viruses found

Discussion in 'Malware Help (A Specialist Will Reply)' started by Yorkshire, May 27, 2013.

  1. Yorkshire

    Yorkshire Private E-2

    Bitdefender keeps finding viruses MIDAS3? including downloads and firefox wont work properley
    logs included

    I ran all the tools and lots of them took ages to even pop up nevermind work

    thanks
     

    Attached Files:

    Yorkshire, May 27, 2013
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Tell me what Bitdefender is complaining about. The full path to the file.
     
    TimW, May 27, 2013
    #2
  3. Yorkshire

    Yorkshire Private E-2

    this is one of many
     

    Attached Files:

    Yorkshire, May 27, 2013
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please download ComboFix to your desktop. Turn off any AV software you have before you run it. Attach the log when finished. Do not do anything while it is running or it may stall the program.
     
    TimW, May 27, 2013
    #4
  5. Yorkshire

    Yorkshire Private E-2

    okay will do

    just got this from yahoo

    Sorry, Unable to process request at this time -- error 999.
    Yahoo!

    Unfortunately we are unable to process your request at this time. This error is usually temporary. Please try again later.

    If you continue to experience this error, it may be caused by one of the following:

    You may want to scan your system for spyware and viruses, as they may interfere with your ability to connect to Yahoo!. For detailed information on spyware and virus protection, please visit the Yahoo! Security Center.
    This problem may be due to unusual network activity coming from your Internet Service Provider. We recommend that you report this problem to them.
     
    Yorkshire, May 28, 2013
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    That link should take you directly to the download site.
     
    TimW, May 28, 2013
    #6
  7. Yorkshire

    Yorkshire Private E-2

    had to unisntall bitdefender to get combo to work
    also keep getting virus midas3

    ComboFix 13-05-28.02 - Chris 28/05/2013 21:50:55.2.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.3060.2084 [GMT 1:00]
    Running from: c:\users\Chris\Desktop\ComboFix.exe
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\programdata\1369773867.bdinstall.bin
    c:\users\Chris\AppData\Roaming\vso_ts_preview.xml
    c:\windows\system32\spsys.log
    .
    .
    ((((((((((((((((((((((((( Files Created from 2013-04-28 to 2013-05-28 )))))))))))))))))))))))))))))))
    .
    .
    2013-05-28 20:59 . 2013-05-28 21:00 -------- d-----w- c:\users\Chris\AppData\Local\temp
    2013-05-28 20:59 . 2013-05-28 20:59 -------- d-----w- c:\users\Public\AppData\Local\temp
    2013-05-28 20:59 . 2013-05-28 20:59 -------- d-----w- c:\users\Default\AppData\Local\temp
    2013-05-28 19:48 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1A89C702-7EF0-4ED4-86A4-5A72E36E1740}\mpengine.dll
    2013-05-27 04:50 . 2013-05-27 04:54 -------- d-----w- C:\MGtools
    2013-05-26 07:50 . 2013-05-26 07:50 -------- d-----w- c:\programdata\Kaspersky Lab
    2013-05-17 18:38 . 2013-05-17 18:43 -------- d-----w- c:\users\Chris\AppData\Local\Nero
    2013-05-16 22:07 . 2013-05-16 22:07 -------- d-----w- c:\users\Chris\AppData\Roaming\Nero
    2013-05-16 21:34 . 2010-05-26 10:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
    2013-05-16 21:34 . 2010-05-26 10:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
    2013-05-16 21:33 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
    2013-05-16 21:33 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
    2013-05-16 21:32 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
    2013-05-15 02:10 . 2013-05-05 19:12 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2013-05-14 23:00 . 2013-04-15 14:20 638328 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2013-05-14 23:00 . 2013-04-13 10:56 37376 ----a-w- c:\windows\system32\cdd.dll
    2013-05-14 22:59 . 2013-04-09 01:36 2049024 ----a-w- c:\windows\system32\win32k.sys
    2013-05-11 10:37 . 2013-05-11 10:37 209472 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
    2013-05-08 15:51 . 2013-05-08 15:51 -------- d-----w- c:\program files\Microsoft Silverlight
    2013-05-06 14:09 . 2013-05-06 15:10 -------- d-----w- c:\programdata\BDLogging
    2013-05-06 14:02 . 2013-05-28 20:46 -------- d-----w- c:\program files\Bitdefender
    2013-05-06 14:02 . 2013-05-28 20:45 -------- d-----w- c:\program files\Common Files\Bitdefender
    2013-05-06 13:26 . 2013-05-06 13:26 -------- d-----w- c:\users\Chris\AppData\Local\VS Revo Group
    2013-05-06 13:26 . 2013-05-06 13:26 -------- d-----w- c:\programdata\VS Revo Group
    2013-05-05 23:26 . 2013-05-05 23:26 -------- d-----w- c:\programdata\bdch
    2013-05-02 21:55 . 2013-05-06 11:27 -------- d-----w- c:\windows\system32\catroot2(16540)
    2013-05-02 21:29 . 2013-05-02 21:29 -------- d-----w- C:\RegBackup
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2013-05-27 04:54 . 2013-05-27 04:50 295384 ----a-w- C:\MGlogs.zip
    2013-05-15 01:47 . 2012-12-13 19:48 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2013-05-15 01:47 . 2012-12-13 19:48 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2013-05-10 19:07 . 2011-03-28 18:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2013-05-02 01:06 . 2011-02-04 13:29 238872 ------w- c:\windows\system32\MpSigStub.exe
    2013-04-04 13:50 . 2013-03-22 23:05 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
    2013-03-22 22:23 . 2011-12-26 22:04 861088 ----a-w- c:\windows\system32\npdeployJava1.dll
    2013-03-22 22:23 . 2011-12-26 22:00 782240 ----a-w- c:\windows\system32\deployJava1.dll
    2013-03-11 13:25 . 2013-04-10 05:00 3603816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2013-03-11 13:25 . 2013-04-10 05:00 3551080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2013-03-09 03:45 . 2013-04-10 05:00 49152 ----a-w- c:\windows\system32\csrsrv.dll
    2013-03-09 01:28 . 2013-04-10 05:00 64000 ----a-w- c:\windows\system32\smss.exe
    2013-03-08 03:53 . 2013-04-10 05:00 376320 ----a-w- c:\windows\system32\winsrv.dll
    2013-03-08 03:52 . 2013-04-10 05:00 2067968 ----a-w- c:\windows\system32\mstscax.dll
    2013-03-06 23:32 . 2012-09-23 23:33 228600 ----a-w- c:\windows\system32\aswBoot.exe
    2013-03-03 19:50 . 2008-10-23 12:05 499712 ----a-w- c:\windows\system32\msvcp71.dll
    2013-03-03 19:07 . 2013-04-10 05:00 1082232 ----a-w- c:\windows\system32\drivers\ntfs.sys
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-04-25 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-04-25 170520]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-01-17 4907008]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
    .
    c:\users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
    @=""
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
    @="Service"
    .
    S2 AERTFilters;Andrea RT Filters Service;c:\windows\system32\AERTSrv.exe [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
    2013-05-24 03:27 1165776 ----a-w- c:\program files\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2013-05-28 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-13 01:47]
    .
    2013-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-04-16 12:16]
    .
    2013-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2013-04-16 12:16]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    mStart Page = about:blank
    TCP: DhcpNameServer = 192.168.0.1
    FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\fzo7gk9z.default-1368028199828\
    FF - ExtSQL: 2013-05-06 13:44; {DAC3F861-B30D-40dd-9166-F4E75327FAC7}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
    FF - ExtSQL: 2013-05-06 13:44; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - ExtSQL: 2013-05-08 21:48; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\fzo7gk9z.default-1368028199828\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
    FF - ExtSQL: 2013-05-08 22:35; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\fzo7gk9z.default-1368028199828\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
    FF - ExtSQL: 2013-05-11 23:31; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\fzo7gk9z.default-1368028199828\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
    FF - ExtSQL: 2013-05-27 14:15; trafficlight@bitdefender.com; c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\fzo7gk9z.default-1368028199828\extensions\trafficlight@bitdefender.com.xpi
    .
    - - - - ORPHANS REMOVED - - - -
    .
    SafeBoot-WudfPf
    SafeBoot-WudfRd
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2013-05-28 22:00
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker5"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
    @="?????????????????? v1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
    @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
    @="?????????????????? v2"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
    @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
    .
    Completion time: 2013-05-28 22:02:41
    ComboFix-quarantined-files.txt 2013-05-28 21:02
    ComboFix2.txt 2013-05-14 16:37
    .
    Pre-Run: 180,280,778,752 bytes free
    Post-Run: 180,693,176,320 bytes free
    .
    - - End Of File - - 07BEE392F84F2C2F03B1CADAA1D3070B
     
    Yorkshire, May 28, 2013
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You need to attach your logs in the future. How are things running?
     
    TimW, May 29, 2013
    #8
  9. Yorkshire

    Yorkshire Private E-2

    sorry about that
    still get bitdefender finding the virus and yahoo wont load up for me

    any signs of malware?
     
    Yorkshire, May 30, 2013
    #9
  10. Yorkshire

    Yorkshire Private E-2

    comp slow to load too
     
    Yorkshire, May 30, 2013
    #10
  11. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Attach a log from bitdefender so I can see what is going on.
     
    TimW, May 30, 2013
    #11
  12. Yorkshire

    Yorkshire Private E-2

    unbelievably the first time i run it now no virus midas3
     
    Yorkshire, May 30, 2013
    #12
  13. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Are you still having issues?
     
    TimW, May 31, 2013
    #13
  14. Yorkshire

    Yorkshire Private E-2

    seems okay, were my logs clear
     
    Yorkshire, May 31, 2013
    #14
  15. Yorkshire

    Yorkshire Private E-2

    still keep getting the odd not responding on pages
     
    Yorkshire, May 31, 2013
    #15
  16. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You may need to post in the software forum for that issues. Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Jun 1, 2013
    #16
  17. Yorkshire

    Yorkshire Private E-2

    My mouse wont go down to taskbar where all the open windows its odd
     
    Yorkshire, Jun 1, 2013
    #17
  18. Yorkshire

    Yorkshire Private E-2

    cant close windows either something not right
    wont let me click the x right button
     
    Yorkshire, Jun 1, 2013
    #18
  19. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I don't think your issues are malware related, but if you want, rerun the procedures and get me new logs. I may have to send you to the software forum.
     
    TimW, Jun 1, 2013
    #19
  20. Yorkshire

    Yorkshire Private E-2

    bitdefender still keeps findinf this virus
     

    Attached Files:

    Yorkshire, Jun 2, 2013
    #20
  21. Yorkshire

    Yorkshire Private E-2

    okay thanks
    have enclosed fresh set of logs
     

    Attached Files:

    Yorkshire, Jun 2, 2013
    #21
  22. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding it in your logs. Perhaps it is a false positive from Bitdefender. What issues are you having?
     
    TimW, Jun 2, 2013
    #22
  23. Yorkshire

    Yorkshire Private E-2

    I sent all my logs in my cant see them
     
    Yorkshire, Jun 3, 2013
    #23
  24. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    ????
     
    TimW, Jun 3, 2013
    #24
  25. Yorkshire

    Yorkshire Private E-2

    seems okay now so if my logs are clean I guess I am ok

    do I re defog and delete everything
     
    Yorkshire, Jun 5, 2013
    #25
  26. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Jun 5, 2013
    #26
  27. Yorkshire

    Yorkshire Private E-2

    many thanks
     
    Yorkshire, Jun 6, 2013
    #27
  28. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome. Safe surfing. :)
     
    TimW, Jun 6, 2013
    #28

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds