URL:Mal Infection

Viruses and worms
1

Hello,

I too have been hit by the URL:Mal Infection. hxxps://188.165.198.52 URL:Mal C:\Windows\explorer.exe. I have admittedly tried to eliminate the issue over the last couple days on my own. I have used nearly every program, scanner etc. Strangely enough, after following instructions to post the necessary logs here, the popup message has changed to the xmlka.com variety. I like many others am at my wits end and ready to wipe the machine. I would appreciate any assistance provided. I have attached the necessary logs. Thank you in advance.

Edit: The pop up has returned to the hxxps://188.165.198.52 URL:Mal.

2
I like many others am at my wits end and ready to wipe the machine.
No need for that, essexboy or somone from the removal team will remove it when they are online....may take a couple of hours
3

Let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

2014-10-19 22:21 - 2014-10-19 22:21 - 00000000 _____ () C:\Windows\system32\kvaqzr.dll 2014-10-18 15:49 - 2014-10-18 15:49 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2014-10-21 19:41 - 2009-07-14 01:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-10-18 15:49 - 2014-09-10 08:51 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 CustomCLSID: HKU\S-1-5-21-1960636888-259027640-1386876136-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\mpr.dll (Microsoft Corporation) C:\ProgramData\9rEcGKR.reg EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S1].txt as well.

4

The popups seem to have stopped for the moment. I do feel something is still present on the machine based on its behavior. IE seems almost inoperable and is acting very sketchy. Attached are the logs from the fix session. Thank you for your assistance thus far, it is greatly appreciated!

Edit: Very shortly after posting the pop ups returned, please advise.

5

OK lets see if we can determine where it is hiding

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

[*]Double click on ComboFix.exe & follow the prompts.
[*]Accept the disclaimer and allow to update if it asks

http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png

http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png

[*]When finished, it shall produce a log for you.
[*]Please include the C:\ComboFix.txt in your next reply.

Notes:

  1. Do not mouse-click Combofix’s window while it is running. That may cause it to stall.
  2. Do not “re-run” Combofix. If you have a problem, reply back for further instructions.
  3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

6

Greetings,

I ran combofix as directed, it ran very slowly but did not delete anything when completed, or when the box was rebooted. Popups started immediately upon booting to desktop. The box remains sluggish, IE will not allow me to travel to many sites in my favorites, google, twitter etc. I’m able to surf freely using chrome. I have no clue if this is related, but I did note that under my computer, devices with removable storage, I have drives E, F, G, H which I do not recall being there (unless the onboard card reader is the reason). I have no thumb drives or externals attached, so I found this to be odd. Attached you will find the requested log. Awaiting your next move.

Thanks again,

7

Could you uninstall Trojan remover please and run a fresh FRST scan

8

Fresh scan logs attached. I have yet to see a pop up since I removed that program. Box still sketchy and IE still very abnormal.

Thank You,

9

We may need to reset IE, what do you mean by sketchy ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

2014-10-21 23:43 - 2014-10-30 12:25 - 00000000 ___HD () C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} Task: {93B4E263-423B-4090-84EF-EFFB5F77A5F0} - \WPD\SqmUpload_S-1-5-21-1960636888-259027640-1386876136-1004 No Task File <==== ATTENTION EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

10

Hello,

Thanks for the quick reply, sketchy means that the machine is hanging and seems sluggish, a lot of noise from HD. It does appear that the pop ups are gone (fingers crossed), I do still have issues with IE being unable to load pages. Was this the primary target? Attached is the requested log.

As always, thank you for your time.

11

What sort of noise are you getting from the HD is it a ticking/clicking noise ?

12

No I wouldn’t classify it as that, it’s more of a normal data transfer sound, only louder and ever present.

13

Like this http://www.youtube.com/watch?v=Qc_cGuhILow&feature=youtu.be

14

Yep, that was the noise.

15

That is the sound of a hard drive on its last legs. I would recommend that you back up your data now

16

Yikes, I hope that’s not the case, this HD is less than a year old. However, everything seems to be back to normal, including the noise, with the exception of IE, do you suggest anything there? I will put the box through its paces and report back if anything out of the ordinary happens.

I truly appreciate all of your hard work,

17

In that case I would still back up your data the MTF for hardrives is theoretically measured in the decades however, that is just the mean http://en.wikipedia.org/wiki/Hard_disk_drive_failure

18

Been a few days since I last posted, work has me running in circles. I did a quick back up of my important files, but the HD seems back to normal with no excessive noise. I also reset the IE settings and that is also working like a charm, even though I switched over to chrome full time. I think the box is in the clear.

Just wanted to take a moment to check in and thank you for your time, it’s rare to receive such excellent support these days.

19

OK that is weird, but then computers always are :slight_smile:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Click Start then Run.
On Windows7 or Vista you may use Start Search field if Run is not available.
In the box copy/paste the following command:

ComboFix /Uninstall

Note that there is a space between " ComboFix " and " /Uninstall " .

Then click OK (or press Enter ).
Wait for the uninstall process to complete.

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave: