Please help with a stubborn virus

Hello,

AVAST reports that the virus LNK:Jenxcus-M has infected my ntuser.dat.log files. When I select the fix option, it says that it will handle it on the next boot, but the problem doesn’t go away. I don’t think this is a false positive, because the machine runs more slowly than usual. The scan on Malwarebytes (free version) did not reveal a problem.

Any help would be greatly appreciated!

see instructions here https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and Farbar Recovery Scan Tool logs

have you used a USB stick/drive lately that have been inserted in another machine?

I used a USB flash drive to transfer some photos. I don’t know if that was the culprit or not. The logs are attached. Thanks.

Not a false positive, but real

Could you uninstall YAC (yet another cleaner ) please

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-4006700494-1004150182-100131720-1002\...\Run: [AdopeFlash] => C:\Google\AutoIt3.exe [750320 2003-10-25] (AutoIt Team) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-4006700494-1004150182-100131720-1002 -> {C0220B26-F5DB-4F4F-9EA5-AC6C848590BA} URL = Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2015-01-05] (Elex do Brasil Participações Ltda) S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2015-01-05] (Elex do Brasil Participações Ltda) R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2015-01-05] (Elex do Brasil Participações Ltda) R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [42152 2015-01-05] (Elex do Brasil Participações Ltda) R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-01-05] (Elex do Brasil Participações Ltda) R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-01-03] (Elex do Brasil Participações Ltda) 2015-01-05 10:16 - 2015-01-05 10:16 - 00001926 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\YAC.lnk 2015-01-05 10:16 - 2015-01-05 10:16 - 00001920 _____ () C:\Users\Public\Desktop\YAC.lnk 2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\Users\Bruce\AppData\Roaming\Elex-tech 2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC 2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\Program Files (x86)\Elex-tech 2015-01-05 10:16 - 2015-01-05 09:16 - 00045224 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeKrnlBoot.sys 2015-01-05 10:16 - 2015-01-03 03:57 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeNetFilter.sys 2015-01-05 10:14 - 2015-01-05 10:14 - 00729256 _____ (Elex do Brasil Participações Ltda) C:\Users\Bruce\Downloads\yet_another_cleaner_sk_1054473.exe 2015-01-05 10:14 - 2015-01-05 10:14 - 00000000 ____D () C:\Users\Bruce\AppData\Roaming\eCyber Task: {5AEDF8CE-06D6-449F-A7F2-8CEC8C72F932} - \Tempo Runner coz64host No Task File <==== ATTENTION C:\Google EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

FINALLY TO CLEAN THE USB

Download MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives

https://dl.dropbox.com/u/73555776/mcshield%20unhide.JPG

Plug in the drive and McShield will start a scan

Then get the log which will be located under the logs tab on the main page

And post that

I used a USB flash drive to transfer some photos.
all machines that usb stick/drive has been plugged in to are most likely infected .... you may tell the owner

they may ask for cleaning help here :wink:

The fixlog.txt is attached. I was able to follow these instructions up to the adwcleaner scan. That program said it had run into problems and had to reboot the computer. It referenced IRQL_NOT_LESS_OR_EQUAL as the apparent reason that it could not continue. How should I proceed from here? Thanks.

continue with next program …

OK. Here’s the other scan log.

MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

v 3.0.5.28 / DB: 2014.12.28.1 / Windows 8.1 <<<

1/5/2015 2:18:27 PM > Drive C: - scan started (OS ~452 GB, NTFS HDD )…

=> The drive is clean.

1/5/2015 2:18:28 PM > Drive E: - scan started (no label ~3887 MB, FAT32 flash drive )…

=> The drive is clean.

We will replace the Adwcleaner programme with a similar one. How is the computer behaving now ?

Please download Junkware Removal Tool to your desktop.

[]Right-mouse click JRT.exe and select “Run as Administrator” the tool will open and start scanning your system
[
]please be patient as this can take a while to complete depending on your system’s specifications
[]On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
[
]post the contents of JRT.txt into your next message.

I think that solved the problem! Computer seems to be okay now.

Here’s the log.

Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 x64
Ran by Bruce on Mon 01/05/2015 at 14:59:22.34



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Bruce\appdata\local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio



~~~ Event Viewer Logs were cleared





Scan was completed on Mon 01/05/2015 at 15:07:16.61
End of JRT log


Thanks a ton. I would love to buy you a pint.

Hi Essexboy,

Pondus messaged me to check back with you today, so that you could remove the tools used in the cleaning process. Computer is working normally again. THANK YOU!

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Remove tools

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select Remove Java Runtime. Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version

https://dl.dropboxusercontent.com/u/73555776/javara.JPG

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme :wink:

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

I have followed all your advice, and everything looks good. Thanks again. :slight_smile:

One last question, What should I do with the infected files that Avast quarantined. Is it safe to delete them?

One last question, What should I do with the infected files that Avast quarantined. Is it safe to delete them?
let them stay for a week or two, if no ill effect .... delete

OK. Thanks.