Whistler@mbr Rtk - Revisited. Malwarebytes does not find.

Viruses and worms
1

Hey there.

Been reading this forum quite a bit, and gotten some good help.

I recently got a find on my computer to “Whistler@mbr rtk” same as this topic: http://forum.avast.com/index.php?topic=69767.0 I encountered the same problems - Avast couldn’t do anything about it so I tried the MWB program to get rid of it.

The odd thing is though, that Malewarebyes can’t find the trojan! I first did a quickscan (as instructed) with no results, and then a full scan (with no results)

Is this a false positive, or is is some demonic business going on in my hard drive?

2

Can you find the original file showing as infected?
Can you upload it to www.virustotal.com?

3

I dont think Malwarebytes detect whistler

if you use the forum search for “whistler” you find many cases, and they all needed Essexboy to clean this

I send him a PM, you find him here tomorrw 08:00pm - 11:59pm UK time

4

Alright.

For some reason I managed to think that MBRcheck.exe was the same as Malwarebytes, don’t ask me how - brainfart ;D

I did the MBRcheck and it detected Whistler.

I’ve attached the logfile. Then - what now?

Thanks for the aid, I am not gonna step into the dark and try for myself on this one!

5

[quote]I’ve attached the logfile. Then - what now?[quote]
waite for Essexboy…

6

This latest variant can be a bit of a pain - once you have rebooted wait for 5 minutes or so and then rerun MBRCheck to confirm that it has gone please

[*]Run MBRCheck.exe
[*]Wait until you see the following line: Enter ‘Y’ and hit ENTER for more options, or ‘N’ to exit:
[*]Please push the ‘Y’ key and then press Enter
[*]When program ask you Enter your choice: enter 2 and press the Enter key
[*]Now the program will ask you “Enter the physical disk number to fix (0-99, -1 to cancel):”
[*]Enter 0 and press the Enter key.
[*]The program will show Available MBR codes:, followed by a list of operating systems. Please enter [ 5] Windows 7, and then press Enter.
[*]The program will prompt for confirmation. Type YES and press Enter (Must type the full word, YES). You will be informed if successfully wrote a new MBR code!
[]A text file will be saved to your desktop
[]Paste that report into your next post
[*]Restart your PC.

.
THEN

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%*. /mp /s
CREATERESTOREPOINT

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

7

Post 1/2

OTR log

8

Post 2/2

Extras
Mbrcheck

The files were too big together - sorry.

9

Hmm the latest variant - drat

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

[]Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
[]Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

10

Hehe… This is turning interesting!

Combofixlog added.

I am curious - if its not overly complicated; why can’t Avast! remove whistler if it can detect it?

11

Hm combofix is not detecting it - mayhap MBRcheck did fix it

Avast can now detect this I believe, but they may be working on a solution to fixing it. However, the problem is that there are a huge variety of legitimate MBR configurations and the right one needs to be inserted

Could you run MBRcheck one more time, just a scan run, and post the log. Also what other problems are you experiencing

12

It seems mbr is still finding it if I am not wrong?

I am not having any problems actually. Only have a slight issue starting the computer when its comiing from hibernation, where I have to press the power-button twice - though thats been there since I reinstalled W7 so I reckon its a driver I have forgotten to install.

Other than that the computer is working fine, and I have not seen any difference in the preformance since the last time I scanned and didn’t have trojan…

13

did you re-run MBRCheck after the reboot ?

14

I have been rebooting and scanning as prompted… Which reboot are you referring to?

15

On the last MBR run where you repaired the MBR

Lets see if the Avast tool can detect it - if it finds nothing and you are happy we will clean you up and remove my tools

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR1.png

Click the “Scan” button to start scan

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR2.png

Click the “Fix” in case of infection

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR3.png

Save the aswMBR.log to the desktop and post that

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR4.png

16

Good evening

Seems like it found no infections!

Does that mean I am free? ;D

17

More to the point I feel - how is your system running - any residual problems ?

18

Sorry for late reply, been out with flu

I can’t say I really had any problems along the way at all. The computer is running quite perfectly actually…

19

In that case lets tidy you up

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands [resethosts] [purity] [emptytemp] [EMPTYFLASH] [Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself. MBAM can be uninstalled via control panel add/remove along with ERUNT. But they may be useful tools to keep

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

[*]Click Start.
[*]Open My Computer.
[*]Select the Tools menu and click Folder Options.
[*]Select the View Tab.
[*]Under the Hidden files and folders heading select Do not show hidden files and folders.
[]Click Yes to confirm.
[]Click OK.

http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

[*]Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 23.
[*]Click the “Download” button to the right.
[*]Select your Platform and check the box that says: “I agree to the Java SE Runtime Environment 6 License Agreement.”.
[*]Click on Continue.
[*]Click on the link to download Windows Offline Installation (jre-6u23-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager…
[*]Close any programs you may have running - especially your web browser.
[*]Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
[*]Check any item with Java Runtime Environment (JRE or J2SE) in the name.
[*]Click the Remove or Change/Remove button.
[*]Repeat as many times as necessary to remove each Java version.
[*]Reboot your computer once all Java components are removed.
[*]Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u23-windows-i586-p.exe and select “Run as an Administrator.”)

SPRING CLEAN

To manually create a new Restore Point

[*]Go to Control Panel and select System
[*]Select System
[*]On the left select System Protection and accept the warning if you get one
[*]Select System Protection Tab
[*]Select Create at the bottom
[*]Type in a name i.e. Clean
[*]Select Create

Now we can purge the infected ones

[*]GoStart > All programs > Accessories > system tools page
[*]Select Performance Information and Tools
[*]Right click Disc cleanup an select run as administrator
[*]Select Your main drive and accept the warning if you get one
[*]For a few moments the system will make some calculations
[*]Select the More Options tab
[*]In the System Restore and Shadow Backups select Clean up
[*]Select Delete on the pop up
[]Select OK
[]Select Delete

Final stretch

Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check

http://i1224.photobucket.com/albums/ee362/Essexboy3/Bootdefrag.jpg

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

http://img233.imageshack.us/img233/7729/mbamicontw5.gif
Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit
[*]Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe :wave:

20

Alright!

Done and Done!

Thanks a lot :smiley: