How to remove LNK.Jenxcus-p worm virus?

essexboy · 2015-07-13T17:41:00.000Z

I cannot see the trigger for this so lets look deeper

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

system · 2015-07-13T19:06:43.000Z

essexboy post:10:

I encountered the following errors while ComboFix was working, in all cases I pressed “Yes”.

http://imgur.com/a/PP56A
The problems are still present. Though I am not getting as many lnk files popping up, right after the reboot Avast found two new infections, both in the same directory.

essexboy · 2015-07-13T19:13:55.000Z

What directory was this ?

system · 2015-07-13T19:18:46.000Z

essexboy post:12:

What directory was this ?

It came from C:\AdwCleaner but could be anything, the files seem to be created in whatever directory I’m in, lately (or at least that I remember) it’s been creating only “My Music” folders

essexboy · 2015-07-13T19:29:10.000Z

OK lets clear the tools in case it is trying to run from quarantine
Once done reboot and let me know if Avast alerts again

Remove Combofix

Click Start then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
In the box copy/paste the following command:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

Then click OK (or press Enter ).
Wait for the uninstall process to complete.

Remove tools

Download and run Delfix
Select the options as shown

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

system · 2015-07-13T19:50:36.000Z

essexboy post:14:

OK lets clear the tools in case it is trying to run from quarantine
Once done reboot and let me know if Avast alerts again

http://i.imgur.com/5aDUPyG.png

It’s still there.

I think I should also mention that MalwareBytes and MCShield were not uninstalled by Delfix.

Attached is the log Delfix generated.

essexboy · 2015-07-13T20:41:19.000Z

No those two will stay

Download AVZ tool from here to your desktop
Unzip all files to a folder on your desktop
Open the folder and double click the AVZ icon
https://dl.dropboxusercontent.com/u/73555776/avz.JPG

When the tool opens select “File” > “Standards scripts”

https://dl.dropboxusercontent.com/u/73555776/avz1.jpg

Place a tick in :

5. Update signature database

Then press “Execute selected scripts”

https://dl.dropboxusercontent.com/u/73555776/avz2.JPG

Once that has execute then
select “File” > “Standards scripts”
Place a tick in :

3. Advanced System Analysis with malware removal mode enabled

When finished look in the folder AVZ4 on your desktop
Open the LOG folder
Upload the zip file virusinfo_syscure to a file sharing site for me to collect

https://dl.dropboxusercontent.com/u/73555776/vz3.JPG

system · 2015-07-13T21:09:47.000Z

essexboy post:16:

No those two will stay

http://i.imgur.com/t4oDu6k.png

It stops responding, I tried downloading it again but get same results.

essexboy · 2015-07-14T14:18:46.000Z

Is there anything important in this folder :

C:\Joymax

If not then run this fix

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: 2015-07-11 18:16 - 2014-03-18 11:15 - 00000000 ____D C:\Joymax EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-07-14T15:42:09.000Z

essexboy post:18:

Is there anything important in this folder :

The folder was empty, the .lnk files were created in different folders in the C directory and that just happened to be the one I captured on screenshot.

essexboy · 2015-07-14T16:32:51.000Z

Are you still receiving the alerts ?

system · 2015-07-15T15:49:58.000Z

essexboy post:20:

Are you still receiving the alerts ?

Yes
http://i.imgur.com/fkObn2d.png

I also apologize for late reply.

essexboy · 2015-07-15T16:52:00.000Z

Could you try AVZ from safe mode please… I assume you have no USB devices plugged in during the alerts

system · 2015-07-16T17:49:32.000Z

essexboy post:22:

Could you try AVZ from safe mode please… I assume you have no USB devices plugged in during the alerts

The only USB device I have plugged in is my mouse.

When running AVZ in safe mode it doesn’t stop responding, but suddenly closes, no log is generated.

essexboy · 2015-07-16T19:33:31.000Z

You have a fair few folders on your root c drive did you put those there

system · 2015-07-17T12:50:11.000Z

essexboy post:24:

You have a fair few folders on your root c drive did you put those there

I assume most of those came with programs I installed.

