removing win64/Patched.A from services.exe

Joe1128 · Nov 5, 2012

I ran the entire procedure detailed in this forum and AVG still keeps popping up threat warnings that the Win64/Patched.A is in services.exe and can't be removed. AVG keeps detecting and removing numerous trojans and other malware.

It started a 2 - 3 weeks ago. I've been updating and running AVG on a regular basis. I am attaching the requested logs. Avg and the other programs you requested seem to point to the Patched.A and two Desktop.ini files that are infected. These dont seem to be removable. Not sure what it was, but my kids like the gaming sites with all the little flash games.

I can also attach the log of the viruses removed by AVG in just the last two days, if its helpul

TimW · Nov 7, 2012

Rescan with HitmanPro, when it finds services.exe - Virus, allow it to Replace by clicking the down arrow next to the detection and choosing Replace.

Choose to Delete these files if they are detected:

C:\Users\Katie\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\links@rivalgaming.com\components\xpcomponent.dll
C:\Users\Katie\AppData\Roaming\Mozilla\Firefox\Profiles\ox6v1glo.default\extensions\links@rivalgaming.com\

\components\xpcomponent.dll
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\U\80000000.@
C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\U\80000032.@

Ignore all other detections.
Afterwards, click the Next button.
HitmanPro may want to reboot the PC in order for the changes to take affect, please do so.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button

Now click the Files/folders tab and locate these detections:

[ZeroAccess][FILE] @ : C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\@ --> FOUND
[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\U --> FOUND
[ZeroAccess][FOLDER] L : C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\L --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FOUND
[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FOUND
[Susp.ASLR][FILE] services.exe : C:\Windows\system32\services.exe --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Now rescan with both RogueKiller and Hitman and attach those new logs as well.

Joe1128 · Nov 6, 2012

I ran the procedure as detailed below. When I first ran hit man, it mentioned that the delete of the services.exe failed (even though I didnt tell it to delete just to replace as the second post warned me)

Rogue killer gave variuos logs, not just one so I included all. When I ran Hit man pro again, the services.exe didnt pop up. Hopefully this means its fixed.

Avg usually pops up a warning every 10 mins or so, and I havent seen it in an hour or so. I am crossing my fingers.

Let me know if I need to do anything else

Joe

TimW · Nov 7, 2012

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Files/folders tab and locate these detections:

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{b0b4e0a2-5b87-a302-03bc-b50352022fa8}\U --> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Now rescan with RogueKiller and attach that log as well. Make sure to tell me how things are running.

Joe1128 · Nov 16, 2012

I'm sorry I didnt reply quickly. The computer seemed to be working well. Here are the logs. The Patched.A virus seems to be gone but I seemed to have a redirect virus that is associated with only certain user profiles and not others. When we try to get to something through Google it redirects us to an ad of some sort. Cant get anywhere on the internet. Avg is finding trojans left and right again. I tried the obvious things, like looking at the "host" files for added code, looking at LAN Settings in internet options, and making sure the proxy and DNS settings weren't rerouted.

I attached all the new logs RogueKiller created.

Joe

TimW · Nov 17, 2012

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't
double click, use right click and select Run As Administrator).

Attach the new C:\MGLogs.zip.

Joe1128 · Nov 20, 2012

Here is the report. The redirect virus doesn't seem to affect Mozilla and only affects IE under certian user names, not all. It seems only to be attached to google. If we google search and try to follow a link in google. I believe its also letting in Trojans and other malware, because AVG seems to detect malware especially when using IE and google

Thanks
Joe

TimW · Nov 20, 2012

Then boot into the user account that has the issue and run MBAM, RogueKiller and Hitman on that account and attach the logs.

Joe1128 · Nov 30, 2012

Here are the logs run from one of the users that is having the redirect problem

TimW · Dec 1, 2012

Please re-run MBAM and have it fix what it found.

Then:

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][SUSP PATH] HKUS\S-1-5-21-2015490786-1681137006-671436948-1003[...]\Run : bmqwhhhd (C:\Users\Katie\AppData\Local\upwyratjq\hruewculanw.exe) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot and run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't
double click, use right click and select Run As Administrator).

Attach both the RogueKiller log and the new C:\MGLogs.zip

Joe1128 · Dec 15, 2012

I did all that. Here are the new logs.

Thanks,
Joe

TimW · Dec 16, 2012

What issues are you still having, if any.

Joe1128 · Dec 18, 2012

Right after posting, the last time, I tried linking through google, and everything seems to be fine now. Thank You

TimW · Dec 18, 2012

You are welcome.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

After doing the above, you should work thru the below link

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

removing win64/Patched.A from services.exe

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

Attached Files:

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Joe1128 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member