possible virus, which forum to go to for help

[drmax]

no more zeroaccess

Wow, gotta hand it to malwarebytes! Unreal!!
I do have other things found by that Rouge Killer program I used, but it isn't stating virus. He is the latest report...
RogueKiller V8.4.3 _x64_ [Jan 25 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : RogueKiller - Geeks to Go Forums
Website : RogueKiller
Blog : tigzy-RK
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : greg [Admin rights]
Mode : Scan -- Date : 01/25/2013 21:53:06
| ARK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 19 ¤¤¤
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Services\Microsoft\RunOnce : Z1 (cmd /c "C:\Users\greg\AppData\Local\Temp\Rar$EXa0.995\mbar\mbar.exe" /cleanup /s) -> FOUND
[TASK][SUSP PATH] AmiUpdXp : C:\Users\greg\AppData\Local\SwvUpdater\Updater.exe -> FOUND
[TASK][SUSP PATH] Updater21804.exe : C:\Users\greg\AppData\Local\Updater21804\Updater21804.exe /extensionid=21804 /extensionname="Coupon Companion Plugin" /chromeid=jneaojaoiajhnemidnjhoempalnidbhj -> FOUND
[TASK][SUSP PATH] {08C1F234-568C-4E01-A173-0CE24EC7480E} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {0AE7B435-789A-4706-B760-CEBE58093B40} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {4338847E-E938-4FF6-8CC0-5D7332A25EE5} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {4C915BC5-464F-45D1-8DAC-5EBD614BE23F} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {6FE37CCF-0EB5-4144-8DDE-A628D33493C0} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {9051A283-39ED-4164-BFD2-F9AA48668EF0} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {B94F491E-0B54-4E4E-A7A6-19FA3F5FA826} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[TASK][SUSP PATH] {F9BEEBEA-4C20-45DC-B6AE-35302F8A99E4} : C:\Users\greg\Desktop\abgx360_v1.0.5_setup.exe -> FOUND
[HJPOL] HKCU\[...]\Services\Microsoft\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKCU\[...]\Services\Microsoft\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Services\Microsoft\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Services\Microsoft\System : DisableRegistryTools (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\Services\Microsoft\System : DisableTaskMgr (0) -> FOUND
[HJPOL] HKLM\[...]\Wow6432Node\Services\Microsoft\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[...]\Services\Microsoft\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\Services\Microsoft\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: SAMSUNG HD204UI ATA Device +++++
--- User ---
[MBR] 7dc8ed4fba1d6234107389db834b6c05
[BSP] cac14c49d7f039a9758c50803549fbbd : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: ST3160812AS ATA Device +++++
--- User ---
[MBR] 0086f36f0b7bc8b257f89fc226376c3d
[BSP] 9e3b3c473b1db0daa516427cdae6e1cc : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097152 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive3: SanDisk Cruzer USB Device +++++
--- User ---
[MBR] bfc2508142cb31e56488e57ad8f80c9c
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 30532 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[3]_S_01252013_02d2153.txt >>
RKreport[1]_S_01252013_02d1959.txt ; RKreport[2]_S_01252013_02d2055.txt ; RKreport[3]_S_01252013_02d2153.txt

 

[cottonball]

drmax,

If you can obtain a report from Malwarebytes Anti-Rootkit, that will be great.

However, do proceed with the following:



Please plug a flash drive into a clean computer.

Go to Start > Computer
Double-click Computer, and select the flash drive.
Right-click and select: Format
Press Start on the Format prompt.
Remove when done.


Download:
Farbar Recovery Scan Tool Download

Save FRST64 to the USB flash drive.
Remove the flash drive from the clean computer, and plug the drive into the infected computer.







Now, to enter System Recovery Options using Windows installation disc:

• Insert the installation disc.
• Restart the infected computer.
• If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
• Click Repair your computer.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account and click Next.

In the System Recovery Options menu you get the following options:

• 
  Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt

Select: Command Prompt

• In the command window type notepad and press Enter.
• Notepad opens. Under the File menu (at the top) select Open.
• Select Computer, find your flash drive letter, and close Notepad.
• In the command window type e:\frst64.exe, and press Enter Note: Replace letter e with the drive letter of your flash drive.
• The tool starts to run.
• When the tool opens click Yes to disclaimer.
• Press the Scan button.

A log (FRST.txt) is found on the flash drive.

Please provide the FRST.txt in your reply.

 

[cottonball]

In the MBAR folder there are two files:
system-log.txt
mbar-log (date,etc.)

One of them contains the malware removed, etc.

See if you can find it, and post it. The more we can confirm, the better.

Thanks!

 

[drmax]

unlike the regular malwarebytes, this did not store a log. i looked high and low for it, unless it put it somewhere unknown. I searched my pc for mbar and i didn't find that particular scan. Damn...

 

[cottonball]

Is there an MBAR folder on your Desktop, or wherever you unzipped the program?

In any event, press on with the instructions for FRST64. We need to make sure ZeroAccess is truly gone. It is best to use more than one program to confirm.



Verify that your system is now running normally, and that the following items are functional:

1. Internet access
2. Windows Update
3. Windows Firewall

Post back.

MBAR can also give the Firewall a repair shot, if needed. However, we need that MBAR folder.
There is an application called fixdamage in it. You would need to run the 'fixdamage' tool, and reboot.

If you have no luck finding the folder, right-click the downloaded MBAR file on the Desktop, and select: Extract here...

 

[drmax]

Is there an MBAR folder on your Desktop, or wherever you unzipped the program?

In any event, press on with the instructions for FRST64. We need to make sure ZeroAccess is truly gone. It is best to use more than one program to confirm.




Verify that your system is now running normally, and that the following items are functional:

1. Internet access
2. Windows Update
3. Windows Firewall

Post back.

MBAR can also give the Firewall a repair shot, if needed. However, we need that MBAR folder.
There is an application called fixdamage in it. You would need to run the 'fixdamage' tool, and reboot.

If you have no luck finding the folder, right-click the downloaded MBAR file on the Desktop, and select: Extract here...

I will have to figure out was frst64 means, and i'll check that...then get back to you. I did not find that log file anywhere.

 

[cottonball]

Sorry! Was not specific enough.

Look at the instructions in Post #22 for Farbar Recovery Scan Tool x64 (FRST64)

Also, check the Firewall, Internet access, Windows Update, etc. to make sure all is well.

 

[drmax]

I have the MBAR folder, there is just NO log found that held the info where the virus was located. I thought that is what you were after. I see the "fix damage" exe program within. I figured out what frst means and did not appear to have an issue, as there was nothing to "fix". I re-ran the Roguekiller program, and it did not show anything. What is it I need to attempt with that "fix damage" setting?

 

[drmax]

Sorry! Was not specific enough.

Look at the instructions in Post #22 for Farbar Recovery Scan Tool x64 (FRST64)

Also, check the Firewall, Internet access, Windows Update, etc. to make sure all is well.

ok, sorry but I will have to get at this in the morning. I have an attachment of the scan report. It was to large to c/p. See you tomorrow and you were a great help.

 

[Jacee]

What is a Rootkit? Rootkit - Wikipedia, the free encyclopedia

There are experts who believe that the only reliable way to remove them is to re-install the operating system from trusted media.[79][80] This is because antivirus and malware removal tools running on an untrusted system may be ineffective against well-written kernel-mode rootkits. Booting an alternative operating system from trusted media can allow an infected system volume to be mounted and potentially safely cleaned and critical data to be copied off—or, alternatively, a forensic examination performed.[23] Lightweight operating systems such as Windows PE, Windows Recovery Console, Windows Recovery Environment, BartPE, or Live Distros can be used for this purpose, allowing the system to be cleaned.
Even if the type and nature of a rootkit is known, manual repair may be impractical, while re-installing the operating system and applications is safer, simpler and quicker

I have been awarded the Microsoft 'Most Valuable Professional' in Security for 8 years now.... I will not even try to clean up a rootkit or bootkit. The computer has been extremely compromised and it will never be stable again without a total wipe and clean install.

