Win32/Dorkbot on computer and hard drive.

Discussion in 'Malware Help (A Specialist Will Reply)' started by Ozarukage, Sep 13, 2013.

  1. Ozarukage

    Ozarukage Private E-2

    About two days ago I noticed my hard drive (Buffalo HD-PCTU3) had a $Recycler folder or something like that, and tons of shortcuts. I don't fully remember what I did at that point, apart form scanning with ESET and found out it was Dorkbot. I also found MalwareBytes suggested somewhere and used it, and fixed whatever problems it showed. So the shortcuts disappeared ( I think ESET did that), but the folder was still there, and my other folders were still hidden. And when I checked my two system drives I noticed they were infected too, though there were only a few folders hidden (in my hard drive it was every folder).
    By the way, the folder contains subfolders which I can't access, along with a fake recycle bin thing. And despite being a few MB, if I try deleting the folder it attempts to delete GBs.
    Also, as of today my hard drive has stopped being detected by the computer, despite it's light coming on (Note: My brother's hard drive, same model, also had stopped being detected a while back, and I had checked it on my copmuter. Any relation to the virus? Though he definitely didn't have it)
    Another change today is that all those subfolders have also become fake recycle bins.

    I tried ESET's specific scanner for Win32/Dorkbot, but it says there's no infection. I also tried SpyHunter. Then I came across this place.
    So, I've done all the stuff in the instructions and attached the logs (albeit over a day or so, I've had to manage this whenever I get time between work). Though, the MalwareBytes log I've attached is the one I took initially, since that's when it detected something. I also did a full scan from MB after that, and I did reinstall and rescan when I was following the instructions here. So I have those two logs as well, if needed.
     

    Attached Files:

  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rescan with Hitman and have it fix everything it found.

    Reboot and rescan with Hitman and attach the new log.
     
  3. Ozarukage

    Ozarukage Private E-2

    Um, did you want the logs from both scans or only after reboot? I put both anyway.

    And I wasn't sure if you wanted me to do anything to the suspected things, since hitmanpro suggests Ignore for them.
     

    Attached Files:

  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Since it was reporting a Sality infection, please do the following:

    eSet Online Scan.
     
  5. Ozarukage

    Ozarukage Private E-2

    ESET is only showing MGTools as infected.
     

    Attached Files:

  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know. What issues are you still having, if any?
     
  7. Ozarukage

    Ozarukage Private E-2

    Still the same, $Recyce.Bin folders in C and D, though the folders inside $Recycle.Bin which had changed to Recycle Bins have changed back.

    Question: This is a Windows virus, right? So if I were to install and boot another OS, say Ubuntu, wouldn't I be able to delete the $Recycle.Bin folders without harm?
     
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, that might be possible. I take it you cannot empty the recycle bin?
     
  9. Ozarukage

    Ozarukage Private E-2

    The normal Recycle Bin? I can. Not that there was much in it. I'd emptied it quite recently.
    There was one of the subfolders of $Recycle.Bin that I'd deleted from my hard drive. Oh but the folder or two it had taken with it seems to have disappeared since I took the hard drive out/ it stopped working.
     
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Where does the situation stand at present?
     
  11. Ozarukage

    Ozarukage Private E-2

    Okay, instead of trying to explain it, which would just be confusing, I've just attached print screens of how it all looks now.
    I'm about to use an expendable pen drive to see if it's spreading.
    And I'll try Ubuntu tomorrow, probably.
     

    Attached Files:

  12. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Hang in there, I am consulting with my colleagues.
     
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    There is nothing wrong in these screens. These are normal Windows folders. You should not be trying to remove them unless the goal is to break Windows.
     
  14. Ozarukage

    Ozarukage Private E-2

    They are? How weird. Since my hard drive definitely had it and the infection's folders are supposed to be similar, I assumed it was here too. Especially since stuff was being detected.
    Well, thanks for all the help and patience then, and sorry for whatever of this was needless worrying. At least some harmful stuff got cleared out anyway.
    Thanks.
     
  15. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You're welcome.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Renable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now goto the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. If you are running Win 8, Win 7, Vista, Windows XP or Windows ME, do the below to flush restore points:
      • Refer to the instructions for your WIndows version in this link: Disable And Enable System Restore
      • What we want you to do is to first disable System Restore to flush restore points some of which could be infected.
      • Then we want you to Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds