*winsvchost trojan* READ ME FIRST logs attached

Discussion in 'Malware Help (A Specialist Will Reply)' started by maddog808, Jun 27, 2013.

  1. maddog808

    maddog808 Private E-2

    I screwed up and tried to download & install an app that I should have just paid for. :foolish I'm pretty sure I have a nasty trojan now (according to mbam, RK, Hitman, etc.)

    There are many running processes all named *****winsvchost.exe (the ***** is a random 5 digit number). Also there are 2 processes running with the file name of the program I downloaded (ConvertXtoDVD).

    My mouse pointer has a constant spinning circle (Windows 7 hourglass), which makes me think this Trojan is hard at work screwing things up in my file system and registry.

    Any help will be GREATLY appreciated. Logs attached.

    Also, here is a screenshot of the running processes (this was taken AFTER going through all the READ ME FIRST steps:










    Thanks in advance for any time spent helping me,

    Matt
     

    Attached Files:

    Last edited by a moderator: Jun 27, 2013
    maddog808, Jun 27, 2013
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
    When it opens, press the Scan button
    Now click the Registry tab and locate these detections:


    • [RUN][SUSP PATH] HKCU\[...]\Run : 72803VSO.ConvertXtoDVD.v5.0.0.44.Incl.Patch-MeGaHeRTZ.exe (C:\Users\maddog808\AppData\Roaming\72803VSO.ConvertXtoDVD.v5.0.0.44.Incl.Patch-MeGaHeRTZ.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : Windows Updater ("C:\Users\maddog808\AppData\Roaming\20589winsvchost.exe" [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 20589winsvchost.exe (C:\Users\maddog808\AppData\Roaming\20589winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 93095winsvchost.exe (C:\Users\maddog808\AppData\Roaming\93095winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 82752winsvchost.exe (C:\Users\maddog808\AppData\Roaming\82752winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 80138winsvchost.exe (C:\Users\maddog808\AppData\Roaming\80138winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 37091winsvchost.exe (C:\Users\maddog808\AppData\Roaming\37091winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 77254winsvchost.exe (C:\Users\maddog808\AppData\Roaming\77254winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 81877winsvchost.exe (C:\Users\maddog808\AppData\Roaming\81877winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 47213winsvchost.exe (C:\Users\maddog808\AppData\Roaming\47213winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 79160winsvchost.exe (C:\Users\maddog808\AppData\Roaming\79160winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 12831winsvchost.exe (C:\Users\maddog808\AppData\Roaming\12831winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 88189winsvchost.exe (C:\Users\maddog808\AppData\Roaming\88189winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 57870winsvchost.exe (C:\Users\maddog808\AppData\Roaming\57870winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 67516winsvchost.exe (C:\Users\maddog808\AppData\Roaming\67516winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 67458winsvchost.exe (C:\Users\maddog808\AppData\Roaming\67458winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKCU\[...]\Run : 51987winsvchost.exe (C:\Users\maddog808\AppData\Roaming\51987winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 72803VSO.ConvertXtoDVD.v5.0.0.44.Incl.Patch-MeGaHeRTZ.exe (C:\Users\maddog808\AppData\Roaming\72803VSO.ConvertXtoDVD.v5.0.0.44.Incl.Patch-MeGaHeRTZ.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : Windows Updater ("C:\Users\maddog808\AppData\Roaming\20589winsvchost.exe" [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 20589winsvchost.exe (C:\Users\maddog808\AppData\Roaming\20589winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 93095winsvchost.exe (C:\Users\maddog808\AppData\Roaming\93095winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 82752winsvchost.exe (C:\Users\maddog808\AppData\Roaming\82752winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 80138winsvchost.exe (C:\Users\maddog808\AppData\Roaming\80138winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 37091winsvchost.exe (C:\Users\maddog808\AppData\Roaming\37091winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 77254winsvchost.exe (C:\Users\maddog808\AppData\Roaming\77254winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 81877winsvchost.exe (C:\Users\maddog808\AppData\Roaming\81877winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 47213winsvchost.exe (C:\Users\maddog808\AppData\Roaming\47213winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 79160winsvchost.exe (C:\Users\maddog808\AppData\Roaming\79160winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 12831winsvchost.exe (C:\Users\maddog808\AppData\Roaming\12831winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 88189winsvchost.exe (C:\Users\maddog808\AppData\Roaming\88189winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 57870winsvchost.exe (C:\Users\maddog808\AppData\Roaming\57870winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 67516winsvchost.exe (C:\Users\maddog808\AppData\Roaming\67516winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 67458winsvchost.exe (C:\Users\maddog808\AppData\Roaming\67458winsvchost.exe [-]) -> FOUND
      [RUN][SUSP PATH] HKUS\S-1-5-21-384597277-1165354790-2325154611-1000\[...]\Run : 51987winsvchost.exe (C:\Users\maddog808\AppData\Roaming\51987winsvchost.exe [-]) -> FOUND

