win32, trojan, rootkit etc.

Discussion in 'Malware Help (A Specialist Will Reply)' started by mrriddler, Mar 4, 2009.

  1. mrriddler

    mrriddler Private E-2

    Alright. I hit upon this problem earlier tonight. I tried to be as detailed as possible.

    Source of problem: About 4-5 hours ago, I was prompted for and very, very foolishly installed what appeared on the surface to be a legit plugin for Windows Media Player. Provided no function. Quickly installed and subsequent query revealed it was likely a malware. Red flags started going up according to my Online Armor and this happened when I tried to access my C drive:

    Cannot Open C drive: Windows cannot find 'RECYCLER\S-0-1-69-100010723-100011219-100031739-5742.com'

    I started running through my malware defenses, which proved to be futile. Updates were blocked for most including AVG and found I couldn't open Spybot. When I tried to uninstall it I got this from Online Armor:

    _iu14D2N.tmp wants to run.
    Program has same content C:\Program Files\Spybot - Search Destroy\ununs000.exe but its filename is C:\Documents and Settings\Xavier\Local Settings\Temp\_iu14D2N.tmp. Recommended block.

    Later I was able to uninstall it and reinstalled it after removing Online Armor.

    Went through the recommended list. Brief snag when autoupdate for SuperAntispy failed. Ran a full scan and then remembered to update manually so I ran it again. Both logs are attached.

    Uninstalled Spybot and reinstalled successfully. Autoupdate worked. Everything after worked fine without issue.

    At this point: I CAN access C drive again, but I'm not sure if everything was removed or if the virus might be mutatable. Advice and help would be greatly appreciated. Mainly things like:

    1) Should I reinstall Online Armor?
    2) Do I perform the Toggle System Restore?
    3) Any additional tests?
    4) And if/when everything is fixed, is there a procedure for removing Combatfix and MgTools and their associated files/registries etc?

    Thanks in advance for reading and for help.
     

    Attached Files:

    mrriddler, Mar 4, 2009
    #1
  2. mrriddler

    mrriddler Private E-2

    Combat Fix log and MgTools logs.
     

    Attached Files:

    mrriddler, Mar 4, 2009
    #2
  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Your logs are clean......though you can use windows explorer to find and delete:
    C:\WINDOWS\system32\rn.tmp

    This should answer your questions ..........If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, Mar 5, 2009
    #3
  4. mrriddler

    mrriddler Private E-2

    Alright. Thanks for the help. Much appreciated.
     
    mrriddler, Mar 5, 2009
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.....safe surfing. :)
     
    TimW, Mar 8, 2009
    #5

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds