TR/ATRAPS.Gen2

mixmistress508 · Mar 12, 2014

I'm not exactly sure when this started, but I believe it was in Oct or Nov. I noticed and issue with my laptop so I shut it down and put it aside because I have a smaller laptop also. I decided to turn it on a week ago or so and that's when I realized I had a bigger problem then I thought. AVIRA scanned the system and found 2 detections, both named TR/ATRAPS.Gen2 under Desktop.ini. I click Apply now to have it moved to quarantine, the AV seems to go through the process and wants to restart the system. After restarting, it scans again and the same thing happens. It's like Groundhog's Day with my laptop. Yesterday a friend of mine in IT was over and I explained I had a problem and he took a look at my laptop. He discovered that it will not allow me to download programs. They are marked as containing a virus and deleted. He tried a few things, but was unable to fix the issue. I did a search for detection name and I found you. I did the READ & RUN ME FIRST as instructed. I looked at the other threads, but because it looks like each situation is different, I decided to post a thread and ask for your help. I have attached the logs as instructed.

I am at your mercy. Please help. And thank you in advance.

Mixx

Kestrel13! · Mar 12, 2014

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7/8 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these detections:

[RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\Jessica\AppData\Local\Google\Desktop\Install\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\?��?��?��\?��?��?��\???ﯹ๛\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\GoogleUpdate.exe" >) -> FOUND

[RUN][ZeroAccess] HKUS\S-1-5-21-2385915299-4175240935-3140996829-1000\[...]\Run : Google Update ("C:\Users\Jessica\AppData\Local\Google\Desktop\Install\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\?��?��?��\?��?��?��\???ﯹ๛\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\GoogleUpdate.exe" >) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CCSet\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\ \...\???ﯹ๛\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\GoogleUpdate.exe" < [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CS001\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\ \...\???ﯹ๛\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\GoogleUpdate.exe" < [x]) -> FOUND

[SERVICE][ZeroAccess] HKLM\[...]\CS002\[...]\Services : ???etadpug ("C:\Program Files (x86)\Google\Desktop\Install\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\ \...\???ﯹ๛\{22490271-46a9-cce7-3c0c-eb5e153f8e40}\GoogleUpdate.exe" < [x]) -> FOUND

Place a checkmark next to each of these items, leave the others unchecked.

Now press the Delete button.

...and the same for these entries on the file/folder tab please...

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_32\Desktop.ini [-] --> FOUND

[ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_64\Desktop.ini [-] --> FOUND

[ZeroAccess][Junction] en-US : C:\Program Files\Windows Defender\en-US >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpAsDesc.dll : C:\Program Files\Windows Defender\MpAsDesc.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpClient.dll : C:\Program Files\Windows Defender\MpClient.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpCmdRun.exe : C:\Program Files\Windows Defender\MpCmdRun.exe >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpCommu.dll : C:\Program Files\Windows Defender\MpCommu.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpEvMsg.dll : C:\Program Files\Windows Defender\MpEvMsg.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpOAV.dll : C:\Program Files\Windows Defender\MpOAV.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpRTP.dll : C:\Program Files\Windows Defender\MpRTP.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MpSvc.dll : C:\Program Files\Windows Defender\MpSvc.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MSASCui.exe : C:\Program Files\Windows Defender\MSASCui.exe >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MsMpCom.dll : C:\Program Files\Windows Defender\MsMpCom.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MsMpLics.dll : C:\Program Files\Windows Defender\MsMpLics.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Junction] MsMpRes.dll : C:\Program Files\Windows Defender\MsMpRes.dll >> \systemroot\system32\config [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Users\Jessica\AppData\Local\Google\Desktop\Install [-] --> FOUND

[ZeroAccess][Folder] Install : C:\Program Files (x86)\Google\Desktop\Install [-] --> FOUND

When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)
Reboot the machine.

Re run Hitman, have it delete all it finds, and on the repairs tab, there is alot you need to have Hitman fix.

Re run RogueKiller (just a scan) and attach log
Same for TDSSKiller please.
And the same for Hitman.

http://imageshack.us/a/img841/7292/thisisujrt.gif Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Attach JRT.txt to your next message.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

mixmistress508 · Mar 12, 2014

First, I want to say thank you so much. You are an amazing genius. When I ran RogueKiller, the Registry files were different than the ones in the first scan. I've attached both logs, before and after deleting. The when I ran Hitman, there was much less found. After that, it was pretty much clean. I did everything as you instructed and things have reappeared on my desktop that I didn't realize were gone. And I was wondering what happened to my Recycle Bin and now I know.

Many thanks to you!
Mixx

mixmistress508 · Mar 12, 2014

Additional logs

Kestrel13! · Mar 13, 2014

MGTools did not run to completion. Can you rerun the C:\MGTools\Getlogs.bat again and attach the resulting MGlogs.zip. Ensure that all protection software is disabled, that user account control is indeed disabled, and that you run as admin.

mixmistress508 · Mar 14, 2014

I made sure User Account Control was disabled and I turned off my AV. Here is the MGlogs.zip.

Kestrel13! · Mar 15, 2014

Download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.

Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)

Now select the Start Repairs tab.

The click the Start button.

Create a System Restore point if prompted.

On the next screen, click the Unselect All button to first deselect all repairs.

Now select the following repair options:

Reset Registry Permissions

Reset File Permissions

Register System Files

Repair WMI

Repair Windows Firewall

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair Proxy Settings

Repair Windows Updates

Set Windows Services To Default Startup

Now on the lower right side check the box to Restart/Shutdown System When Finished

Then make sure the Restart System radio button is enabled.

Shutdown any other programs that you are running now before continuing.

Now click the Start button.

Be patient while the tool repairs the selected items.

It should reboot automatically when finished.

After reboot, check to see if your firewall is working.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. (Right click and run as admin if using Vista, Windows7 or Win8) Then attach the new C:\MGlogs.zip file that will be created by running this.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

mixmistress508 · Mar 16, 2014

Hi. I am attaching the new MGlogs.zip log. I did as you instructed and did not have any problems. Everything seems to be working and the system is running great. In fact, it is faster and it definitely boots up faster. I hope everything looks good with the log. If I notice any problems or issues, I will let you know.

Thank you again for all your help. I definitely could not have done this without your expertise. You are indeed a Super Malware Fighter!

Mixx

Kestrel13! · Mar 16, 2014

Excellent. I'm glad to hear everything is running so nicely.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.

Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.

Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.

If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others) and running MGclean.bat did not remove them, you can delete these files now.

If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:

Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore

What we want you to do is to first disable System Restore to flush restore points some of which could be infected.

Then we want you to Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

TR/ATRAPS.Gen2

mixmistress508 Private E-2

Attached Files:

RKreport[0]_S_03122014_034100.txt

mbam-log-2014-03-12 (03-49-40).txt

TDSSKiller.3.0.0.25_12.03.2014_04.06.47_log.txt

HitmanPro_20140312_0426.log

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mixmistress508 Private E-2

Attached Files:

RKreport[0]_S_03122014_085319.txt

RKreport[0]_D_03122014_085807.txt

RKreport[0]_S_03122014_100022.txt

HitmanPro_20140312_0956.log

TDSSKiller.3.0.0.25_12.03.2014_10.16.05_log.txt

mixmistress508 Private E-2

Attached Files:

MGlogs.zip

JRT.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mixmistress508 Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

mixmistress508 Private E-2

Attached Files:

MGlogs.zip

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member