I am getting repeat alarms from both messages below. My I ask what causes it and what i may do to remove this 2 malware?
URL: http://disorderstatus.ru/order.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe
URL: http://disorderstatus.ru/diff.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe
Attached are the logs required. Any expert advice is greatly appreciated. Thanks
Please re-run Malwarebytes Anti-Malware and remove everything it finds.
[*]Step #1 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –
Start
CreateRestorePoint:
CloseProcesses:
Emptytemp:
IE trusted site: HKU\S-1-5-21-1856509183-1709349294-3674221526-1000\...\maxonline.com.sg -> hxxps://authserver1.maxonline.com.sg
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
2015-08-03 09:39 - 2015-03-13 12:11 - 00132975 _____ C:\Windows\AutoKMS.log
C:\ProgramData\msolnu.exe
C:\Users\BIENOC\jquery-2.1.1.min.js
CMD: bitsadmin /reset /allusers
End
[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
[*]Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[]After the completion, a log will be produced;
[]Attach the log in your next reply.[/list]
[*]Required Log(s):
[*]FRST Fix Log
Regards,
Valinorum
Hi , issue seems to be fixed.
Can shed some light how i gotten the virus and what was done to actually removed the malware?
I read from the logs where some registry keys was removed. able to guide me along?
One JavaScript file and some leftover of Task files were causing them.
Perusing your logs, I see no infection currently present in your system. Unless you are having any issue(s), the machine appears to be Malware-free as we speak.
Removal of Tools and Quarantined Files
Despite the tools we have used are clean, they are powerful removal tools and made in a way so that they carry out any commands given to them without (most cases) asking for a confirmation. In the hands of an inept person, they can make the machine un-bootable – a scenario we do not wish to see. Also, we need to remove the quarantined files/folders from your system as a dormant malware can be as bad as an active one if given the proper environment. I shall now give you the guidelines to remove the tools and the quarantined files from your system.
[*]Cleanup with Delfix
Please download DelFix by Xplode to your Desktop.
Download Link
[*]Double-click to run the program;
[list][*]Note: Windows Vista/7/8 users right-click and choose Run as administrator[*]Make sure that all the boxes are checked;
[*]Click Run;
[*]A log will be opened after the operation is finished;
[*]Copy and Paste it in your next reply[/list]
Prevention and Future Guidelines
Prevention is better than cure – goes the old saying. As much as we love to see you visit our site, we do not want to see you having your PC infected by malwares again.
[*]Keep Windows up-to-date.
It is extremely important that you keep your operating system (Windows) updated when updates are made available. It is set to alert you, so be sure not to ignore these notices and to allow the updates to install. Many of these are critical security packages which could very possibly be the difference between your picking up a future infiltration and simply passing right by it unharmed.
[*]Run antivirus software and keep it up-to-date, too.
Antivirus software is your safety net if all other protections fail. The first line of defense is smart computing, of course, but everyone needs a backup. Once they’re installed, check periodically to ensure they have been successfully updating as well. An out-of-date antivirus is not a happy antivirus!
[*]Keep your web browser plugins and other programs updated also.
This tip is rarely shared by technicians and its importance is not widely recognized, but it’s absolutely critical. Programs such as Java, Adobe Flash Player and Adobe Reader, Internet Explorer, and myriad other such web-exposed items are deeply vulnerable to attack, which can quickly lead to a hopelessly infected system no matter what protection you currently have installed. The reason is that these programs are ubiquitous, but are also not perfect and are extremely complex… and as such, security vulnerabilities are discovered and exploited by hackers hoping to gain control over your machine. By performing every update for these programs as soon as it’s made available, you will greatly reduce your exposure to dangerous internet threats.
A great way to do this is to install the Filehippo Update Checker and run it regularly. Also, try not to ignore any notifications you receive regarding updates to programs already installed on your PC.
No scripts is an excellent security device too. I like it but it is not for everyone because it requires you to take action if you want to see some things (pop ups, banners etc.) on sites you visit.
Download NoSript by Giorgio Maone.
Note: Sometimes you will get a site telling you that you need to install Java when actually all you need to do is enable the site through the no script icon down on the right hand side of your computer.
[*]Watch out for new threat named CryptoLocker
CryptoLocker is a new type ransomware family malware that encrypts your important files and asks for a ransom to decrypt them. At the moment of posting this reply there are no tools that can undo the havoc this malware causes. We can help you to remove the malware from your system but the files that was encrypted cannot be recovered without the decryption key. So, I ask for your forbearance and practice constant vigilance. Please read the following article to acknowledge yourself about the safety measures.
How to prevent your computer from becoming infected by CryptoLocker.
[*]And last of all, surf smart.
It doesn’t matter how well the autopilot system works if the pilot keeps flying the plane into mountain ranges. Don’t forget that no matter how much you have protecting yourself, your security ultimately begins and ends with you. Don’t visit dangerous or questionable web sites, avoid suspicious links on Facebook and emails/email attachments you’re unsure about, and just generally keep your wits about you, and you’ll be much safer. Also, avoid illegal downloads, cracks, “warez”, and all other too-good-to-be-true internet offerings: they’re typically laden with malware. Be smart and you can avoid most threats lurking about the darker corners of the internet! And for even more tips, see our article, How Did I Get Infected in the First Place?
