One after another

Discussion in 'Malware Help (A Specialist Will Reply)' started by admkrk, Nov 8, 2012.

  1. admkrk

    admkrk Private E-2

    I haven't had any real problems except for MSSE telling me I have DOS/Alureon.A every week or so. I followed the directions in the sticky in hopes of getting rid of it once and for all only to find Rootkit.Boot.Pihar.c when I ran TDSSKiller. That appeared to clean that up but continuing with the steps suggested, when I ran MBRCheck it found errors on two of my three discs. The one without errors is the OS drive, so that is good, but the second one is my program drive.
    Should I continue on with the rest of the steps or do something different? Log files are attached.
     

    Attached Files:

    admkrk, Nov 8, 2012
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    TimW, Nov 8, 2012
    #2
  3. admkrk

    admkrk Private E-2

    Hi Tim,
    Sorry about my confusion. Ran the rest of the tests and at one point MSSE popped up and is now holding five or six trojans in quarantine. I'm leaving that be for now.
     

    Attached Files:

    admkrk, Nov 8, 2012
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Files/folders tab and locate these detections:

    • [ZeroAccess][FOLDER] U : C:\Windows\Installer\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\Windows\Installer\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\L --> FOUND
      [ZeroAccess][FILE] @ : C:\Users\admin\AppData\Local\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\@ --> FOUND
      [ZeroAccess][FOLDER] U : C:\Users\admin\AppData\Local\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\U --> FOUND
      [ZeroAccess][FOLDER] L : C:\Users\admin\AppData\Local\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\L --> FOUND
    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Rescan with HitmanPro.
    Choose to Delete these files if they are detected:

    • F:\Downloads\Web\installer_urban_pad.exe
      C:\Users\admin\AppData\Local\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\L\ (ZeroAccess)
      C:\Users\admin\AppData\Local\{f53df234-dcd5-71ae-7cd4-b74e8833f054}\U\ (ZeroAccess)
    Ignore all other detections.
    Afterwards, click the Next button.
    HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

    Now after a reboot, rescan with both RogueKiller and HItman and attach those logs as well.
     
    TimW, Nov 9, 2012
    #4
  5. admkrk

    admkrk Private E-2

    Hi Tim,
    There were no check boxes in the file tab of RogueKiller, just the registry tab had check boxes. Since none of those matched I unchecked them (hope that was right?). The file you listed was not there either, but after hitting delete, the four folders showed as being deleted. It created a [3] report after the deletion so I'm including that just in case. Only the first one showed in Hitman and was gone for the second scan. Hopefully I did it all right and it looks a lot better now.
     

    Attached Files:

    admkrk, Nov 9, 2012
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Tell me how things are running now.
     
    TimW, Nov 10, 2012
    #6
  7. admkrk

    admkrk Private E-2

    Running OK but like I said, I wasn't seeing many problems to begin with aside from the one Alureon virus that kept popping up every week or so. I was getting the need to update Flash Player pop ups on restarts but learned from last time to go to Adobe's site if I'm worried about that. Every now and then the mouse would freeze up also but that was all intermittent and no way to tell yet if it is over. I'll try clearing out the quarantine list from MSSE after I get my work turned in tomorrow and see how that goes since that started my original problem several months ago and MSSE shows a Sirefef again along with the 5 different Alureons.
     
    admkrk, Nov 11, 2012
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Let me know if you need additional assistance. In the meantime:

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link
    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Nov 11, 2012
    #8
  9. admkrk

    admkrk Private E-2

    Sorry to bump this after all this time but I neglected to thank you for the help. Been free of everything all this time except one trojan that popped up and it deleted with no problems. So thanks once again and sorry for taking so long to say so.

    Peace, Kirk
     
    admkrk, Jan 5, 2013
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Not a problem. :)

    And you are most welcome. Safe surfing.
     
    TimW, Jan 6, 2013
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds