Malware attack

system · 2014-04-21T10:56:45.000Z

Hi samlemx,
If you still experience avast! alerts, it is normal. Stay with me till the end.

[*]Step #1 Fix with OTL
[*]Re-run OTL by right clicking and choosing Run as administrator;
[*]Under the Custom Scans/Fixes Box copy and paste the following contents inside the code box.

:Commands
[createrestorepoint]

:OTL
IE - HKU\S-1-5-21-2670899690-1136335791-712615611-1000\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80798&lng=en
IE - HKU\S-1-5-21-2670899690-1136335791-712615611-1000\..\SearchScopes\{EF4312C2-87D6-40DE-BDF0-C47FDF81B391}: "URL" = http://websearch.shopathome.com?user_id=%guid&q={searchTerms}
[2014/04/01 18:44:22 | 000,000,064 | ---- | M] () -- C:\Windows\System32\eclydv.own
[2014/04/01 18:44:22 | 000,000,000 | ---- | M] () -- C:\Windows\System32\ulwhr.cso
[2014/04/01 18:27:53 | 000,299,344 | --S- | M] () -- C:\Windows\System32\dxhceav.baq
[2014/04/01 18:27:53 | 000,000,000 | --S- | M] () -- C:\Windows\System32\cdmfnjy.ysk
[2014/04/01 18:27:53 | 000,000,000 | --S- | M] () -- C:\Windows\System32\aaaj.mcg
[2014/04/01 18:55:58 | 000,000,078 | ---- | C] () -- C:\Windows\System32\fkzzesn.pqa
[2013/10/04 18:02:35 | 000,000,000 | -HSD | M] -- C:\Users\Compouter\AppData\Local\Google\Desktop\Install\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\❤≸⋙\Ⱒ☠⍨\<U+202E>ﯹ๛\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\L
[2013/10/04 18:02:35 | 000,000,000 | -HSD | M] -- C:\Users\Compouter\AppData\Local\Google\Desktop\Install\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\❤≸⋙\Ⱒ☠⍨\<U+202E>ﯹ๛\{0e3585e8-09d9-6293-7dbb-44df52dc6ea4}\U
[2009/07/13 23:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

:Commands
[emptytemp]

[*]Click on “Run Fix” and let the program run unhindered;
[]Your PC will reboot automatically and a log will be opened;
[]Please attach it in your next reply.
[/list][/list]

[*]Step #2 Run ComboFix Script
Make sure that you still have Combofix on your Desktop. If not, download it from here.
[list][*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

FCopy::
c:\windows\winsxs\x86_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_6bd245e79c221747\rpcss.dll | c:\windows\System32\rpcss.dll
Reboot::

[list]
[*]Click on File > Save as…
[list][*]Inside the File Name box type CFScript.txt;
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Make sure your security programs are disabled while performing the actions. If you have difficulties, peruse this thread;
[*]Drag CFScript.txt into ComboFix.exe as shown in the screenshot below –

http://users.telenet.be/bluepatchy/miekiemoes/images/CFScript.gif
[/list]
ComboFix will now run a scan on your system. After the scan finishes, it will execute the script and reboot your computer automatically. Don’t reboot your computer manually, let ComboFix do it. Once your computer is rebooted, ComboFix will start preparing a log. Please let it do so unhindered. After a few minutes, it shall produce a log for you. Please attach the C:\ComboFix.txt in your next reply.

[*]Step #3 Scan with Farbar Recovery Scan Tool
[*]Please download Farbar Recovery Scan Tool by Farbar to your Desktop from the link below.
Download link for 32 bit system
Download link for 64 bit system
[*]Right-click on the program and choose Run as administrator;
[*]Put tick-mark on all boxes under Whitelist and Optional Scan;
[*]Click on Scan;
[]After the scan two notepad files will be opened –
[list][]FRST.txt;
[]Addition.txt[]Attach the contents of the logs in your next reply.[/list]

[*]Step #4 Scan with RogueKiller
[*]Download Rogue Killer from one of the suitable links below to your Desktop.
Download link for 32 bit system
Download link for 64 bit system
[*]Let the pre-scan finish. After that click on Scan;
[*]The scan won’t take long;
[*]A log has been created on your Desktop;
[*]Attach the content of the log in your next reply.

[*]Required Log(s):
[]OTL Fix Log;
[]ComboFix Log;
[]Farbar Recovery Scan Tool Log(s)–
[list][]FRST.txt;
[]Addition.txt
[]RogueKiller Report
[/list]

Regards,
Valinorum

system · 2014-04-21T22:49:07.000Z

Hi Valinorum,
Thank you for the post. Sorry for my delay. Trying to do this after work and the PC was running pretty slow. I did know the reference to being a “Mentee”

Per your request, I have attached the logs produced by the various programs. 4 attachments on this one, since that is the max, I will have another post.

Just to note, Avast has stopped going crazy with blocking those connections and the PC does seem to be running smoother, or I have just adapted to it’s slowness. It looked like Rogue Killer picked up on some items though. Let me know where to go next.

Thanks,
Sam

system · 2014-04-21T22:49:44.000Z

Rogue Killer log.

Thanks,
Sam

system · 2014-04-22T04:45:08.000Z

Hi,
I have submitted my fix to an Expert here and will post here after his approval. Thank you for your patience.

system · 2014-04-22T13:00:00.000Z

Hi samlemx,

We have one more big fish to fry.

[*]Step #5 Fix with RogueKiller
[*]Re-run RogueKiller. If you do not have it on your Desktop download it from the suitable link below.
Download link for 32 bit system
Download link for 64 bit system

[*]Let the pre-scan finish. After that click on Scan and wait for the scan to finish;
[*]Click on Delete;
[*]Now again click on Scan and wait for the scan to finish;
[*]Click on Report and a log file will open;
[*]Attach the report in your next reply.

[*]Step #6 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

Start
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
C:\Windows\system32\fkzzesn.pqa
C:\Windows\system32\eclydv.own
C:\Windows\System32\ulwhr.cso
C:\Windows\System32\dxhceav.baq
C:\Users\Compouter\AppData\Local\Google\Desktop\Install
End

[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
[*]Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[]After the completion, a log will be produced;
[]Attach the log in your next reply.[/list]

[*]Required Log(s):
[]RogueKiller Report;
[]FRST Fix Log

Regards,
Valinorum

system · 2014-04-22T21:01:57.000Z

Hi Valinorum,
I have attached the reports you requested. It looks like Rogue Killer cleaned up it’s findings. Avast has been quiet too. I know an absence of symptoms doesn’t mean it is in the clear, but it is certainly behaving better. Thank you again for your help. I have to ask, does it annoy you that this PC’s name is “compouter”? It sure bugged me when I first started working on this. ;D

Thanks,
Sam

system · 2014-04-22T21:23:00.000Z

How is your system running? I have seen weird usernames.

system · 2014-04-22T21:31:14.000Z

Compared to how it was when I started with it, it is running much smoother. I tried to create a folder 2 days ago to try and keep my logs organized and that took a couple of minutes after I right clicked just for the menu to come up. Now it takes a few seconds. I can also open and minimize IE without it being sluggish too. The last thing I want to do is give it a restart, since I left it on last night so I didn’t lose that Rogue Killer website that came up about what it found. I kind of stole the computer for stuff I needed to do before restarting though

system · 2014-04-22T21:36:40.000Z

Hi,
We are almost done. I have submitted my fix for you to an expert for his approval and will post it here afterwards. Thank you for your patience.

system · 2014-04-23T14:36:25.000Z

Hi samlemx,

[*]Step #7 Scan with Malwarebytes’ Anti-Malware
[*]Download Malwarebytes’ Anti-Malware from the suitable link below –
[list][]Download Link #1
[]Download Link #2
[]Download Link #3
[*]Double-click mbam-setup.exe to install the application.
[*]Before clicking Finish perform the following actions –
[*]Un-check the box beside Enable free trial of Malwarebytes Anti-Malware Premium.
[*]Check the box beside Launch Malwarebytes Anti-Malware
[*]Once the program has loaded, The MBAM dashboard will appear with an alert to update - click the green button Update Now;
[*]Click on Setting–
[*]Navigate to the tab Detection and Protection and check all the boxes under Detection Options
[*]From the Dashboard click on Scan Now;
[*]If threats are detected click on Apply actions. If the program asks to reboot your PC, let it do so;
[*]On completion of the scan click on View Detailed Log after that click on Export Button, select Text File and save the log to your Desktop;
[]Attach the log in your next reply.[/list]

