Trying to remove malware

lurifax · Aug 20, 2012

Here is my list!

chaslang · Aug 21, 2012

Welcome to Major Geeks!

You need to attach ALL of the logs we requested in the READ & RUN ME FIRST. Please attach logs from the below:

Malwarebytes

TDSSKiller

HitMan Pro

MGtools

lurifax · Aug 21, 2012

Im unable to download TDSSKiller and Hitman Pro to my laptop. I get this messasge:

404. That’s an error.

The requested URL /Hitman_Pro_d5283.html was not found on this server. That’s all we know.

What to do?

chaslang · Aug 22, 2012

Try again or use another PC to download the tools and put them on a USB drive. Then copy to the problem PC.

If you do not have access to another PC, then try the below to get started but we will need to full procedure to be run in order to properly clean your PC.

Re-run RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that exist and then click the Delete button.

[SUSP PATH] HKCU\[...]\Run : Ynesu (C:\Users\Kjetil\AppData\Roaming\Liibvo\pyivu.exe) -> FOUND
[SUSP PATH] HKCU\[...]\Run : Wuwoe (C:\Users\Kjetil\AppData\Roaming\Suvuyl\obta.exe) -> FOUND
[SUSP PATH] HKCU\[...]\Run : Guiqquy (C:\Users\Kjetil\AppData\Roaming\Abosyk\inef.exe) -> FOUND
[SUSP PATH] HKCU\[...]\Run : Trolltech (C:\Users\Kjetil\AppData\Roaming\371549.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2535621127-1310670371-491774050-1000[...]\Run : Ynesu (C:\Users\Kjetil\AppData\Roaming\Liibvo\pyivu.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2535621127-1310670371-491774050-1000[...]\Run : Wuwoe (C:\Users\Kjetil\AppData\Roaming\Suvuyl\obta.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2535621127-1310670371-491774050-1000[...]\Run : Guiqquy (C:\Users\Kjetil\AppData\Roaming\Abosyk\inef.exe) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2535621127-1310670371-491774050-1000[...]\Run : Trolltech (C:\Users\Kjetil\AppData\Roaming\371549.exe) -> FOUND
[SUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Kjetil\LOCALS~1\Temp\msouwt.cmd) -> FOUND
[SUSP PATH] HKUS\S-1-5-21-2535621127-1310670371-491774050-1000[...]\Windows : Load (C:\Users\Kjetil\LOCALS~1\Temp\msouwt.cmd) -> FOUND
[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Kjetil\AppData\Local\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\n.) -> FOUND
Click to expand...

Then select the Files tab and if the below exist, click the Delete button again.

¤¤¤ Particular Files / Folders: ¤¤¤
[ZeroAccess][FILE] n : c:\windows\installer\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\n --> FOUND
[ZeroAccess][FILE] @ : c:\windows\installer\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\@ --> FOUND
[ZeroAccess][FOLDER] U : c:\windows\installer\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\U --> FOUND
[ZeroAccess][FOLDER] L : c:\windows\installer\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\L --> FOUND
[ZeroAccess][FILE] n : c:\users\kjetil\appdata\local\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\n --> FOUND
[ZeroAccess][FILE] @ : c:\users\kjetil\appdata\local\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\@ --> FOUND
[ZeroAccess][FOLDER] U : c:\users\kjetil\appdata\local\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\U --> FOUND
[ZeroAccess][FOLDER] L : c:\users\kjetil\appdata\local\{6172bfae-ec55-faff-5d99-6c41b5cb0764}\L --> FOUND
[Susp.ASLR][ASLR WIPED-OFF] services.exe : c:\windows\system32\services.exe --> FOUND
[ZeroAccess][Sig found] services.exe : c:\windows\system32\services.exe --> FOUND
Click to expand...

Then immediately reboot your PC.

After reboot, run a new scan with RogueKiller and save a log as in original instructions and attach the new log.

Then see if you can run all the other scans requested and attach the logs.

Log in or Sign up

Trying to remove malware

lurifax Private E-2

Attached Files:

RKreport[1].txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

lurifax Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member