Hello, this is my second time in forums, sorry if I put this post in the wrong place.
Yesterday my computer was (probably) infected by a virus. Avast was continuously showing popups of web shield from different files from Windows\system32 (msiexec.exe, msdtc.exe, ctfmom.exe, presentationhost.exe, avastsvc.exe…) trying to redirect to http:/xmlka.com/… or something similar. The computer collapsed and took a lot of time doing everything. A lot of programs started in “hidden mode” and I couldn´t stop them. This includes Skype, notepad, and more than 10 tasks at a time. Avast was active during all this time but, suddenly, windows informed me that “no antivirus was running”!, and a second later Avast was running againg. Iexplorer history of the day showed a lot of strange pages I didn’t visit. Avast was saying “everything is ok”, but I didn’t believe a word of it…It seemed like someone took control of my computer. I shut down the wifi connection and the situation calmed, but whenever I connected again the “virus” started again…
I run a “smart scan” (Avast), found some things, I’m not sure if it could clean but the problems remain. Today, I run adwcleaner and found something, but I think it missed the big one, too. Attached the report. After this I run Malware bytes and found more serious things, I think. I did something wrong and the txt report was empty but I could save 2 .xlm files, saved as txt and attached. I run again (probably shouldn’t) and everything was clean (I attach the second report plus a “history of the day”).
I also run FRST and aswMBR.exe, cannot attach the reports (max 4 files), I’ll try it later.
I hope everything is fine in the computer now (so it seems), but I am not sure. I would like to confirm it (if confirmation of cleanliness is possible in such a case).
Does anybody can help me?
Thank you in advance!
Pondus
March 19, 2015, 8:06pm
2
Hello, this is my second time in forums, sorry if I put this post in the wrong place.
you did correct ;)
I also run FRST and aswMBR.exe, cannot attach the reports (max 4 files), I'll try it later.
Then you just reply to this post and attach them in your reply ;)
This is very easy, thank you Pondus!
Pondus
March 19, 2015, 8:38pm
4
Now you wait for Essexboy …he should be online soon
Hi before we proceed I would like to check out the MBR
Download the latest version of TDSSKiller from here
[*]Doubleclick on TDSSKiller.exe to run the application
https://dl.dropbox.com/u/73555776/tdss%20start.JPG
[*]Then click on Change parameters .
https://dl.dropbox.com/u/73555776/tdss%20Change%20param.JPG
[*]Check the boxes beside Verify Driver Digital Signature, Detect TDLFS file system and Use KSN to scan objects , then click OK.
[*]Click the Start Scan button.
[*]If a suspicious object is detected, the default action will be Skip , click on Continue .
https://dl.dropbox.com/u/73555776/tdss%20threat.JPG
[*]If malicious objects are found, they will show in the Scan results and offer three (3) options.Cure is selected, then click Continue => Reboot now to finish the cleaning process.
[*]Get the report by selecting Reports
https://dl.dropbox.com/u/73555776/tdss%20report.JPG
[*]Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
Please copy and paste its contents on your next reply.
Done! only one medium threat…
The message exceeds 20000 characters, attached .txt file…
22:15:19.0821 0x111c TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
[…, see attached file]
22:17:24.0271 0x0f30 WindowsWelcomeCenter - ok
Thank you, could you let me know what problems you are having after this
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
2015-03-18 21:47 - 2015-03-19 14:44 - 00000000 ___HD () C:\ProgramData\{49A0BAC7-3326-4433-9373-4AA8793ABB5C}
2015-03-18 21:47 - 2015-03-18 21:47 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
CustomCLSID: HKU\S-1-5-21-3125687505-42030154-949934000-1000_Classes\CLSID\{F7117AE6-81F2-45B8-96EE-56F6FD357A48}\InprocServer32 -> C:\ProgramData\{49A0BAC7-3326-4433-9373-4AA8793ABB5C}\neth.dll No File
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt , in the same location as FRST.exe
https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG
Run FRST and press Fix
Actually, the computer is running fast and smooth. No strange active tasks. Everything seems ok. I’m usually cautious, but I feel happy.
Here goes the fixlog.txt
OK if you can use it as normal and if all is well tomorrow I will tidy up
Thank you, Essexboy! I was totally lost and now I see the ligth, amazing community here. Thanks everybody again.
