Jump to content

new virus

roscoep54

By roscoep54,
in Help, my PC is infected!

 Share

Recommended Posts

roscoep54

roscoep54

Posted
Posted

I think my system has a new virus.  My Epson printer stopped working but seems to be setup properly so ran Adaware and came up with 3 virus files.  (didnt write down the virus)

 

Tried running JRT and it just gets hung up - wont complete.

 

here are the files for you to review:  FRST.txtAddition.txtlogs.db3

 

Thanks for any help you can provide.  

Link to comment
Share on other sites
roscoep54

roscoep54

Posted
  • Author
Posted

I think my system has a new virus.  My Epson printer stopped working but seems to be setup properly so ran Adaware and came up with 3 virus files.  (didnt write down the virus)

 

Tried running JRT and it just gets hung up - wont complete.

 

here are the files for you to review:  FRST.txtAddition.txtlogs.db3

 

Thanks for any help you can provide.  

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

logs.db3 is a SQLite database file, scan logs are found in C:\EEK\bin\Reports\.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

Winlogon\Notify\igfxcui: igfxdev.dll [X]
SearchScopes: HKU\S-1-5-21-3104866962-3908348715-1408370962-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3104866962-3908348715-1408370962-1001 -> {B5D55817-668F-4239-88AB-18DF0D002E43} URL = 
2015-10-19 16:59 - 2015-10-19 16:59 - 00003838 _____ C:\WINDOWS\System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473
C:\ProgramData\Dell Click 2 Fix+-64-bit-V2545.exe
C:\ProgramData\Dell Click 2 Fix+-64-bit-V2546.exe
C:\ProgramData\Dell Click 2 Fix-64-bit-V2546.exe
C:\ProgramData\fontcacheev1.dat
C:\Users\roscoep\AppData\Local\Temp\3eaeee01-fcad-4cda-8b61-ed3ab7baf1d5.exe
C:\Users\roscoep\AppData\Local\Temp\CSI4C91.exe
C:\Users\roscoep\AppData\Local\Temp\SetupDisplay.dll
C:\Users\roscoep\AppData\Local\Temp\SkypeSetup.exe
C:\Users\roscoep\AppData\Local\Temp\_before.dll
C:\Users\roscoep\AppData\Local\Temp\_is8D26.exe
Task: {0F505DA9-010C-4E40-A9E0-5FC95D9A1894} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION
Task: {33BFF4B8-C1EB-462A-83AF-72E352867A6B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION
Task: {67D2F30E-5C7D-491B-85AD-4799E297F438} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION
Task: {9C69836E-8B4B-4056-9845-F80EF43B031E} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION
Task: {A33BFE74-B8EF-4EBF-8AE0-66C01CA5E3F9} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION
Task: {BE59AE83-9594-4116-9D85-ABF2C77BFB10} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION
Task: {C20B3142-D0F6-4C3E-894A-CADFE33C1925} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION
Task: {D521C2DE-EEEA-4C48-B786-BB6A79038624} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION
Task: {D5FBAA6C-1A64-4837-9E71-4714CAC39D3D} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION
Task: {D882685F-FDEC-4FF8-A316-407303A88F12} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION
Task: {D9520F80-1E0D-4A9B-9BCC-CD2EEE858EE7} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION
Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Do the following:

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

Task: {1BE5CEAE-40A4-4DBB-8A72-96F455783579} - \IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 -> No File <==== ATTENTION
Reg: reg delete "HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM" /v "DISABLETASKMGR" /f
Reg: reg delete "HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM" /v "DISABLEREGISTRYTOOLS" /f
Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
roscoep54

roscoep54

Posted
  • Author
Posted

Well it wasnt running well, perhaps worse.  So I reran EEK - here' s scanlog scan_151104-194448.txt

 

saw the same two files from before so reran he FRST fix - here's the fixlog Fixlog 11.4 813pm.txt

 

then reran EEK & FRST - no suspicious files to report -  attached are the files 

 

now I'm going to see if I can run JRT without it failing.  Will add another reply when I'm able to do that.

Addition.txt

FRST.txt

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Close all programs and disconnect any USB or external drives before running the tool.

  • Double-click RogueKiller.exe to run the tool again (Vista or 7 users: Right-click and select Run As Administrator).
  • Once the Prescan has finished, click Scan.
  • Once the Status box shows "Scan Finished".
    • Click the Registry Tab and select the following items:
      [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve  -> Found

      [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

      [PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

      [PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Found

    • Click the Files Tab and select the following items:
      [PUP][Folder] C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308} -> Found

      [PUP][Folder] C:\ProgramData\{AD6D5A97-B46C-4FB1-91D4-411424B4A57F} -> Found

    • Click the Delete button.
  • Attach the RogueKiller report to your next reply.
    • The log can also be found on your desktop labeled (RKreport[X]_D_xxdatexx_xtimex)
    • The highest number of [X], is the most recent Delete
Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Let's take a look at the system using a different tool.

Download avz4.zip from here

  • Unzip it to your desktop to a folder named avz4
  • Double click on AVZ.exe to run it.
  • Run an update by clicking the Auto Update button on the Right of the Log window: AVZupdate.jpg
  • Click Start to begin the update

    Note: If you receive an error message, chose a different source, then click Start again

  • After the update, from the "File" menu, choose "Standard Scripts"
  • Put a check next to item 2: Advanced System Analysis
  • Click Execute selected scripts
  • At the next prompt, click the OK button
  • Let the scan run and click "OK" when the completion prompt pops up
  • Now Close out of the Standard Scripts window, and exit AVZ
  • Navigate to the avz4 folder and locate the folder LOG
  • Inside the LOG folder you will find virusinfo_syscheck.htm, virusinfo_syscheck.htm and virusinfo_syscheck.zip
  • Attach the Compressed file, virusinfo_syscheck.zip, to your next reply.
Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Do the following:

Close all windows then double click on AVZ.exe

  • Click File > Custom scripts
  • Copy & paste the below code in to the text box in the program

    Note: When you run the script, your PC will be restarted

    begin
SetAVZGuardStatus(True);
 RegKeyDel('HKLM','SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CF84DAC5-A4F5-419E-A0BA-C01FFD71112F}');
 DeleteService('McAWFwk');
 DeleteService('SearchProtectionService');
 SetServiceStart('LavasoftTcpService', 4);
 DeleteFile('C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe','32');
 DeleteFile('c:\program files (x86)\lavasoft\web companion\tcpservice\2.3.4.7\lavasofttcpservice.exe','32');
 DeleteFile('C:\WINDOWS\system32\LavasoftTcpService.dll','32');
 DeleteFile('C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.4.7\LavasoftTcpService.exe','32');
 DeleteFile('C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe','32');
 DeleteFile('C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe','32');
 RegKeyParamDel('HKEY_CURRENT_USER','Software\Microsoft\Windows\CurrentVersion\Run','Web Companion');
 DeleteFile('C:\Program Files\McAfeeAntiTheft\2.3.197.1\uninstall.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{248DFD5F-0557-40EA-BDD7-E9F933FEB3C9}','64');
 DeleteFile('C:\Program Files\McAfeeAntiTheft\2.5.142.1\uninstall.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{91916E38-746E-497E-B7F6-6B281FC55E5E}','64');
 DeleteFile('D:\start.exe','32');
 DeleteFile('C:\WINDOWS\system32\Tasks\{BAD45A38-4682-4FA5-A99C-3462C2B0A3BA}','64');
ExecuteSysClean;
RebootWindows(true);
end.
  • Click Run
  • Restart your PC if it doesn't do it automatically.
Attach a fresh AVZ log.

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now!

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

The leftover Lavasoft stuff is the most likely culprit.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

Winsock: Catalog9 01 C:\WINDOWS\system32\LavasoftTcpService.dll No File 
Winsock: Catalog9 02 C:\WINDOWS\system32\LavasoftTcpService.dll No File 
Winsock: Catalog9 03 C:\WINDOWS\system32\LavasoftTcpService.dll No File 
Winsock: Catalog9 04 C:\WINDOWS\system32\LavasoftTcpService.dll No File 
Winsock: Catalog9 17 C:\WINDOWS\system32\LavasoftTcpService.dll No File 
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-11-01] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-11-01] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-11-01] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-11-01] (Lavasoft Limited)
Winsock: Catalog9-x64 17 C:\WINDOWS\system32\LavasoftTcpService64.dll [425744 2015-11-01] (Lavasoft Limited)
2015-11-01 21:17 - 2015-11-02 12:35 - 00000000 ____D C:\Users\roscoep\AppData\Roaming\Lavasoft
2015-11-01 21:17 - 2015-11-02 07:22 - 00002992 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-11-01 21:17 - 2015-11-02 07:22 - 00002992 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-11-01 21:17 - 2015-11-01 21:17 - 00425744 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-11-01 21:17 - 2015-11-01 21:17 - 00000000 ____D C:\Users\roscoep\AppData\Local\Lavasoft
2015-11-01 21:17 - 2015-11-01 21:17 - 00000000 ____D C:\Program Files (x86)\Lavasoft
2015-11-01 21:16 - 2015-11-02 12:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-11-01 21:03 - 2015-11-01 21:16 - 00000000 ____D C:\ProgramData\Lavasoft
Task: {4A17F12B-83DA-4A86-AE6C-BEEDAA273465} - \{BAD45A38-4682-4FA5-A99C-3462C2B0A3BA} -> No File <==== ATTENTION
Task: {6D2A8F94-6E1E-41C2-B3FF-0B0068EB8C4B} - \{248DFD5F-0557-40EA-BDD7-E9F933FEB3C9} -> No File <==== ATTENTION
Task: {D73E9405-F515-4AC5-B218-3A3B20C1AFE4} - \{91916E38-746E-497E-B7F6-6B281FC55E5E} -> No File <==== ATTENTION
Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

I am going to have you invoke Windows File Protection by running System File Checker.

System File Checker

  • Click on Start and type cmd in the search box. Right click on cmd in the popup menu and select Run as Administrator.
  • Another box will open, at the Command Prompt, type sfc /scannow and press Enter. (Note the gap between the c and the /)
  • Let the check run to completion. DO NOT reboot the PC or close the cmd window.
  • Copy & Paste the following command at the Command Prompt and press Enter:

findstr /c:"[sR]" %windir%\logs\cbs\cbs.log >%userprofile%\Desktop\sfcdetails.txt

  • This will place a file on your desktop called sfcdetails.txt which contains the results of the scan.
  • Attach sfcdetails.txt to your next post.
Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Run Adwcleaner again and this time have it remove everything it finds. Attach the AcdCleaner cleaning log to your reply.

Copy the below code to Notepad; Save As fixlist.txt to your Desktop.

Task: {6D2A8F94-6E1E-41C2-B3FF-0B0068EB8C4B} - \{248DFD5F-0557-40EA-BDD7-E9F933FEB3C9} -> No File <==== ATTENTION
Task: {D73E9405-F515-4AC5-B218-3A3B20C1AFE4} - \{91916E38-746E-497E-B7F6-6B281FC55E5E} -> No File <==== ATTENTION
Close Notepad.

NOTE: It's important that both files, FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST64 and press the Fix button just once and wait.

If the tool needed a restart please make sure you let the system to restart normally and let the tool complete its run after restart.

The tool will make a log on the Desktop (Fixlog.txt). Attach it to your reply.

Note: If the tool warns you about an outdated version please download and run the updated version.

Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

You can go ahead and have EEK safely delete:

Value: HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLETASKMGR 	detected: Setting.DisableTaskMgr (A)
Value: HKEY_USERS\S-1-5-21-3104866962-3908348715-1408370962-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM -> DISABLEREGISTRYTOOLS 	detected: Setting.DisableRegistryTools (A)
Everything else looks good.

Unless you are having problems, it is time to do the final steps.

Now to remove most of the tools that we have used in fixing your machine:

Download Delfix from here and save it to your desktop.

Ensure Remove disinfection tools is checked.Also place a checkmark next to:Create registry backupPurge system restoreClick the Run button.When the tool is finished, a log will open in notepad. I do not need the log. You can close Notepad.

Empty the Recycle Bin

Download to your Desktop:

- CCleaner Portable

Run CCleanerTurn off System restore to flush all your restore points then turn system restore back on. See How To Enable and Disable System Restore.

You can delete and uninstall any programs I had you download, that you do not wish to keep on the system.

Run Windows Update and update your Windows Operating System.

Install and run the , this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated.

Articles to read:

How to Protect Your Computer From Malware

How to keep you and your Windows PC happy

Web , email, chat, password and kids safety

10 Sources of Malware Infections

That should take care of everything.

Safe Surfing!

  • Upvote 2
Link to comment
Share on other sites
ShadowPuterDude

ShadowPuterDude

Posted
Posted

Thread Closed

Reason: Resolved

The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist.

All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread.

Link to comment
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

Products & Services

Ransomware/Malware Removal

Partners

Resources

Company

© 2003-2022 Emsisoft - 05/23/2022 - Legal Notice - Terms - Bug Bounty - System Status - Privacy Policy

×
×
  • Create New...