User's machine hasn't had AV in 2 years!!! Completely overtaken! - Logs Attached

Discussion in 'Malware Help (A Specialist Will Reply)' started by axlmastr, Jul 12, 2013.

  1. axlmastr

    axlmastr Private E-2

    The user of this machine is an elderly man that is not very computer literate so he was not aware that his machine didn't have any AV on it for the last 2 years or so. He took it to an independent "white box builder" shop back in January 2011 for infected behaviors and they used CCleaner, Malwarebytes, & Combofix amongst other things to clean his machine. They handed it back to him without any AV and failed to remove the last traces of Combofix (Qoobox catchme log, and such). The user had no idea how he was supposed to protect the machine after the shop "cleaned it". Recently the user recently complained of issues with slowness and his webmail (Yahoo) not working correctly. He was going to take it to the same shop until I asked to take a look at it. Thanks in advance.
     

    Attached Files:

    axlmastr, Jul 12, 2013
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You forgot the Hitman Pro log; however, let's wait on that unless you already have the log. If you have it, attach it now. I will be asking for a new log at the end of this message.


    Please download OTM by Old Timer and save it to your Desktop.
    • Run OTM.exe by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).
    • Copy the lines from the below codebox to the clipboard by highlighting ALL of them and pressing CTRL + C
      (or, after highlighting, right-click and choose Copy): Do not include the word Code: which is just a title line of
      the code box
    Code:
    :Processes
explorer.exe
 
:Files
C:\WINDOWS\Tasks\Symantec NetDetect.job
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\govlog.dat
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Local Settings\Application Data\ddajiifd28.nls
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Local Settings\Application Data\dfl28z32.dll
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Local Settings\Application Data\svcxdcl32.dat
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Local Settings\Application Data\wsr28zt32.dll
 
:Reg
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
:Commands
[purity]
[EmptyTemp]
[start explorer]

[Reboot]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar
      ) and choose Paste.
    • Now click the large http://forums.majorgeeks.com/chaslang/images/MoveIt!.png button.
    • If OTM asks to reboot your computer, allow it to do so. The report should appear in Notepad after the reboot.
    • Close OTM.
    Now navigate to the C:\_OTM\MovedFiles folder ( assuming your Windows drive is C). This is where your log will be
    saved in the form of Date and Time mmddyyyy_hhmmss.log. Just look for the most recent .log file. Attach
    this log file to your next message.



    Now download Windows Repair by Tweaking.com and unzip the contents into a newly created folder on your desktop.
    • Now run Repair_Windows.exe by double clicking on it ( if you are running Vista or Win 7, use right click and select Run As Administrator)
    • Now select the Start Repairs tab.
    • The click the Start button.
    • Create a System Restore point if prompted.
    • On the next screen, click the Unselect All button to first deselect all repairs.
    • Now select the following repair options:
      • Reset Registry Permissions
      • Reset File Permissions
      • Register System Files
      • Repair WMI
      • Repair Windows Firewall
      • Remove Policies Set By Infections
      • Repair Winsock & DNS Cache
      • Repair Proxy Settings
      • Repair Windows Updates
      • Set Windows Services To Default Startup
    • Now on the lower right side check the box to Restart/Shutdown System When Finished
    • Then make sure the Restart System radio button is enabled.
    • Shutdown any other programs that you are running now before continuing.
    • Now click the Start button.
    • Be patient while the tool repairs the selected items.
    • It should reboot automatically when finished.

    Now please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
    • The tool will open and start scanning your system.
    • Note: That JRT may reset your home page to a google default so you will need to restore your home page setting if this happens.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Attach JRT.txt to your next message.
    Now run a new scan with Hitman Pro and attach a new log.

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, Win7 or Win8, don't double click, use right click and select Run As Administrator).


    Then attach the below logs:
    • the C:\_OTM\MovedFiles log
    • the JRT.TXTlog
    • the Hitman Prolog
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jul 14, 2013
    #2
  3. axlmastr

    axlmastr Private E-2

    Sorry about the HitmanPro log chaslang. I thought I put it up there since I had it like the others. I copied the logs to a thumbdrive and posted from a different machine. This machine has not been online since it was given to me. I refused to put it on my network since it appears to be well neglected. Log is attached.