 

[cottonball]

Jacee,

Have read different opinions on removing, or not removing Rootkits.

There are quite a number of forums that deal with Rootkits on a daily basis, successfully!

The option to reformat is always there, but, there seem to be more Users cleaning the computer (with assistance from the forums) than doing a wipe and clean install.

Personally, after loaning my laptop to a neighbor, upon return it had a rootkit. Took action to remove it, and now posting from it. It wasn't easy to get rid of, but, the computer is stable, and no further problems developed.

There are tools available to remove Rootkits that do a great job, and experts agree that more than one should be used to confirm removal.

Bottom line appears to be that it is up to the User on whether to clean the computer, or do a total wipe and clean install.

 

[Jacee]

It is most definitely up to the user!

But.... I, personally, will not try to clean up such a compromised computer. I've seen many users come back to the malware help forums after having been declared that their computer was clean of the rootkit.

 

[Layback Bear]

A person removing a rootkit and having a stable computer is great but not my concern. My concern is a computer that a rootkit has been removed still running very quietly a Botnet and or stealing the new passwords for banking, credit card information and on line accounts and the like. We do all agree the the owner has to make that decision. I'm cautious and a little security paranoid. Many years ago I had a bank account wiped out and still have a little bad taste in my mouth. That was before the banks and credit card companies would help you when such things happened. Their attitude was my money, my account, my problem can we help you with anything else. Thank you for doing business with Give a Shot Bank.

 

[cottonball]

In the computer world, anything is possible, as we all know!

I have always gone for the fixing of the computer. There are quite a few very reputable forums with advisors that do the same.


Every person brings in a different experience...:shock:


If security paranoid and going for a new install, buying a new hard drive would be on my list vs. wiping the disk.

 

[Layback Bear]

I wipe a new hard drive before using. One never knows what might be on it.

http://netsecurity.about.com/od/ant...nd-New-Computer-Pre-Infected-With-Malware.htm

 

[drmax]

attention CottonBall

Here is the required info. I had the mbar logs last night, but they were from a post scan of the original findings. So I will put all that stuff here, including the latest scan in dos. Thx and I'll rep you.

PS. Firewall is working fine now, I'm thinking. I use "allshare" by samsung to port stuff to my tv, and for some reason I'm having to disable firewall to run this, which i don't think i did in the past. I'll have to look into this. If there is a prob., I'll post back.

 

[cottonball]

Thanks for the info, drmax.

The MBAR logs do not show anything, but, you say those are from post scans, so that makes sense.

The FRST64 results do show some ZeroAccess remnants. Need to take a close look at the entire report.

Going to be out and about today, so, will get back with you later.

Thanks for your patience.

 

[DBone]

Glad to see that MBAR worked so well for you. Those Malwarebytes guys are definitely on top of their game!

 

[Jacee]

FRST shows quite a mess of infected files and apps

 

[cottonball]

drmax,

Although MBAR took care of some of the ZeroAccess, there are still ZA files left in the system. That just stresses the importance of not placing all your trust on one program. Different programs have different definitions they target.

Let's press on...


Please do the following...
Open Notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the code box below to Notepad.

start
C:\Windows\assembly\tmp
C:\Users\greg\AppData\Local\89e89c8d
end

• In Notepad, go to File > Save as...
• Save to: the USB flash drive
• In File name use: fixlist.txt
• Click: Save

Have FRST.exe and fixlist.txt on the flash drive.

Next, plug the flash drive into the infected computer.







Now, please enter System Recovery Options like you did previously:

• >>> Restart the computer, etc. > select: Command Prompt
• Type e:\frst64.exe, and press: Enter
• Replace the drive letter g with the drive letter of your flash drive, or SD Card!
• In FRST, this time press the Fix button.

The program saves a Fixlog.txt, on the flash drive.

Click the Command prompt window, type exit, and press: Enter
Back at the System Recovery Options, press: Restart

Let the computer boot normally.

Please copy/paste the Fixlog.txt in your reply.