[*]Step #8 ESET Online Scanner
Disable your security programs which includes but not limited to anti-virus, anti-malware, anti-spyware et cetera. Peruse this for additional information.
[*]Go here from Internet Explorer and click on Run ESET Online Scanner.
[list][*]Note: If you use any browser other than Internet Explorer, you will have to download and install esetsmartinstaller_enu.exe when prompt to run the scan.
[*]Accept their terms and condition and proceed.
[*]Install Add-On/Active X if prompted.
[*]From the Computer Scan Setting –
[*]Uncheck the box beside Remove Found Threats;
[*]Check the box beside Scan archives
[*]Click on Advanced Setting and check the following boxes–
[*]Scan for potentially unwanted applications
[*]Scan for potentially unsafe applications
[*]Enable Anti-Stealth Technology
[*]Click on Start and wait for the virus signature database to update.
[*]The online scan will begin automatically and can take several hours.
[*]Note: Do not touch either the Mouse or keyboard during the scan. Otherwise it may stall.
[*]After the Scan finishes –
[*]If no threats were found:
[list][*]Put a checkmark in Uninstall application on close.
[*]Close the program and report that nothing was found
[*]If threats were found:
[*]Navigate to the log file located at C:\Program Files\ESET\ESET Online Scanner\log.txt (32-bit) or C:\Program Files (x86)\ESET\ESET Online Scanner\log.txt (64-bit).
[*]Attach the log file in your next reply.[/list][/list]
Note: Enable your security programs afterwards.

[*]Required Log(s):
[]MBAM Log;
[]ESET Scan Log

Regards,
Valinorum

system · 2014-04-24T10:08:14.000Z

Hi Valinorum,
That last scanner took quite awhile, 6 hours, and it found some more items. Doing this before work this time so I have to be quick ;D Here are my logs. As always, thanks much!

Thanks,
Sam

system · 2014-04-24T14:50:53.000Z

Can you re-attach the ESET log? The log you have attached does not contain any data.

system · 2014-04-24T23:15:19.000Z

uh oh! That was the log that was in my C Drive. Luckily, I kept that window open and it allows me to export the items it found, so try this one. Sorry about that.

Thanks,
Sam

system · 2014-04-25T04:54:56.000Z

Submitted my fix for an expert’s approval. Thank you for your patience.

system · 2014-04-25T11:42:44.000Z

Hi samlemx,

Remove Windows.old by perusing this.

[*]Step #9 Fix with FRST
Make sure that you still have FRST.exe on your Desktop. If you do not have it, download the suitable version from here to your Desktop.
[*]Open Notepad.exe. Do not use any other text editor software;
[*]Copy and Paste the contents inside the code-box to your Notepad –

Start
C:\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll
C:\ProgramData\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setupx.dll
C:\Users\All Users\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll
C:\Users\All Users\Tarma Installer\{DA00D550-BB91-4A26-AAE5-9172D626CAAE}\_Setupx.dll
C:\Users\Compouter\Downloads\ArcadeCandyGames.exe
End

[*]Click on File > Save as…
[list][*]Inside the File Name box type fixlist.txt
[*]From the Save as type drop down list, choose All Files
[*]Save the file to your Desktop;
[*]Re-run FRST.exe and click Fix;
[*]Note: If FRST advises there is a new updated version to be downloaded, do so/allow this.[]After the completion, a log will be produced;
[]Attach the log in your next reply.[/list]

[*]Required Log(s):
[*]FRST Fix Log

Regards,
Valinorum

system · 2014-04-25T22:26:23.000Z

Hi Valinorum,
This is a long process when I only get to work on it between 4pm and 8pm every day I have attached my FRST log, even verified it has data first. Let me know where to go from here.

Thanks,
Sam

system · 2014-04-26T04:26:09.000Z

How is your system running?

system · 2014-04-26T14:06:45.000Z

It is a bit slow. Some of the bigger programs load real slow, like Skype, yahoo messenger, and IE. Others like notepad and calculator come up pretty quick. When right clicking, sometimes that menu comes up pretty quick, sometimes that is slow too. Not sure if that is because the PC is getting older though.

Thanks,
Sam

system · 2014-04-26T14:43:26.000Z

Not a malware issue. Perusing your logs, I see no infection currently present in your system. The machine appears to be Malware-free as we speak.

Removal of Tools and Quarantined Files

Despite the tools we have used are clean, they are powerful removal tools and made in a way so that they carry out any commands given to them without (most cases) asking for a confirmation. In the hands of an inept person, they can make the machine un-bootable – a scenario we do not wish to see. Also, we need to remove the quarantined files/folders from your system as a dormant malware can be as bad as an active one if given the proper environment. I shall now give you the guidelines to remove the tools and the quarantined files from your system.

