Solved MSE found virtool.win32/obfuscator.XZ but couldn't get rid of it.

[Zibeltor]

How do I get rid of this sucker?

 

[boohbah]

a quick google showed this thread as first hit...

http://www.sevenforums.com/system-security/208452-infected-virtool-win32-obfuscator-xz-2.html

loads of info there, good luck.

 

[Zibeltor]

Yeah, I read that thread. The dds tool that Jacee recommends though...none of those mirrors work anymore. :/

Scratch that, I found dds. I have included the two logs she asked that guy for, but I don't really know what she was looking for or what made her decide to recommend combo fix. :/

 

[Jacee]

virtool.win32/obfuscator.XZ ...This is a "backdoor Trojan" ...

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.

If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.

Please uninstall all P2P programs!

Next, we're going to flush the DNS cache and restore MS's Hosts file.
Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.

Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. Your computer will reboot itself.

After doing the above, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[Zibeltor]

I did all the steps you recommended, and ESET found something, but I'm 99% sure that's not what's been causing my blue screens.

 

[VistaKing]

Hi Zibeltor

Lets use SuperAntispyware to remove that


Download




Once you’ve launched the application on the infected machine, you should see a welcome screen, and you can just click the button to start it up.

Pick your language

Click on scan your computer

Select the locations to scan, and choose to Perform Complete Scan (there’s no point in a quick scan on an infected machine).

The application will scan through the system and find anything bad on the system, and then let you remove it all easily

 

[Jacee]

E:\Torrents\Sleeping.Dogs-SKIDROW\sr-sddvd2.iso a variant of Win32/Packed.VMProtect.AAA trojan deleted - quarantined

Ah-ha! Problem ... VMProtect Software Protection » VMProtect.AAA, VMProtect.AAD

If it's not paid for, then it's pirated.

 

[VistaKing]

Nice a program using an old MS Office logo as their software logo .

 

[Zibeltor]

Thank you for your help VistaKing. I'm running the scan now. I'll edit this post when I have results to show you.

 

[VistaKing]

Lets see if we could remove that . If it locates any cookies that's ok that not malware . You may delete those as well .

 

[Zibeltor]

Well, the scan finished. Nothing super interesting except the thing at the bottom.

SUPERAntiSpyware Scan Log
SUPERAntiSpyware | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 03/19/2013 at 02:08 AM

Application Version : 5.6.1014

Core Rules Database Version : 10149
Trace Rules Database Version: 7961

Scan type : Complete Scan
Total Scan Time : 00:11:19

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator

Memory items scanned : 555
Memory threats detected : 0
Registry items scanned : 71812
Registry threats detected : 0
File items scanned : 55253
File threats detected : 15

Adware.Tracking Cookie
.liveperson.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.microsoftwindows.112.2o7.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
sales.liveperson.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.liveperson.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.doubleclick.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.invitemedia.com [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
pulse-analytics-beacon.reutersmedia.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.legolas-media.com [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
server.iad.liveperson.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
3DStats.com - Professional Website statistics in real time [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.kaspersky.122.2o7.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
.eset.122.2o7.net [ C:\USERS\CARL\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

Rootkit.Agent/Gen
C:\WINDOWS\SOFTWAREDISTRIBUTION\DOWNLOAD\07CCC227213AC080954CC1FC7C451E72\AMD64_MICROSOFT-WINDOWS-LSA_31BF3856AD364E35_6.1.7601.22099_NONE_04A88CE28CC4EB33\LSASS.EXE

 

[VistaKing]

Did you delete the results and restart ?

Did you update before scanning ?

 

[Zibeltor]

Yes I updated before starting and yes I restarted after deleting the things it found (except for a few cookies related to my microsoft support session).

 

[VistaKing]

Lets take a look with this software

   Note

You will need a USB Flash Drive

Farbar Tool

Download Farbar Recovery Scan Tool from below on a non infected PC
For 32-bit (x86) systems
Download


Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems
Download


Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

:ar: To enter System Recovery Options from the Advanced Boot Options:
Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

:ar: To enter System Recovery Options by using Windows installation disc:
Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

:ar: On the System Recovery Options menu you will get the following options:
Startup Repair

System Restore

Windows Complete PC Restore

Windows Memory Diagnostic Tool

Command Prompt

Select Command Prompt

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

   Note

Replace letter e with the drive letter of your flash drive.

   Tip

Type the commands below to see what your letter is for the USB drive and press ENTER after each command

Diskpart
List volume

The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
services.exe
Now press the Search button
When the search is complete, search.txt will also be written to your USB
Type exit and reboot the computer normally
Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

 

[VistaKing]

You could also try to run this program

Download AdWareCleaner AdwCleaner Download

AdwCleaner Download to your desktop
:ar: Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
:ar: Click on Search button.

Upload the log with your reply

 

[Zibeltor]

I'm afraid I don't have a flash drive, but I'm trying the AdwCleaner. Just wondering, but this is probably the 7th...8th? adware/malware scanner I've used since I started investigating the issue. Can I just skip..straight to the best one? Haha; I'm just not sure why I'm being led through a series of ineffective programs. :/

Alright, so I used adwCleaner program, and here's the log!

 

[VistaKing]

Run the AdwCleaner once more this time click on delete . When it asks to restart please do so .

 

[Zibeltor]

Alrighty. I have deleted the files and here is the report.

 

[VistaKing]

I apologize if I am giving you the run around to remove this sucker .

Can you give me a screen shot of this please

Open up the registry . Click on rb: button type in REGEDIT in the search box and press Enter once REGEDIT shows up in the start menu under Programs (1) . Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN

And

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNOnce

 

[Zibeltor]

Haha, if it stops the interminable blue screens, you don't have to apologize for anything. I would in fact buy you many virtual beers. Here are the screen caps you asked for.