    Place a checkmark each of these items, leave the others unchecked.
    Now press the Delete button.
    When it is finished, there will be a log on your desktop called: RKreport[2].txt
    Attach RKreport[2].txt to your next message. (How to attach)
    Do not reboot your computer yet.

    Now rerun Hitman and have it fix everything it found.

    Reboot and rescan with both RogueKiller and Hitman and attach those new logs as well.

    Be sure to tell me how things are running now.
     
    TimW, Jun 27, 2013
    #2
  3. maddog808

    maddog808 Private E-2

    Thank you very much for the quick response, Tim!!

    I followed your instructions.

    When I scanned with Rogue Killer, The registry entries changed from the original scan yesterday. The 5 digit numbers are generating randomly. I went ahead and checked the boxes and deleted them anyway. I've attached the log from that (although, the file is not named "RKreport[2].txt". It is named "RKreport[0]_D_06272013_172636.txt".

    Then I scanned with Hitman, and clicked "next". Some items were marked "quarantine", others "delete" and others "ignore". I left them all the way they were. I wasn't sure exactly what you meant by "have it fix everything it found".

    Then I rebooted and re-scanned with both, and attached the logs here.

    Now, when I re-booted, before getting to the Windows 7 login screen, there was a black screen, with large white text about Hitman and winsvchost.exe.

    The problem seems to be gone, as the processes aren't running in task manager anymore:






    But, there are still entries in the registry according to the scans I did after the reboot.

    I will stand by and wait for your next instructions.

    Thanks again!!! :)

    Matt
     

    Attached Files:

    Last edited by a moderator: Jun 28, 2013
    maddog808, Jun 27, 2013
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Rerun RogueKiller and have it delete this item:
    [code[[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : Windows Updater ("C:\Users\maddog808\AppData\Roaming\30444winsvchost.exe" [x]) -> FOUND[/code]

    Now rerun Hitman and have it delete everything it found.

    Rescan with RogueKiller and Hitman after a reboot and attach those logs as well.
     
    TimW, Jun 28, 2013
    #4
  5. maddog808

    maddog808 Private E-2

    Hi Tim,

    Sorry for the delay. I was away from home for a week, and just got back. I followed your instructions, and the logs are attached.

    Thanks again for your help. The machine seems to be running normal now.

    Matt
     

    Attached Files:

    maddog808, Jul 8, 2013
    #5
  6. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Good to know.

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. You can uninstall RogueKiller and HitManPro.
    2. Go back to step 4 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    7. After doing the above, you should work thru the below link


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0
     
    TimW, Jul 8, 2013
    #6
  7. maddog808

    maddog808 Private E-2

    I do notice that when I login to the admin account, a real quick cmd.exe box opens and closes. It happens so fast, I can't tell what it is. I don't remember this happening before the malware problem.

    Also, should I delete the registry entry that RogueKiller finds?

    "[V2][SUSP PATH] DealPly : C:\Users\MADDOG~1\AppData\Roaming\DealPly\UPDATE~1\UPDATE~1.EXE - /Check [x] -> FOUND"


    Thanks,
    Matt
     

    Attached Files:

    maddog808, Jul 9, 2013
    #7
  8. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Yes, you can delete that entry.

    Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator). Attach the new C:\MGLogs.zip so I can look for the cmd window.
     
    TimW, Jul 10, 2013
    #8
  9. maddog808

    maddog808 Private E-2

    Here you go, Tim.

    Thanks once again!


    Matt
     

    Attached Files:

    maddog808, Jul 10, 2013
    #9
  10. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    If you look at the runkeys log, you will see the cmd window is related to your Skydrive.
     
    TimW, Jul 11, 2013
    #10

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds