Solved MSE found virtool.win32/obfuscator.XZ but couldn't get rid of it.

[cottonball]

On:

Rootkit.Agent/Gen
C:\WINDOWS\SOFTWAREDISTRIBUTION\DOWNLOAD\07CCC227213AC080954CC1FC7C451E72\AMD64_MICROSOFT-WINDOWS-LSA_31BF3856AD364E35_6.1.7601.22099_NONE_04A88CE28CC4EB33\LSASS.EXE

Would take action to check the above file further, vs. removing it.

 

[VistaKing]

I believe it's save to delete stuff inside this folder C:\WINDOWS\SOFTWAREDISTRIBUTION\DOWNLOAD

 

[cottonball]

@VistaKing,

Just a suggestion...

Rootkit.Agent/Gen was flagged by SAS. It may be a false positive, but, if not, that particular Rootlit can cause problems, and maybe even the BSODs.

Consider running:
Malwarebytes : Malwarebytes Anti-Rootkit

This is how I've used it...

Save to the Desktop (easy to find)
Right-click the file and select: Extract here...

Follow ithe Usage instructions on the MBAR website from Step 3 to Step 6.
For now, please stop at Step 6.

When the program is done, two reports are created in the MBAR folder:
1. system-log.txt
2. mbar-log-2013-03-19 (20-13-32).txt (corresponds to mbar-log-year-month-day (hour-minute-second).txt)

Please provide report #2, the mbar-log containing information on what was detected and removed.
Then, we will proceed.

 

[Jacee]

Just wondering ... why have you run AdwCleaner 4 times, and you didn't post all the results of the .txt logs?

Also, why didn't you post the full ESET log?

Since this is a "Self Build" computer, can you tell us where you got your current (DVD) version of Windows 7 Ultimate X64?

 

[Jacee]

What are we dealing with here? Your current specs with "self build" or someone else's DDs log? Wasting our resource help gets you no-where

 

[Zibeltor]

@ Kingvista: I uninstalled Daemon tools like you recommended, downloaded and ran the STPD checker; it didn't find anything to uninstall. I also followed the BSOD tutorial and have uploaded a rar dump of my latest blue screen. I will try and run the Microsoft Safety Scanner again, but I just wanted to get this all out in case my computer blue screens again while that happens. Edit: MSS didn't pick anything up on a quick scan; I'm gonna run a full scan to confirm. Okay, the full scan seems to consistently crash my computer, so I'm not going to do that anymore. What should we do next?

@ Cottonball: I'm sorry, I'm a little overwhelmed right now. Kingvista was the first person to help me, so I'm just going to keep following his instructions.

@ Jacee: I'm sorry about that game you saw earlier. I deleted all the folders and tried to uninstall it (for some reason I couldn't; I think it's on page 3). I assure you though that this copy of Windows is legitimate. I attached a screenshot that I hope will assure you. I had a good friend help me pick out most of the parts and I mainly watched him build it, so that's why I don't really know as much as you guys. I'm really sorry; I'm not trying to waste anyone's time. I've just been on the phone the last 3 days (and they're going to call me again tomorrow) with Microsoft tech support who I paid 99$ for and haven't been able to accomplish anything. :/ That's why it kind of slipped my mind to post all those logs you mentioned (and I don't really know off the top of my head where I'd find them). I don't know exactly what you're accusing me of (I don't know what a DD log is), but I promise I really did pay for everything in this computer and that it's like really here, causing me problems. I'm not trying to troll anyone.

 

[cottonball]

Zibeltor,

The suggestion was for VistaKing, since a Rootkit entry showed up.

He or you, can take it or leave it.

Good luck.

 

[VistaKing]

Zibeltor reason why Jacee Said that comment cause your system specs on your profile says your OS is Windows 7 Ultimate 64 bit when your logs say you have Windows 7 Home Premium .


@ Cottonball , What suggestion ?

 

[Zibeltor]

Oh, yeah. Sorry. I guess I should change that; I didn't really know what the difference between the two was :x Anyway, I'm kinda confident the malware is removed now.

 

[VistaKing]

I can't take a look at the .rar file right now. I am using an iPad right now . Is security tool from Microsoft locating the virus ?


Added :


Zibeltor we could run the tool that Cottonball suggested HERE follow the instruction that were posted as well .

 

[Zibeltor]

The security tool from Microsoft didn't find anything on a quick scan. When I tried to run the full scan, my computer just crashed.

