Possible ZeroAccess infection.

OK Spock, once attached, I'll start reviewing! :major

 

Leave the RK Quarantine, it's in case something good gets nuked, we can restore it.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

• [RUN][BLACKLIST DLL] HKCU\[...]\Run : nsupi (rundll32.exe "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember) -> FOUND
• [RUN][BLACKLIST DLL] HKLM\[...]\Run : nsupi ("C:\Windows\System32\rundll32.exe" "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember) -> FOUND
• [RUN][BLACKLIST DLL] HKUS\S-1-5-21-2017919655-706122831-2595955138-1000[...]\Run : nsupi (rundll32.exe "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember) -> FOUND
• [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
• [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
• [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\n.) -> FOUND
• [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\n.) -> FOUND
• [HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\n.) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.



...and the same for Files/Folders tab.

• [ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC\Desktop.ini --> FOUND
• [ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\n --> FOUND
• [ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\n --> FOUND
• [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\@ --> FOUND
• [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\@ --> FOUND
• [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\U --> FOUND
• [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\U --> FOUND
• [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\L --> FOUND
• [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\L --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Do not reboot your computer yet.

• Re run Hitman and have it delete what it finds unless RogueKiller got it all, check though.
• Rerun RogueKiller and attach the log.
• What happened with MGTools Spock?

 

• Re run Hitman and have it delete what it finds unless RogueKiller got it all, check though.
• Rerun RogueKiller and attach the log.

 

Yes, you said some lines showed with RogueKiller, some didn't, so just run it again for now, no fix, just a scan and attach log.
Same for Hitman. If nothing else is showing in those logs I will fully look into the MGLogs.zip and see what's left to do.

 

Hey Spock.

Before we continue I would like for you to use MSConfig to put this machine back into normal start up mode


http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 3 detections: (if they show)

• [RUN][BLACKLIST DLL] HKCU\[...]\Run : nsupi (rundll32.exe "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember) -> FOUND
• [RUN][BLACKLIST DLL] HKLM\[...]\Run : nsupi ("C:\Windows\System32\rundll32.exe" "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember) -> FOUND
• [RUN][BLACKLIST DLL] HKUS\S-1-5-21-2017919655-706122831-2595955138-1000[...]\Run : nsupi (rundll32.exe "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember)

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.

and the same for Files/Folder tab

• [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\@ --> FOUND
• [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\@ --> FOUND
• [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\U --> FOUND
• [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\U --> FOUND
• [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$ad5f997cb3ee59ff8479c90ab3d8164b\L --> FOUND
• [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-2017919655-706122831-2595955138-1000\$ad5f997cb3ee59ff8479c90ab3d8164b\L --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Do not reboot your computer yet.


Re run Hitmanpro and have it delete all it finds.


Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

• O4 - HKLM\..\Run: [nsupi] "C:\Windows\System32\rundll32.exe" "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember
• O4 - HKCU\..\Run: [nsupi] rundll32.exe "C:\Users\Aaron\AppData\Roaming\nsupi.dll",NewMember

After clicking Fix exit HJT.




Download and run OTM.

Download OTM by Old Timer and save it to your Desktop.

• Right-click OTM.exe And select " Run as administrator " to run it.
• Paste the following code under the http://farm3.static.flickr.com/2455/4173556815_a721a91733_o.png area. Do not include the word Code.

Code:

:Files
C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
C:\Users\Aaron\AppData\Roaming\nsupi.dll

:reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"nsupi"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"nsupi"=-
[HKEY_USERS\S-1-5-21-2017919655-706122831-2595955138-1000\Software\Microsoft\Windows\CurrentVersion\run]
"nsupi"=-

:Commands
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
• Push the large http://farm3.static.flickr.com/2782/4174320048_f01c448b32_o.png button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy everything in the Results window (under the green bar), and paste it in your next reply.

NOTE: If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and attach the contents of that document back here in your next post.



We have other things to repair but I want to be rid of malware first.

Re run RogueKiller (no fix just a scan and attach log)
Re run Hitman (no fix just a scan and attach log)

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista or Windows7) Then attach the new C:\MGlogs.zip file that will be created by running this.

 

If you have selected to delete the 3 items on registry tab and the 6 on files/folders then continue on with the other insructions yes.

 

OK, I'll be floating around somewhere.

 

Really? Your call Spock.