essexboy · 2015-07-17T13:02:09.000Z

I will remove the suspect folders and see if that kills it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: 2015-07-11 20:10 - 2013-08-29 11:13 - 00000000 ____D C:\eclipse 2015-07-11 19:58 - 2012-12-02 18:15 - 00000000 ____D C:\Users\Daniel\Downloads\Google chrome 2015-07-11 18:38 - 2014-02-20 18:45 - 00000000 ____D C:\Javalib 2015-07-11 18:27 - 2012-12-02 12:34 - 00000000 ____D C:\Fotos 2015-07-11 18:20 - 2014-06-06 23:03 - 00000000 ____D C:\nasm 2015-07-11 18:16 - 2014-03-18 11:15 - 00000000 ____D C:\Joymax 2015-07-11 08:32 - 2015-05-08 21:13 - 00000000 ____D C:\oraclexe 2015-07-11 08:32 - 2015-05-08 18:38 - 00000000 ____D C:\app 2015-07-11 08:32 - 2014-06-06 22:44 - 00000000 ____D C:\TASM RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-07-17T13:30:15.000Z

essexboy post:26:

I will remove the suspect folders and see if that kills it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: 2015-07-11 20:10 - 2013-08-29 11:13 - 00000000 ____D C:\eclipse 2015-07-11 19:58 - 2012-12-02 18:15 - 00000000 ____D C:\Users\Daniel\Downloads\Google chrome 2015-07-11 18:38 - 2014-02-20 18:45 - 00000000 ____D C:\Javalib 2015-07-11 18:27 - 2012-12-02 12:34 - 00000000 ____D C:\Fotos 2015-07-11 18:20 - 2014-06-06 23:03 - 00000000 ____D C:\nasm 2015-07-11 18:16 - 2014-03-18 11:15 - 00000000 ____D C:\Joymax 2015-07-11 08:32 - 2015-05-08 21:13 - 00000000 ____D C:\oraclexe 2015-07-11 08:32 - 2015-05-08 18:38 - 00000000 ____D C:\app 2015-07-11 08:32 - 2014-06-06 22:44 - 00000000 ____D C:\TASM RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Of those:

Eclipse is the Java IDE I use.
Javalib, nasm and tasm I believe are tools for creating lexers (I know nasm is)
Not sure what is stored in oracleexe, could there be any data from the Oracle Database System or any other developing tool?
The fotos folder is just a folder where I store pictures taken with my camera.
The Google Chrome folder in Downloads is just the directory where everything I download from Google Chrome goes.
I removed the Joymax folder earlier when you told me.

essexboy · 2015-07-17T13:51:10.000Z

I am reaching a bit of an impasse now as most of my tools are failing to run … We will try one more

Create an emergency repair USB drive:
Download Dr Web Live USB to your desktop

[]Connect a USB flash drive to the computer. Registering the plugging in event takes no more than 10 seconds.
[]Launch drwebliveusb.exe.
[*]The program will detect available USB-devices automatically and prompt you to choose the one you?d like to use as an emergency repair drive. You can format the device if you like (a warning will be displayed before you proceed with formatting). In order to read the License agreement, follow a corresponding link found in the program window (the page containing the license agreement text will be loaded in your default browser).

https://dl.dropbox.com/u/73555776/liveusb_ru.jpg

[]To create a bootable USB flash drive, press the Create Dr.Web LiveUSB button.
[]Files will be copied automatically.
[]Once the copying process is completed, press the Exit button to close the application.
[]Reboot the infected computer with the USB in the drive
[]Ensure that the first boot device is USB - If you are not sure about that then see this page for instructions
[]As loading starts, a dialogue window will prompt you to choose between the standard and safe modes.

https://dl.dropboxusercontent.com/u/73555776/Live%20boot%20screen.png

[*]Use arrow keys to select DrWeb-LiveCD (Default)

https://dl.dropboxusercontent.com/u/73555776/drwebselect.JPG

[*]Press select objects for scanning

https://dl.dropboxusercontent.com/u/73555776/drwebfolders.JPG

[*]When the system is loaded, check the disks or folders you want to scan, and click on Start.

[*]The programme will now scan for and cure/delete any malware that it finds. Allow it to do so

https://dl.dropboxusercontent.com/u/73555776/drwebscan.JPG

[*]When it has completed

https://dl.dropboxusercontent.com/u/73555776/drwebscancomplete.JPG

[]Select Open Report and copy to the USB
[]Once completed reboot to normal windows, and attach the report here

system · 2015-07-17T23:11:59.000Z

essexboy post:28:

I am reaching a bit of an impasse now as most of my tools are failing to run … We will try one more

The tool’s been checking my computer for over 7 hours now, though it’s been in the same percentage for at least 4 hours, I’m not sure if this is normal, I also think it’s checked the same folder various times now, or at least it’s not the first time it’s been checking the adt bundle.

Also the remaining time’s been changing a lot, at one point it said it ad 35 hours left and then it had 7 minutes.

http://i.imgur.com/p4VNw0F.png

Announcements