Unable to get rid of virtool.win32/obfuscator.XZ

[SchwarzTee]

Hello, I'm a new member.

I've got this nasty virus and I cannot get rid of it. Microsoft security essentials keeps detecting it every time I run a complete scan even though it says it is in quarentine. It does not detect it in safe mode. Maybe it is a rootkit?

Avira detects it as a hidden object, but cannot solve the problem either.
I'm unsure whether it is a false positive.

I researched about this and found this thread:
http://www.sevenforums.com/system-security/208452-infected-virtool-win32-obfuscator-xz-2.html

Still I'm not rid of the problem. I followed the suggestion by Jacee in that thread and ran Combofix. I could post the log if necessary.

Help please.

Cheers.

 

[Borg 386]

It wouldn't hurt to check for rootkits since viruses have a bad habit of inviting more viruses onto your system. Rootkits generally make a cloaked partition & boot from that. Since the partition is hidden, it can be hard to remove for most programs.

For a rootkit scan, try running TDSSKiller.

Anti-rootkit utility TDSSKiller

Another tool you can use to check if anything else is present on your system is Windows Defender Offline. Being you're unsure of your system status, you may want to make this on another, clean PC & then run it on yours.

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html?filter

Yes, if you post the log this will help people to determine if there is anything amiss with your system.

 

[SchwarzTee]

Borg, apparently TDSSKiller solved the problem. It found some threats and removed them.
No more detections in Avira nor in Security essentials.

Danke sehr!

If I find out it came back I'll post here again.

 

[SchwarzTee]

Borg, it was not detected in safety mode.

But now I ran a complete scan in Security essentials and, arghhhh , the nasty virus was found again. See fig attached. It says it removed the plague but if I run a complete scan again it will be there.

TDSS was not useless, because it did find some threats. But now I realize it did not eliminate this problem.

From what I read, I cannot run Windows defender because my pen drive is 32 bits.

Help please.

 

[Jacee]

Warning! Backdoor Trojans

These are the most dangerous, and most widespread, type of Trojan.
Backdoor Trojans provide the author or ‘master’ of the Trojan with remote ‘administration’ of victim machines. Unlike legitimate remote administration utilities, they install, launch and run invisibly, without the consent or knowledge of the user. Once installed, backdoor Trojans can be instructed to send, receive, execute and delete files, harvest confidential data from the computer, log activity on the computer and more.
If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one, if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.
More info can be found below:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
How to report ID theft, fraud, drive-by installs, hijacking and malware? Security | DSLReports.com, ISP Information

Please post the combofix.txt log you saved.

 

[SchwarzTee]

Damn.. it's been on my system for a few days already Jacee.

Here goes Combofix's log. I ran it 2 days ago.
Really worried.

 

[Jacee]

Can you copy and paste the combofix 'quarantined' .txt log?

It's located here C:\Qoobox\ComboFix-quarantined-files.txt

 

[SchwarzTee]

I'll run combofix again.
Here goes the file saved two days ago.

 

[Jacee]

Download AdWareCleaner AdwCleaner Download to your desktop
1.Right-click on adwcleaner.exe and select Run As Administrator to launch the application.
2.Click on Delete button.
3.Confirm each time with OK.
4.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[Sn].txt as well - n is the order number.

 

[SchwarzTee]

Just ran Combofix again. Posting combofix's last logfiles.

Posting adware logfile too.

 

[SchwarzTee]

sorry, the adware log I posted was after clicking 'search'.
Here goes the correct one.

 

[Jacee]

Second AdWareCleaner looks much better after deleting the mess!

I want you to delete the old Combofix that you've been using.

First, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Next, uninstall both Firefox and Google Chrome.

Now download a fresh copy of Combofix from any of the links below, and save it to your desktop.<--Important
Link 1
Link 2
Link 3

Click on this link Here to see a list of programs that should be disabled.
The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
Next: Disconnect from the internet. If you are on Cable or DSL, unplug your computer from the modem.
Next: Please disable all onboard security programs (all running with back ground protection) as it may hinder the scanner from working.
This includes Antivirus, Firewall, and any Spyware scanners that run in the background.

• Double click combofix.exe and follow the prompts.
• When finished, it will produce a log for you.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Please be patient while the scan runs, at times it may appear to stall.
When finished and after reboot (in case it asks to reboot), it should open a log, combofix.txt.
Post this log in your next reply
After rebooting ensure your Security applications have been re-enabled.

In your next reply post:
ComboFix.txt
***A guide and tutorial on "How to use Combofix" can be found here:
ComboFix: A guide and tutorial on using ComboFix

IF CF won't run:
During the download, rename Combofix.exe to sVchost.exe

 

[SchwarzTee]

Here it goes.

 

[Jacee]

Ackkk! you have a rootkit ... I do not work on a computer with a rootkit because I can not tell you (for sure) that it will ever be stable again.

You Need to wipe the HDD and do a "Clean" install. Do not use any passwords you used previously
http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

Please read what a Rootkit is and what it does to your computer:
Rootkit - Wikipedia, the free encyclopedia

 

[SchwarzTee]

Do you know how long it has been there?
Could I have got it by accessing an infected forum? I accessed a forum in spite of a browser's warning sometime ago (forum admin said google's warning was invalid)
This will take me some work. my DVD drive is not working at moment.


My pendrive has 3817 MB. Could it work?

 

[Jacee]

Follow Brink's tutorial in the link I gave you above.

 

[SchwarzTee]

Ok Jacee, thank you very much!
You are my heroine.

I'm saving all my important data.

 

[Borg 386]

Be sure to run a thorough scan on any files you save before putting them back on your system as you may re-introduce the virus. You can upload files here to be scanned by multiple AV's. (max file size 32MB)

https://www.virustotal.com/

 

[SchwarzTee]

Ok, thank you Borg.

Just will make one thing clear.
Jacee, the keylogger virus detection than you saw in the image I posted was installed by myself when seeking security tools. It is not a deed from the rootkit.


The only virus detected by the antivirus is this Obfuscator.

I'm gonna format and reinstall windows in a partition and leave the other partition.
Is that okay?

 

[Jacee]

That one, I don't know Maybe someone else here, has the knowledge needed for your question.