I understand that you can't look at the BSOD dump right now; I'm sure you're a busy man. I'm probably going to go to sleep anyway, but before I do, just thought I'd leave this here. This is the log from Malwarebytes that Cottonball suggested. It did apparently find something and remove it (no reboot required), but I don't know how significant that is. Note: The system seems a lot more stable than before I started today (it's been running continuously now for about 3 hours, but oddly it seems to be only when it idles that it crashes).

 

[VistaKing]

It deleted this file

Registry Keys Detected: 1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{11111111-1111-1111-1111-110111271159} (PUP.CrossRider)

That's not the file that was found before I don't think. What do you mean crashes ? BSOD ? I can't look at the dmp file cause I am on an iPad .

Zibeltor can you run SuperAntispyware once more please ? Upload the log file once done .

 

[Zibeltor]

No, that's not the file that the other program found earlier; I don't think. And yes, by crashes I mean BSOD. But sometimes there's no actual BSOD, it's just all my programs (including Windows explorer) crash and all I can see is my desktop, and nothing except the mouse works so I just have to hard shut it down and reboot.

 

[VistaKing]

Looks like we will need to see what Cottonball and Lacee says .

 

[jimbo45]

Hi there
If you have a decent backup of your OS why not just wipe the machine and restore a CLEAN version.

Re-format the disk as well before proceeding.

Would seem second nature to me to do this -- How can you possibly ever be sure that an INFECTED machine could ever be 100% cleansed --especially if you are running the cleansing program on an INFECTED machine in the first place.

I'm not Dr Spock in Star Trek but you don't need to be a Vulcan to appreciate that it's "just not logical".

If you run decent daily scans and backup the OS every day you should have an uninfected backup copy. If you haven't well that is just plain idiotic -- Re-install OS is only safe solution.

Most people will disagree here - but I'm sticking to my guns -- I WOULD NEVER EVER trust ANY A/V cleansing software. Once I get an infected computer - the only ways of cleansing it are either a restore or a re-install of the OS -- and before doing that a re-format of the disk(s) as well.

Cheers
jimbo

 

[cottonball]

@VistaKing,

You guys have a hard call...

BSODs can be caused by malware, praticularly Rootkits or Bootkits that get hold of the Master Boot Record or boot code. This has not been ruled out, but the Rootkit SAS reported may have been a false positive. There is also no clue as to what SAS removed since there was no report provided with removals, etc.

What shows up in MBAR is a PUP.

A serious consideration is that the BSODs may be hardware or driver related. This machine was built by Zibeltor and someone else, which may give a little more room for issues than a factory built system.

Pursuing the BSODs looks to be the best decision. If you do a clean install, if there is a hardware issue, the problem could appear again. That would be a bummer!!

Do you agree?

 

[Zibeltor]

@ Jimbo: Yeah; that's exactly what Microsoft is telling me to do. :/ I kinda agree with Cottonball though. My computer has been having issues that don't seem to be just viral. I only say that because of how consistently it crashes instead of goes to sleep (when I leave it idle for about 30 minutes). The only reason I really hesitate to do the clean wipe is because I don't have a CD; and tech support is telling me I need to pay another 299$ to get the OS I originally paid for working. x.x

@ Cottonball: I think you're absolutely right. I'd hate to spend almost 300$ on a CD, after having spent 99$ on tech support, just to find out that it was some arcane hardware incompatibility the whole time. These issues have also been plaguing me since day 1 when I built the computer, which is another reason I doubt the sole issue is any malware. (It was bluescreening before I ever downloaded anything). I ran malware bytes like you suggested, it found and deleted something, but I don't think it was that important. The log is a little higher up.

@ VistaKing: I'm running Superantispyware right now. I'll edit this and add the log when it's done. Edit: It found a bunch of tracking cookies, no big stuff. Haha, most of the cookies are from Microsoft's tech support. I think cottonball is kind of on the right track; I don't think it was ever really viruses causing my BSOD's.

 

[cottonball]

@Zibeltor,

Thanks for the info.

SAS states: File threats detected: 21
However, it only presented 16 of them??? Whatever...but strange.

Looks as if VistaKing is setting you up for BSOD analysis.
Let's get his thoughts on this, but, I'm pretty sure he will move forward.

BSODs are bummers. Grrrr...

Good luck, Zibeltor!

 

[Zibeltor]

I'm more excited than anything. My system is already better for some reason; the prospect of being ultimately rid of the BSOD's is very tantalizing.

 

[cottonball]

I'm sure the folks at the BSOD forum. and VistaKing. will help you with whatever is possible, just like we tried to help you here to get the malware out of the way.

Regards...