Ransomware with no known traces?

Just a wannabe geek · Dec 11, 2012

Hi,

I'm currently trying to fix my parents' computer. And the fact that it isn't my own complicates things a bit; I'm not sure what they have on it and where they went to catch it. It runs on Windows XP media center edition 2005.

The first instance of this malware/virus was this last August. There was the police ransom page at start up. That's when I learnt how to boot using safe mode. I updated MBAM through the backdoor and ran the scan, found some suspect files, fixed them and everything was fine.

Now, 3 days ago (Dec. 8th) the malware was back. But it seems that they've now caught the new and improved version of the damn Ukash ransomware. I say that because I searched all over the web, on forums such as this one (have to mention I admire this one the most and it's why I registered), and we exhibit none of the usual symptoms.

Of course, through my research I ended up following a lot of different expert advice. I hope I didn't mess things up, but I was as careful as possible, considering.

Retracing my (significant) steps:

(All in safe mode, mind you, because I can't access the computer any other way)

1) I ran MBAM scan, found nothing wrong;
2) I ran AVG scan, found nothing either;
3) I ran Ad-Aware scan, it found 2 instances of Trojan Generic!BT, quarantined;
4) Took the computer to my plave to have internet access on my own PC;
5) I looked for mspmsnsv.dll and replaced it with the file downloaded from Originaldll.com;
6) In Windows/temp, I cleaned up files that had been modified on or since Dec. 8th, but didn't find any that bore a random 6-digits name.dat;
7) I tried to run System File Checker (scannow) by it didn't work;
8) I went into Event viewer and witnessed Remote connections happened minutes before my dad saw the malware page;
9) I then disabled remote access connections;
10) I went into regedit to see if "[HKLM\SYSTEM\CurrentControlSet\Services\WmdmPmSN] had been changed to 3, but no it was still at 2;
11) I ran RogueKiller which found a few things (log attached) - this was before I had decided to write my own thread, I was using the help you gave in this thread: http://forums.majorgeeks.com/showthread.php?t=262044;

At the end of my wits, I registered to post a thread and then saw the READ AND RUN ME FIRST, which I did all the way until step 4; I was still having problems.

The computer has 2 accounts, the Administrator I made for myself, and the family account for my parents to play in.

If I boot in Normal mode, I get the desktop image of the family account, bypassing the login page, there are no icons, it takes minutes and then I get a white screen. It's not plugged in the internet, so the ransomware page doesn't appear, just the white page.

If I boot in safe mode, with or without network, and choose the family account, windows shuts down. If I choose the Administrator account, it's fine but then I don't have access to everything to scan and/or fix.

I attached all my logs here. It includes the past logs I made of the first instances in August, and the logs I made before all my steps.

I sure hope someone can help me. If not, my only option left will be to buy a new drive, which I'd very much like to avoid.

Thanks a lot,

Jen

Just a wannabe geek · Dec 11, 2012

These are the rest of the logs.

Forgot to mention, they're running on 32-bits, SP3.

Thanks again.

chaslang · Dec 12, 2012

Welcome to Major Geeks!

Just a wannabe geek said: ↑

The computer has 2 accounts, the Administrator I made for myself, and the family account for my parents to play in.
Click to expand...

The Adminstrator user account name is a Windows user account. It always exist. It just may not be enabled to see in normal boot mode.

The Owner account is the account I assume you mean is your parents? You did not run the scans on this account. Is that correct? This is the account you need to clean so it is more important to run scans on this user account. If I give you fixes based on what you posted, it primarily address the Administrator account not the Owner account. I will provide a fix anyway since some items can be common to all user accounts.

NOTE: I will be deleting the Spyhunter file you downloaded. This is junk you should not use!!

