Malware/Spyware/Virus??

Discussion in 'Malware Help (A Specialist Will Reply)' started by parts.man, Dec 28, 2013.

  1. parts.man

    parts.man Private E-2

    I'm helping a friend try to find what is causing his computer problem on a lan. The best internet access available is via 4G aircard and has a 20GB per month limit. Everything had been fine and Networx had been installed to monitor usage (except for tablets) and backup total usage was monitored by router. A little over a week ago, one computer went berserk and used nearly 13gb over 8 hours during the day when no one was using the computer (mostly downloads). I ran several scans, found typical stuff, removed it and thought it was gone. The "incident" forced discontinued usage of the 4g as this happened and ran monthly total to 19.8 total for the month. Currently using a 3g connection as a backup until main account resets. However, this keeps trying to download and I can't find what's doing it. I followed your "do this first" listand attached are what is requested. Hopefully someone can tell what is going on. I've thought things were fixed a couple of times, but they haven't been. Download totals reset on midnight between Jan. 1 and Jan. 2 so I hope to have a good feeling for leaving it running. Thanks.

    View attachment RKreport[0]_S_12272013_180738.txt

    View attachment protection-log-2013-12-27.txt

    View attachment TDSSKiller.3.0.0.19_27.12.2013_18.49.38_log.txt

    View attachment HitmanPro_20131227_1923.log

    View attachment MGlogs.zip
     
    parts.man, Dec 28, 2013
    #1
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi and welcome. :)

    Is this machine purposely set up to use a proxy?

    You have a zero access infection for us to take care of.
     
    Kestrel13!, Dec 28, 2013
    #2
  3. parts.man

    parts.man Private E-2

    He is not available for me to check with at the moment. The only thing I know he has told me in the past is that he uses something to access his work computer. Is there something I could check to see if it is set up for a proxy until I can talk to him? Thanks for your assistance--this is driving me crazy.
     
    parts.man, Dec 28, 2013
    #3
  4. parts.man

    parts.man Private E-2

    I got in touch with him and the only thing he once used was remote desktop, which he said so longer worked beacuse they had a virus get on the work computer and he no longer needs. I see in IE that info for a proxy server is filled it, but not checked to use, so I guess the answer is no, it is not setup to use a proxy server. His IT people may have temporarily used it when they did whatever it is they did to configure the Remote Desktop. Thanks.
     
    parts.man, Dec 28, 2013
    #4
  5. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode.



    http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these 2 detections:

    • [PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (192.168.0.1:80 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND
    • [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-369384097-3163631704-4056071079-1008\$a86889d42e017b3e5e001cd0fc098169\n. [x]) -> FOUND
    Place a checkmark next to each of these items, leave the others unchecked.
    Now press the Delete button.


    ...and the same for entries on the file/folder tab please....

    • [ZeroAccess][File] @ : C:\RECYCLER\S-1-5-18\$a86889d42e017b3e5e001cd0fc098169\@ [-] --> FOUND
    • [ZeroAccess][Folder] U : C:\RECYCLER\S-1-5-18\$a86889d42e017b3e5e001cd0fc098169\U [-] --> FOUND
    • [ZeroAccess][Folder] L : C:\RECYCLER\S-1-5-18\$a86889d42e017b3e5e001cd0fc098169\L [-] --> FOUND

    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Reboot the machine.




    Re run Hitman Pro and let it delete any Malware remnants if there are any left.


    Delete these:
    • C:\Documents and Settings\Rick.D6GGXLG1\Local Settings\Application Data\p1kiksnnsm081jwf
    • C:\Documents and Settings\Rick.D6GGXLG1\Templates\p1kiksnnsm081jwf


    Now re run RogueKiller once more (just a scan) and attach log.


    Run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

    Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
    Kestrel13!, Dec 29, 2013
    #5
  6. parts.man

    parts.man Private E-2

    Per your request, I used MSCONFIG to set startup to normal and allowed it to reboot. Ran RogueKiller and clicked on REGISTRY, this key was no longer there:

    [PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (192.168.0.1:80 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND

    However, under proxy settings the same information was displayed. No changes were made there. Deleted this key:

    [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-369384097-3163631704-4056071079-1008\$a86889d42e017b3e5e001cd0fc098169\n. [x]) -> FOUND

    and then went to FILES, but the files you indicated to delete were already marked deleted. Logs were not named as you indicated but two with slightly different times and denoted by "S" and "D" in the names are attached. Rebooted and ran HITMANPRO and these were not detected:

    C:\Documents and Settings\Rick.D6GGXLG1\Local Settings\Application Data\p1kiksnnsm081jwf
    C:\Documents and Settings\Rick.D6GGXLG1\Templates\p1kiksnnsm081jwf

    and it reported to be clean. Attached log even though it was not requested. Reran RogueKiller for a scan and it is attached. Ran MGTools and log is attached. Hope I did everything correctly. Only problem originally was with the random, unexpected uses of bandwidth and it might be days before it fires up again. Thanks again for your assistance and a quick question--is there a way to edit posts, as I can't find it?
     

    Attached Files:

    parts.man, Dec 29, 2013
    #6
  7. parts.man

    parts.man Private E-2

    Per your request, I used MSCONFIG to set startup to normal and allowed it to reboot. Ran RogueKiller and clicked on REGISTRY, this key was no longer there:

    [PROXY IE][PUM] HKCU\[...]\Internet Settings : ProxyServer (192.168.0.1:80 [Country: (Private Address) (XX), City: (Private Address)]) -> FOUND

    However, under proxy settings the same information was displayed. No changes were made there. Deleted this key:

    [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\RECYCLER\S-1-5-21-369384097-3163631704-4056071079-1008\$a86889d42e017b3e5e001cd0fc098169\n. [x]) -> FOUND

    and then went to FILES, but the files you indicated to delete were already marked deleted. Logs were not named as you indicated but two with slightly different times and denoted by "S" and "D" in the names are attached. Rebooted and ran HITMANPRO and these were not detected:

    C:\Documents and Settings\Rick.D6GGXLG1\Local Settings\Application Data\p1kiksnnsm081jwf
    C:\Documents and Settings\Rick.D6GGXLG1\Templates\p1kiksnnsm081jwf

    and it reported to be clean. Attached log even though it was not requested. Reran RogueKiller for a scan and it is attached. Ran MGTools and log is attached. Hope I did everything correctly. Only problem originally was with the random, unexpected uses of bandwidth and it might be days before it fires up again. Thanks again for your assistance and a quick question--is there a way to edit posts, as I can't find it?
     
    parts.man, Dec 29, 2013
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes, if the below is found in the proxy section, then have RK fix it. Have it fix the proxy entry wherever it shows. It's still there.

     
    Kestrel13!, Dec 29, 2013
    #8
  9. parts.man

    parts.man Private E-2

    Ran RK and navigated to the proxy section, located the only entry (the one you indicated), highlighted it and hit delete. It deleted the entries from the registry section (UH-OH). Then noticed there was a "Fix Proxy" button. Hit that and rescanned. Right or wrong, here are the log files. Hope that didn't do anything drastic. The wpals.dll always gave an error on startup anyway "file not found". Let me know how bad I did (hopefully, no harm no foul). As always, thanks.
     

    Attached Files:

    parts.man, Dec 29, 2013
    #9
  10. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    OK, proxy gone. How are things running? :)
     
    Kestrel13!, Dec 30, 2013
    #10
  11. parts.man

    parts.man Private E-2

    No large amounts of unexplainable activity has occured. However, it seems to be random so I won't know unless it is on line for quite some time with no random downloads. His cap resets at 12:01 a.m. 1/2/14 so he can swap back to the 4G aircard from the backup 3G. Are you aware of any program that not only will monitor activity outside the LAN, but will also shut the network adapter down on reaching a daily cap. This all happened when he said he had a problem closing some programs (probably because of whatever was going on at the time) and download/upload continued for over 8 hours with no one at the helm. Thanks again so very much for your help and sorry for the double post, one without attachments. I honestly don't know how it happened, but something weird was going on.
     
    parts.man, Dec 30, 2013
    #11
  12. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there. You can further discuss everything else you asked me about in the software or networking forum. :)



    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.
    3. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    4. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    5. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    6. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    7. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

    8. After doing the above, you should work thru the below link:
     
    Kestrel13!, Dec 31, 2013
    #12

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds