Suspecting malware hasn't been cleaned up all the way

hedgecorex · Mar 9, 2013

Hello,

My girlfriend's computer had some bogus addons on her Chrome browser called Default Tab among other things, which essentially simulated a Google home page when you would open a new tab. I removed said addon (and anything else that looked bogus) about a week ago, but now I came back to do the steps per Majorgeeks and see if I can make sure everything is clean on her end.

A few things I noticed

- She's always had a notice that her Malwarebytes' trial has expired and that she is no longer protected. I have never seen that message on anyone else's computer (including my own) and I didn't even realize that Malwarebytes was run as a trial. When doing the steps in the stickied thread, I uninstalled Malwarebytes and reinstalled it to see if it would fix this, and after running the quick scan and rebooting the computer, Malwarebytes is still saying it is running as a trial

- Malwarebytes found "mplayer_Setup.exe" in her downloads folder, but there is also an "mplayer.exe" in her downloads folder still that is untouched. I'm assuming this is also a virus since it's essentially the same thing (we both don't know what mplayer.exe is) so I'm wondering what we should do about it.

- HitmanPro found Plex to be a trojan, which is the media server that her and her roommate use to stream videos to each other's computers. I ignored it, per instructions.

Rogue Killer found a lot of stuff, so I'm led to believe her computer still has malware. Thank you so much for your time! Attached are the logs.

Please let me know if I can add any information that would be helpful

Kestrel13! · Mar 10, 2013

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

hedgecorex · Mar 10, 2013

Here it is. Thank you so much

Kestrel13! · Mar 11, 2013

Please disable Spybot's TeaTimer.

How to disable Spybot's TeaTimer

Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"2ABCF2CD0FBD9B0C95E38BDA7F6D18A880DD3A04._service_run"=-
[HKEY_USERS\S-1-5-21-1853841560-4103013667-290688523-1001\Software\Microsoft\Windows\CurrentVersion\run]
"2ABCF2CD0FBD9B0C95E38BDA7F6D18A880DD3A04._service_run"=-
Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

What issues remain? Apart from Malware Bytes?

hedgecorex · Mar 11, 2013

This was a success.

Other than the Malwarebytes constantly saying it has "0 days remaining on the trial" (is this a normal thing?), the things I'm curious about are:

- Malwarebytes found and removed "mplayer_Setup.exe" in her downloads folder, but there is also an "mplayer.exe" in her downloads folder that was left in there and not found as a threat. They both had the same date modified/downloaded date I believe. Is it safe to delete this mplayer.exe or is there a better way to remove it (like through Malwarebytes quarantine function). Sorry if this is a dumb questions

- I just want to double check that Plex isn't a virus - Hitman Pro found it to be one and it's something that she uses more often than not (media server). How could I go about investigating if it's malicious or not?

She has been staying off her computer in case it still has malware on it, so nothing right now comes to mind. We both really appreciate you taking the time to help us out!

Kestrel13! · Mar 12, 2013

Other than the Malwarebytes constantly saying it has "0 days remaining on the trial" (is this a normal thing?)
Click to expand...

No, not normal, this is something you could ask about in the software forum.

Is it safe to delete this mplayer.exe
Click to expand...

Yes, simply delete it.

- I just want to double check that Plex isn't a virus
Click to expand...

Plex is fine.

We both really appreciate you taking the time to help us out!
Click to expand...

You are most welcome! safe surfing!

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Press and hold the Windows key http://forums.majorgeeks.com/chaslang/images/Windows_Logo_key.gif and then press the letter R on your keyboard. This opens the Run dialog box.

Copy and paste the below into the Run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove, you can delete these files now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 6 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Suspecting malware hasn't been cleaned up all the way

hedgecorex Private E-2

Attached Files:

RKreport[1]_S_03092013_02d1357.txt

mbam-log-2013-03-09 (13-59-36).txt

TDSSKiller.2.8.16.0_09.03.2013_14.09.26_log.txt

HitmanPro_20130309_1423.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hedgecorex Private E-2

Attached Files:

JRT.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

hedgecorex Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member