Hi guys,
When I wake up this morning my computer runs strange.
1)My ZoneAlarm firewall says me “blabalgroup wants to run every on computer starts”
2)My ZoneAlarm firewall says me “it wants to edit registery”
3)Later it appers on my taskbar!
4)I run scan 2 times + rootkit remove
5)I searched my HD and found 2 folder who had .dll or .exe at their ends. (Also folder is hidden)
I don’t know what to do HELP!
Follow instructions http://forum.avast.com/index.php?topic=53253.0
Attach logs (not copy and paste) Malwebytes / OTL / aswMBR
Malwarebytes didn’t find anything.
Hi,
1)My ZoneAlarm firewall says me "blabalgroup wants to run every on computer starts" 2)My ZoneAlarm firewall says me "it wants to edit registery"
This may be legit action as well. Let’s start with ComboFix to see where will that lead us.
Instructions how to disable avast:
[*]Right click on the avast! system tray icon (
http://www.mcshield.net/pg/images/avast5.png
) in the lower right corner of the screen and scroll up to avast! shield controls;
[*]In the menu that appears, choose Disable Permanently. When you are prompted to turn off security, click Yes.
Note: Do not forget to turn back on this option after the cleaning by choosing avast! shield controls > Enable all shield options.
[i][size=7pt]- ComboFix will display DISCLAIMER of warranty on software.
By clicking I Agree ComboFix shall continue.
It took 2 minute to give premissions then the program arrives at “Stage_4” computer frozen!+ when I boot there is no .txt or .exe at end of files (later I
fixed)
Note:My cmd is dead. Looks like it “forget” some words.
Hi,
Please delete old ComboFix (drag & drop icon into RecycleBin) and download new, fresh copy of CF.
Note: Combofix must be located on your Desktop!
[*] Click Start (or
http://amf.mycity.rs/pg/images/VistaStartButton.png
) then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
[*] In the line of text type in (Copy) the following:
"%userprofile%\Desktop\ComboFix.exe" /KillAll
[size=7pt]
[*] then click OK (or press Enter ).
ComboFix should re-run. Please attach here created CF log.
It made it to Stage_50 then it frozen while deleting 1st file (assembely) tmp ??
I have OTL and aswMBR logs if you want I really can’t do with this program.
Hm…when CF does not wanna work then we must use the alter tools. First, fix with OTL and then re-check with mighty FRST.
Re-run OTL.exe.
[*]Copy and paste the following text written inside of the quote box into the Custom Scans/Fixes box.
:OTL
O3 - HKU\S-1-5-21-1327276646-4194761679-295217087-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O33 - MountPoints2\{29a20beb-be12-11e1-ae23-2c27d7d97151}\Shell - "" = AutoRun
O33 - MountPoints2\{29a20beb-be12-11e1-ae23-2c27d7d97151}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ac80a0d5-fd73-11e1-b5ab-2c27d7d97151}\Shell - "" = AutoRun
O33 - MountPoints2\{ac80a0d5-fd73-11e1-b5ab-2c27d7d97151}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ccd33146-bdd2-11e1-9bf9-cc52afa242ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ccd33146-bdd2-11e1-9bf9-cc52afa242ad}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{ccd33154-bdd2-11e1-9bf9-cc52afa242ad}\Shell - "" = AutoRun
O33 - MountPoints2\{ccd33154-bdd2-11e1-9bf9-cc52afa242ad}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{f98faa19-c211-11e1-bc17-2c27d7d97151}\Shell - "" = AutoRun
O33 - MountPoints2\{f98faa19-c211-11e1-bc17-2c27d7d97151}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{faab380d-ac01-11e2-aa96-2c27d7d97151}\Shell - "" = AutoRun
O33 - MountPoints2\{faab380d-ac01-11e2-aa96-2c27d7d97151}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2012.08.01 11:21:05 | 000,000,000 | ---D | M] -- C:\Users\Batu\AppData\Roaming\MediaMonkey
:COMMANDS
[EMPTYTEMP]
[*]Then click the Run Fix button at the top.
[*]Let the program run unhindered; it will reboot the system when it is done and open notepad with logreport. Attach here that logreport.
If the log doesn’t appear, it can be found here:
c:_OTL\MovedFiles\mmddyyyy_hhmmss.log
Please download Farbar Recovery Scan Tool (
http://www.mcshield.net/personal/magna86/Images/FRST_canned.png
) by Farbar and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.
[*]Double-click to run it. When the tool opens click Yes to disclaimer.
[*]Under Optional Scan ensure “Driver MD5” are ticked.
[*]Press Scan button.
[*]It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
[*]The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Logs
1. Open notepad and copy/paste the text present inside the code box below.
To do this highlight the contents of the box and right click on it. Paste this into the open notepad.
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system
Start
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKCU\...\Policies\Explorer: [NoLogoff] 0
U3 ag06c0rk; No ImagePath
U3 DfSdkS;
CMD: DEL %TEMP%\*.* /F /S /Q
End
2. Save notepad as fixlist.txt to your Desktop.
NOTE: => It’s important that both files, FRST and fixlist.txt are in the same location or the fix will not work.
3. Run FRST/FRST64 and press the Fix button just once and wait.
If the tool needed a restart please make sure you let the system to restart normally and let the tool completes its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach it to your reply.
Note: If the tool warned you about the outdated version please download and run the updated version.
====== Next ======
Download TDSSKiller and save it to your desktop
Execute TDSSKiller.exe by doubleclicking on it.
Confirm “End user Licence Agreement” and “KSN Statement” dialog box by clicking on Accept button.
[*]Under Additional options check the boxes next to:
- Verify Driver Digital Signature;
- Detect TDLFS file system
- Use KSN to scan objects
[*] Press Start Scan
[*] If Suspicious object is detected, the default action will be Skip, click on Continue.
[*] If Malicious objects are found, select Cure.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt
Please post the contents of that log in your next reply.
Logs
This is clean PC now. Any other issue?
There is no warnings poping up and computer runs normal
Thanks!
Good workman always cleans up after himself.
• The following will implement some post-cleanup procedures:
=> Please download DelFix by Xplode to your Desktop.
Run the tool and check the following boxes below;
[i]
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Remove disinfection tools
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Create registry backup
http://www.mcshield.net/personal/magna86/Images/checkmark.png
Purge System Restore [/i]
Click Run button and wait a few seconds for the programme completes his work.
At this point all the tools we used here should be gone. Tool will create an report for you (C:[b]DelFix.txt[/b])
The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.
Logs