It is time to uninstall Combofix. Please follow the instructions:

[*]Click on the Start button (
http://www.bleepstatic.com/start-buttons/windows-7.jpg
) and then in the Search field enter combofix /uninstall, as shown in the image below with the blue arrow. Please note that there is a space between combofix and /uninstall.

http://www.bleepstatic.com/combofix/en/windows-7-start-menu.jpg

[*]Once you have typed this in, press Enter on your keyboard.
[*]A Open File security warning will appear asking if you are sure you want to run ComboFix. Please click on the Run button to start the program.

ComboFix will now uninstall itself from your computer and remove any backups and quarantined files. When it has finished you will be greeted by a dialog box stating that ComboFix has been uninstalled. You can now delete the ComboFix.exe program from your computer. ComboFix has now been uninstalled from your Windows Vista or Windows 7 computer.

[*]Cleanup with Delfix
Please download DelFix by Xplode to your Desktop.
Download Link
[*]Double-click to run the program;
[list][*]Note: Windows Vista/7/8 users right-click and choose Run as administrator[*]Make sure that all the boxes are checked;
[*]Click Run;
[*]A log will be opened after the operation is finished;
[*]Copy and Paste it in your next reply[/list]

Prevention and Future Guidelines

Prevention is better than cure – goes the old saying. As much as we love to see you visit our site, we do not want to see you having your PC infected by malwares again.

[*]Keep Windows up-to-date.
It is extremely important that you keep your operating system (Windows) updated when updates are made available. It is set to alert you, so be sure not to ignore these notices and to allow the updates to install. Many of these are critical security packages which could very possibly be the difference between your picking up a future infiltration and simply passing right by it unharmed.
[*]Run antivirus software and keep it up-to-date, too.
Antivirus software is your safety net if all other protections fail. The first line of defense is smart computing, of course, but everyone needs a backup. Once they’re installed, check periodically to ensure they have been successfully updating as well. An out-of-date antivirus is not a happy antivirus!
[*]Keep your web browser plugins and other programs updated also.
This tip is rarely shared by technicians and its importance is not widely recognized, but it’s absolutely critical. Programs such as Java, Adobe Flash Player and Adobe Reader, Internet Explorer, and myriad other such web-exposed items are deeply vulnerable to attack, which can quickly lead to a hopelessly infected system no matter what protection you currently have installed. The reason is that these programs are ubiquitous, but are also not perfect and are extremely complex… and as such, security vulnerabilities are discovered and exploited by hackers hoping to gain control over your machine. By performing every update for these programs as soon as it’s made available, you will greatly reduce your exposure to dangerous internet threats.

A great way to do this is to install the Filehippo Update Checker and run it regularly. Also, try not to ignore any notifications you receive regarding updates to programs already installed on your PC.

No scripts is an excellent security device too. I like it but it is not for everyone because it requires you to take action if you want to see some things (pop ups, banners etc.) on sites you visit.

Download NoSript by Giorgio Maone.

Note: Sometimes you will get a site telling you that you need to install Java when actually all you need to do is enable the site through the no script icon down on the right hand side of your computer.

[*]Watch out for new threat named CryptoLocker
CryptoLocker is a new type ransomware family malware that encrypts your important files and asks for a ransom to decrypt them. At the moment of posting this reply there are no tools that can undo the havoc this malware causes. We can help you to remove the malware from your system but the files that was encrypted cannot be recovered without the decryption key. So, I ask for your forbearance and practice constant vigilance. Please read the following article to acknowledge yourself about the safety measures.
How to prevent your computer from becoming infected by CryptoLocker.

[*]And last of all, surf smart.
It doesn’t matter how well the autopilot system works if the pilot keeps flying the plane into mountain ranges. Don’t forget that no matter how much you have protecting yourself, your security ultimately begins and ends with you. Don’t visit dangerous or questionable web sites, avoid suspicious links on Facebook and emails/email attachments you’re unsure about, and just generally keep your wits about you, and you’ll be much safer. Also, avoid illegal downloads, cracks, “warez”, and all other too-good-to-be-true internet offerings: they’re typically laden with malware. Be smart and you can avoid most threats lurking about the darker corners of the internet! And for even more tips, see our article, How Did I Get Infected in the First Place?

Regards,
Valinorum

system · 2014-04-26T14:57:22.000Z

I didn’t think it was a malware issue. As for keeping the computer safe, I can only do so much since this is not my PC, but I will definitely talk with the owner and make note of the things you mentioned, on top of keeping that info for my own notes. A big thank you to you for all the help you have given me in getting this PC cleaned up. I really appreciate it.

Thanks,
Sam

Announcements