Is there a USB drive connected that is requiring the below U3 software to load?
C:\Documents and Settings\Administrator\Application Data\U3\000015EBBA63B0DA\LaunchPad.exe

For more info on U3, see this for one example: http://en.wikipedia.org/wiki/U3

chaslang · Dec 12, 2012

Note in the below fix I will be deleting file:
Code:
----a-w            36,352 2012-12-11 04:58:20  C:\WINDOWS\system32\mspmsnsv.dll
This file name is a valid Windows file but yours is not the correct size and may be infected.

Uninstall the below software:
Ad-Aware << Not recommended as it is ineffective and it installs Blekko junkware/adware
J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 17

Now install the current version of Sun Java from: Sun Java Runtime Environment

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {CAFECAFE-0013-0001-0028-ABCDEFABCDEF} (JInitiator 1.3.1.28) -

After clicking Fix, exit HJT.

Please download OTM by Old Timer and save it to your Desktop.

Right-click OTM.exe and select Run as administrator to run it.

Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
(or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
the code box
Code:
:Processes
explorer.exe
 
:Files
C:\Documents and Settings\Owner\Application Data\skype.dat
C:\Documents and Settings\Owner\Local Settings\Temp\lfi3nt4r6ja95ciwtx3vt.exe
C:\Documents and Settings\Administrator\Desktop\SpyHunter-Installer.exe
C:\WINDOWS\installer\{ba7eb6f8-478c-e777-7fd5-c24fa19b7db2}
C:\WINDOWS\Temp\RGIB.tmp
C:\WINDOWS\Temp\{0D1D4B4A-7FB4-4BA4-B55C-EB4384A199FF}.exe
C:\WINDOWS\Temp\{237E6D2F-6AF4-43ED-8720-B808B2CD6F8B}.exe
C:\WINDOWS\Temp\*.*
C:\WINDOWS\system32\mspmsnsv.dll
:Reg
[-HKEY_USERS\S-1-5-21-1579780009-420529997-2055060863-1006\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\s]
:Commands
[purity]
[EmptyTemp]
[start explorer]

[Reboot]
Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
) and choose Paste.

Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.

If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.

Close OTM.

Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
this log file to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

the C:\_OTM\MovedFiles log

C:\MGlogs.zip

Make sure you tell me how things are working now!

Just a wannabe geek · Dec 13, 2012

update, thanks.

chaslang · Dec 14, 2012

You're welcome. Are you working on those instructions?

Just a wannabe geek · Dec 15, 2012

Hi Chaslang, thanks for the instructions. I was puzzled as to what I should do. After you wrote to me that those changes would only touch the non-infected account, I realized the three days of work I had done for almost nothing. I couldn't log in the family account at all, let alone run a scan in it.

With my parents at the other end worrying about their computer, I offered them 2 options; either leave it with me for an undetermined amount of time in the hope something could be done to fix it; or cash out the 60$ to buy a new uninfected drive.

They decided to pay up, so I installed the new drive. I'm having some bugs and things to fix with that too, but at least I know I'm not wasting my time. There was so much that had gone wrong with their old drive...

I feel really bad for having asked your support, maybe too quickly, as my parents reached a decision shortly after, before I had gotten an answer from you guys. So I apologize for that.

Also, if you find that some comments made through my login are beyond my apparent computer knowledge, that's because my computer-savvy friend came to help and used my login to ask a question.

Sincerely thanks,

Jen

chaslang · Dec 18, 2012

You're welcome. Hope you get it all working with the new hard disk.

Log in or Sign up

Ransomware with no known traces?

Just a wannabe geek Private E-2

Attached Files:

mbam-log-2012-08-24 (17-30-35).txt

mbam-log-2012-12-09 (11-23-15).txt

mbam-log-2012-12-11 (11-40-07).txt

RKreport[1]_S_12112012_02d1138.txt

QuarantineReport.txt

Just a wannabe geek Private E-2

Attached Files:

TDSSKiller.2.8.15.0_11.12.2012_11.53.16_log.txt

HitmanPro_20121211_1207.log

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Just a wannabe geek Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Just a wannabe geek Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member