Win32/Heur Infection on Laptop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now use windows explorer to find and delete:
C:\Documents and Settings\Maggie\Application Data\Afdeor
C:\Documents and Settings\Maggie\Application Data\ARBE
C:\Documents and Settings\Maggie\Application Data\Coeb
C:\Documents and Settings\Maggie\Application Data\Dycyub
C:\Documents and Settings\Maggie\Application Data\Exoklu
C:\Documents and Settings\Maggie\Application Data\Feid
C:\Documents and Settings\Maggie\Application Data\Fotoyd
C:\Documents and Settings\Maggie\Application Data\HTC
C:\Documents and Settings\Maggie\Application Data\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
C:\Documents and Settings\Maggie\Application Data\Sonayb
C:\Documents and Settings\Maggie\Application Data\Veykfa
C:\Documents and Settings\Maggie\Application Data\Ydul
C:\NAOAPXGL.EXE

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!


Be sure to download TDSSKiller.exe (v2.4.0.0) from Kaspersky's website and not TDSSKiller.zip which appears to be an older version 2.3.2.2 of the tool.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
• If TDSSKiller does not run, try renaming it.
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
• Click the Start Scan button.
• Do not use the computer during the scan
• If the scan completes with nothing found, click Close to exit.
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_14.17.05_log.txt) will be created and saved to the root directory ( usually Local Disk C ).
• Attach this log to your next message

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* TDSSKiller log.
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Yes. Add that to the fix.

 

Please go back to the Read and Run First instructions and download ComboFix to your desktop. Do not run it just yet. We need to see if it will work.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

* Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
If it is not on your Desktop, the below will not work.
* Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
* If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
* Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

KILLALL::

File::
C:\Documents and Settings\Maggie\Local Settings\Temp\6PBjnYgD.exe.part
C:\Documents and Settings\Maggie\Local Settings\Temp\L426MR2M.exe.part
C:\Documents and Settings\Maggie\Local Settings\Temp\raaB.tmp
C:\Program Files\win\x39.exe
Folder::
C:\Documents and Settings\Maggie\Application Data\Lewiqa
C:\Documents and Settings\Maggie\Application Data\Nifoo
C:\Documents and Settings\Maggie\Application Data\Peeslo
C:\Documents and Settings\Maggie\Application Data\Sany

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"{BE9BF95B-849E-65FA-EF68-DBDA1D05AA4A}"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentVersion\Run]
"rap"=-

* Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
* At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
* You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
If it asks you to overide the previous file with the same name, click YES.
* Now use your mouse to drag CFscript.txt on top of ComboFix.exe
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
* Follow the prompts.
* When it finishes, a log will be produced named c:\combofix.txt
* I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Nope, it didn't work.

Download The Avenger by Swandog469, and save it to your Desktop.

* Extract+ avenger.exe from the Zip file and save it to your desktop

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Yes, everything else has been removed except those two items in HJT. Try doing it again and then tell me what issues you have.

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

 

You need to attach an new log from either HJT or just rerun GetLogs.bat and attach the new MGlogs.zip file. Otherwise you will not know if they have really been fixed.

 

I am not finding those exe files in any of your other logs. Let's see if something else can find them:

Using BitDefender Online Scan.

 

It is just the .DEFAULT registry entries that need to be removed. The files were already removed.

 

Please run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\MGlogs.zip

 

Yes, it was a worthless log. Disable AVG and try again. But run the other scans as well......
SAS
MBAM
Combofix if it will run.

 

Not a problem. I will be here.

 

Let's try again:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now see if you can run Combo.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\ComboFix.txt
* C:\MGlogs.zip

 

You need to tell me what process you see running that you are concerned about.

In the meantime:

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.
* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Your logs are clean. You can not rely on Windows firewall for adequate protection, you should download a third party firewall!! See the final instructions on how to protect yourself.

If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
     
     
   
   
3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
   
   
10. After doing the above, you should work thru the below link:
    
    • How to Protect yourself from malware!
    
    

Support MajorGeeks with Geek Wear!

 

What happened between when you posted your last logs that were clean and now?

Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

After clicking Fix, exit HJT.

Now copy just the bold text below to notepad (Do not include any space above the word REGEDIT). Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

* Run avenger.exe by double-clicking on it.
* -Do not change any check box options!!
* Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

* Now click the Execute button.
* Click Yes to the prompt to confirm you want to execute.
* Click Yes to the Reboot now? question that will appear when Avenger finishes running.
* Your PC should reboot, if not, reboot it yourself.
* A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner to clean out only temp files and nothing else!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

* C:\Avenger.txt
* C:\MGlogs.zip

 

I wanted to address this separately.

Yes, a reformat will remove everything including any infections.

The thing to back up is all your personal info and data, which includes images, music, videos and doc's. Just don't backup any exe files or programs. Once you have done a clean install, installed your AV and AS protection, then you can scan your backup media before reinstalling it on your system.

 

Based on you last logs, I checked earlier logs. It appears that part of your infection may have been getting missed. The C:\WINDOWS\Explorermgr.exe that is in your logs needed to be removed. If you have not already formatted, let's try the below fix. Also since things may have changed after your last logs were posted, this current fix I'm posting may be a little out of date too and another may still be needed.

I'm also concerned whether you may have a new form of Ramnit so we will run an online scanner too.

First I need you to load your C:\Windows\win.ini file into notepad. And go to the end of the file and delete the below two lines. Then save the file and quit notepad.

[HookAPI]
DLL_PATH=C:\Program Files\DoubleD\GamingHarbor Toolbar\4.1.2.19770


Now uninstall the below two programs:
NOD32 FiX v2.1
Spybot - Search & Destroy 1.4

Also you seem to have missed fixing the below with HiackThis as requested last time.

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - HKCU\..\Run: [{BE9BF95B-849E-65FA-EF68-DBDA1D05AA4A}] "C:\Documents and Settings\Maggie\Application Data\Vocoo\bavy.exe"

After clicking Fix, exit HJT.


Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now you need to get some protection on this PC to avoid having reinfection. I suggest that you install the below two programs immediately:

• AntiVir Personal Edition
• Comodo Personal Firewall
  • WARNINGS:
    • Ask Toolbar may be installed by default but you can uncheck this during the install or uninstall it anytime afterwards if you decide you do not want this feature later.
    • This includes both the a firewall and an antivirus. Do not install the antivirus since you will already have installed Avira.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\avenger.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

There is still a new one in your last log. It is now beqym.exe

Also the C:\WINDOWS\Explorermgr.exe came right back. You cannot make mistakes while following instructions as each reboot or mistake can cause the infection to spread and or mutate into a different form which make a fix become obsolete immediately. Also I have to advise you not to reboot or power down your PC after you attach new logs because that would also possibly change your status.

Uninstall Firefox for now while we continue to work on this. It may help control things a little. DO NOT reinstall it until we finish.

On the contrary in this case you need to install the antivirus as suggest to possibly help ward off reinfection. This was why it was part of my fix. You need to follow the fixes we give you and not invent your own.

ramaint.exe is a process belonging to the 3am Laboratories, Remotely Anywhere remote administration tool. You have this because you installed LogMeIn to allow remote access to your PC. Why did you install this?

However all the above being said, I now looked over your new logs and my suspicion about you having a form of Ramnit is correct. You have one that is making files like below:

C:\WINDOWS\Explorermgr.exe
C:\WINDOWS\system32\rundll32mgr.exe
C:\WINDOWS\system32\taskmgrmgr.exe

I will give you one more fix but I expect that you will have to reinstall inorder to fix this properly. Ramnit can cause all kinds of damage and result in an unreliable PC.


Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista or Win 7, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines ( and any similar ones that look like the infection ) but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O4 - .DEFAULT User Startup: beqym.exe (User 'Default user')
After clicking Fix, exit HJT.

• Run avenger.exe by double-clicking on it.
• Do not change any check box options!!
• Copy everything in the Quote box below, and paste it into the Input script here: part of the window:

• Now click the Execute button.
• Click Yes to the prompt to confirm you want to execute.
• Click Yes to the Reboot now? question that will appear when Avenger finishes running.
• Your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Maggie\Local Settings\Temp

Now run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

Now run this:Using ESET's Online Scanner and attach the log.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).


Then attach the below logs:

• C:\avenger.txt
• the log from ESET
• C:\MGlogs.zip

Make sure you tell me how things are working now!
After attaching these new logs, DO NOT power down or reboot your PC. You must keep it running to until we give the next fix.

 

Yes and notice that my suspicions of this being a Ramnit infection were correct. I'm sorry but it is time to reinstall. Becareful of doing any backups. Ramnit can/will infect any executable type file and HTML files. For example, see what ESET was showing.

 

If you have any malware problems after the reinstall then you should not just format, you should actually delete partitions, create new partitions, and then format and reinstall. This is actually a much safer and recommended solution after having malware.

 

You may want to post in the Hardware Forum to check it out. Running chkdsk may be the first thing to run but you may want to try running some other hard disk diagnostics too.

However your C and D partitions ( on drive ) show that your drive is fairly small by today's standards and an upgrade may not be a bad idea anyway.

 

You're welcome. Make sure you work thru the below now:

How to Protect yourself from malware!