not change any of the check box options!

Shut down your protection software now to avoid possible conflicts.

Copy everything in the Quote box below, and paste it into the Input script here: part of The Avenger

Files to delete:
C:\Documents and Settings\Administrator\Local Settings\Temp\15116100998859421.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\151161009920320812.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\16825761120320703.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\415303181910163515.tmp
C:\Documents and Settings\Administrator\Local Settings\Temp\415303181920325625.tmp
C:\WINDOWS\Tasks\at1.job
C:\Documents and Settings\Administrator\Local Settings\Application Data\Sevas-S\Defender\defender.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Sevas-S\Updater\updater.exe

Folders to delete:
C:\Documents and Settings\Administrator\Local Settings\Application Data\Sevas-S

Registry values to delete:
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run |Sevas-SSoftwareDefender
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run |Sevas-SSoftwareUpdater
Click to expand...

Now click the http://img33.imageshack.us/img33/9159/executeavenger.jpg button

Click Yes to the prompt to confirm you want to execute.

Click Yes to the Reboot now? question that will appear when The Avenger finishes running.

Your PC should reboot, if not, reboot it yourself.

A log file from The Avenger will be produced at C:\avenger.txt and it will pop-up for you to view when you login after reboot.

Attach this log to your next message. (See: HOW TO: Attach Items To Your Post )

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).Make sure that you watch for the license agreement for TrendMicro HijackThis and click on the Accept button TWICE to accept ( yes twice ).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

malware deleting files every day

Layzie Bone Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Layzie Bone Private E-2

Attached Files:

HitmanPro_20120912_2258.log

mbam-log-2012-09-12 (22-19-02).txt

MGlogs.zip

RKreport[1].txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member