My help is free but if you feel like making my day you may donate any amount you wish by clicking the ‘donate’ button. I really appreciate your kindness.
https://www.paypalobjects.com/en_US/i/btn/btn_donate_SM.gif
Regards,
Valinorum
Hi this is the Fix txt. But my issue seems to happens again now.
~ Activating UAC … OK
~ Removing disinfection tools …
Deleted : C:\FRST
Deleted : D:\Backup of files on C\BIENOC\Desktop\Fixlog.txt
Deleted : D:\Backup of files on C\BIENOC\Desktop\FRST64.exe
~ Creating registry backup … OK
~ Cleaning system restore …
Deleted : RP #92 [End of disinfection | 08/07/2015 07:28:09]
Deleted : RP #94 [Restore Point Created by FRST | 08/07/2015 10:00:09]
New restore point created !
~ Resetting system settings … OK
########## - EOF - ##########
Attached are the 3 new logs created. Any expert please assist. I have another computer affect with the same virus now its giving me a headache
Attached are the 2 virus i am getting. It is popping up even more frequently now.
Just to be sure, is this a new PC? if you are using any type of file-synchronization software, kindly, turn them off until we are done cleansing your PC. Do you know the following IPs–
[indent]FF Homepage: hxxp://172.30.1.38:1088/bienocmain/
FF NetworkProxy: “http”, “218.186.0.124”
FF NetworkProxy: “http_port”, 2308[/indent]
[*]Step #2 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –
Start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
C:\ProgramData\msolnu.exe
C:\Users\BIENOC\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\BIENOC\AppData\Local\Temp\cdo13680929.dll
C:\Users\BIENOC\AppData\Local\Temp\cdo2870348195.dll
C:\Users\BIENOC\AppData\Local\Temp\cdo3170718075.dll
CMD: bitsadmin /reset /allusers
MD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End
[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt;
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[*]After the completion, a log will be produced;
[*]Copy and Paste the contents of the log in your next reply.[/list]
[*]Step #3 Run Malwarebytes’ Anti-Rootkit
Please download Malwarebytes Anti-Rootkit from here and extract the content to your Desktop.
[*]Update the program if asked.
[*]In the Scan System option check all the boxes and click on Scan.
[*]Click on Cleanup button after the scan and wait patiently. Reboot the computer if asked.
[*]After the clean-up process; locate two logs in the mbar folder namely–
[list][]mbar-log.txt; and
[]system-log.txt[*]Copy and paste the contents of the log in your next reply.[/list]
[quote author=Valinorum link=topic=174786.msg1241525#msg1241525 date=1439138950]
Just to be sure, is this a new PC? if you are using any type of file-synchronization software, kindly, turn them off until we are done cleansing your PC. Do you know the following IPs–
[indent]FF Homepage: hxxp://172.30.1.38:1088/bienocmain/
FF NetworkProxy: “http”, “218.186.0.124”
FF NetworkProxy: “http_port”, 2308[/indent]
Yes. Those IPs are part of my intranet server.
These IPs are known. I am just not sure why this malware is so persistent.
this terminal is the same as the 1 post at start of this thread. i have another terminal getting the same virus.
Hi, attached are the 3 log files from the fix and scans. So far the issue seems to be clear for current pc.
may i check. if i need to clear another computer of the same virus. do i need to open another thread?
Monitor this PC and open a new thread for your other PC. Please, read carefully so that you do not mix the fixes. 
thanks a million Valinorum!
You are a real life saver!
Please, monitor it for 24 hours and report me the result.
noted with thanks. i will monitor for the next 24hrs.
I have created a second thread for my other PC too. thnx
You are welcome.
Hi. i am so ashamed to say the issue is back again
after clearing yesterday, there was no popup of the malware alert after several reboot.
the only loophole i can find is my friend’s thumbdrive where we have been working on a project.
After reboot, the malware returns. I will ask my friend to reformat her thumbdrive.
Attached are the logs. Pardon for the trouble again
Please, remove everything that was detected by Malwarebytes Anti-Malware.
[*]Step #4 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –
Start
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
C:\ProgramData\msolnu.exe
C:\Users\BIENOC\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\BIENOC\AppData\Local\Temp\cdo13680929.dll
C:\Users\BIENOC\AppData\Local\Temp\cdo2870348195.dll
C:\Users\BIENOC\AppData\Local\Temp\cdo3170718075.dll
Removeproxy:
CMD: bitsadmin /reset /allusers
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state on
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
End
[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt;
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[*]After the completion, a log will be produced;
[*]Copy and Paste the contents of the log in your next reply.[/list]
[*]Step #5 Fix with AdwCleaner
[*]Download AdwCleaner by Xplode to your Desktop from the following link.
[list][]Download Link #1
[]Download Link #2
[*]Right-click on AdwCleaner.exe and choose Run as administrator;
[*]Click on Scan and let the program run unhindered;
[*]When done, click on Clean and allow the system to reboot after it is done;
[]A log will be opened automatically after the restart;
[]Attach the log in your reply.[/list]
Re-run FRST64.exe and type the following in the search box:-
msolnu
Click on Search Registry. Post the log when done
[*]Required Log(s):
[]Fixlog.txt
[]FRST Search Log
[*]AdwCleaner Log
Regards,
Valinorum