    Oh - just noticed that the log was too large (592k) for the forum limits and wouldn't upload. I guess I missed that issue at the time. I've zip compressed it an attached. Let me know if it comes through.
     

    Attached Files:

    axlmastr, Jul 15, 2013
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hmmm! This file is rather troubling in that it is questioning many EXE files.

    Also when I look at the newfiles.txt log in MGlogs.zip, I see that many EXE files were changed on July 4th. This is also troubling and it make me worry that there really could be some form of PE infection.

    What was done on July 4th that would make so many files have changed dates?
     
    chaslang, Jul 15, 2013
    #4
  5. axlmastr

    axlmastr Private E-2

    As the tale goes the user was having trouble with his Yahoo webmail. He has AT&T service so he contacted them to "fix" it. He says they remote accessed this machine and made some changes to help him. Their actions did not satisfactorily correct his issues so he instructed them to have Yahoo fix it. Supposedly Yahoo then remote accessed this machine to help him. The machine has been right since and he believes that maybe when his machine was remote accessed something went wrong then or thereafter. I'm not sure. I have yet to have him show me what Yahoo did to "screw up his email" as this apparently has happened once before. I'm not sure of the time frame the previous infections occurred but I also noted that Combofix was used by a local "whitebox builder" as its traces are still evident. I know from my past experience that using Combofix usually means serious infestation I just don't know if the people using it were well versed in its implementation.
    The user is an elderly man reaching retirement and has little tech savvy and a complete dislike for change as many of my users did. His perspective of monumental change is a grain of sand to me but I am willing to help him.


    I was having issues with the Windows Repair Tool after leaving it overnight. It ran for 20+ hours elapsed and yet it was only on 4 of 11. It had three command windows open at that time but they hadn't updated at all from the night before when I left the machine. The I decided to close the windows one by one and even though on of them hit me with a "this program is not responding" message they all finally closed and then Windows Repair continued to scan further. I had to do this a few more times until the reboot took place. The machine rebooted and now has a high CPU throttle (45-65%) and steady HDD activity with no input from me. I am going to attempt JRT next.

    Update JRT just completed. As it stands the machine throttles 70-100% CPU with a steady 445- 460MB of Commit Charge memory in Task Manager with nothing but a desktop in front of me. No input from me at all. I will post logs momentarily.
     
    axlmastr, Jul 16, 2013
    #5
  6. axlmastr

    axlmastr Private E-2

    Here's the OTM and JRT logs. I tried to get the logs for MGTools but because the CPU is running nearly 100% for the last hour or so that I have been on this machine running the GetLogs.bat it seems to take forever to get anywhere with it. It's been stuck on "Finding copies of WMIsvc.dll" for the last 45 minutes. I needed to go somewhere so I left it running until tomorrow. Thanks
     

    Attached Files:

    axlmastr, Jul 16, 2013
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.
    Okay just attach the log when it finishes. But I can tell you right now that the problems on this PC may not be due to malware. At least not at this point. This may be a candidate for a reinstall or possible a reimage from the factory partition if it is still in tact.
     
    chaslang, Jul 17, 2013
    #7
  8. axlmastr

    axlmastr Private E-2

    Hey chaslang,

    Per the machine owner's request I removed the necessary files they wanted to save and wipe the entire drive including the OEM partition with a 6 pass random wipe. I reconfigured the partitions with Parted Magic from my UBCD and installed a fresh copy of slipstreamed XP using the OEM key. The machine runs so much better without the OEM bloatware and simplifies additional install and config. The user has his machine back and his happy. I am happy to see it leave.

    It turned out it was a legitimate PE known as Expiro. I have read one successful attempt at recovering from this nasty on a machine equivalent to my infestation. It was posted on bleepingcomputer by a user with a work related notebook that inherited a former users job position and machine. The machine was used for cell tower updates and therefore was prohibited from using an AV so the former user tried to use the machine on the internet anyway. I read the logs and they looked just like mine. Same files and pretty much the same quantity. The poster used a variety of removal software and mentioned a few that I have not seen mentioned in this forum. It all came down to one svchost file that was stubborn but finally eradicated.

    Thanks for the help on this one. It was still a learning experience.

    This thread is considered closed.
     
    axlmastr, Jul 30, 2013
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    Glad to hear you have it up and running again.
     
    chaslang, Aug 1, 2013
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds