« previous next »
Pages: [1] 2   Go Down

Author Topic: Can't remove malware  (Read 11598 times)

0 Members and 1 Guest are viewing this topic.

fabriziopsico

  • Guest
Can't remove malware
« on: March 21, 2013, 10:48:18 AM »
Please help me to fix this...

I inserted an usb drive into my laptop and scanned it while opening the drive many files are not visible, and folders were displayed as shortcuts.
after that i could see that  below 2 urls are invoked at regular intervals and blocked by avast
hxtp://nnh42.name/a/
hxtp://jsh37.net/a/

Also i could see a lot of windows update icon in system tray.

I can't install Malwarebyte and cannot run adwcleaner. OTL is closing as soon as opened
I've runned the RogueKiller, as I saw in other post, the reports are attached.

Thanks!
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove malware
« Reply #1 on: March 21, 2013, 02:54:11 PM »
Hi lets try this little programme first, once done then retry OTL

Please download OTM 
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
     
Code: [Select]

:Files
 C:\Users\Fabiana\AppData\Roaming\4e8

:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
     
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Logged

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #2 on: March 21, 2013, 05:41:58 PM »
really thanks, essex! I'm working on my dissertation and I really need my computer working fine!
I've runned the OTM, here are the results!
Logged

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #3 on: March 21, 2013, 06:32:30 PM »
however, it's not possible to run otl yet, it closes while is starting
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove malware
« Reply #4 on: March 21, 2013, 07:00:56 PM »
OK we will try DDS next and that will allow me to see where the blockage is

Please download DDS and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.scr to run the tool.
  • When done, DDS.txt will open.
  • Click Yes at the next prompt for Optional Scan.
  • Save both reports to your desktop.
---------------------------------------------------
 
Please attach the contents of the following in your next reply:
 
DDS.txt
 
Logged

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #5 on: March 22, 2013, 04:04:47 AM »
Man, when i click on the link, the web page opened stand white, even if i copy the address of the link. So, I couldn't install the program you said.
I runned otl in the safe mode... does it help? It has generated just one file, I attach it to you...

thanks!
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove malware
« Reply #6 on: March 22, 2013, 03:33:58 PM »
Safe mode works for me..  Run this fix in safe mode and allow it to reboot to normal mode
Once in normal mode let me know how it is behaving

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuyE0C0E0D0D0EyByC0C0A0BtD0EyEyBzztN0D0Tzu0StByEyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=89875488
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuyE0C0E0D0D0EyByC0C0A0BtD0EyEyBzztN0D0Tzu0StByEyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=89875488
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuyE0C0E0D0D0EyByC0C0A0BtD0EyEyBzztN0D0Tzu0StByEyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=89875488
IE - HKLM\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuyE0C0E0D0D0EyByC0C0A0BtD0EyEyBzztN0D0Tzu0StByEyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=89875488
IE - HKU\S-1-5-21-1490188616-2252042121-3073585456-1000\..\SearchScopes,Backup.Old.DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1490188616-2252042121-3073585456-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1490188616-2252042121-3073585456-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzuyE0C0E0D0D0EyByC0C0A0BtD0EyEyBzztN0D0Tzu0StByEyBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=89875488
IE - HKU\S-1-5-21-1490188616-2252042121-3073585456-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\PROGRA~2\Funmoods\1.5.23.22\bh\escort.dll File not found
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\PROGRA~2\Funmoods\1.5.23.22\escorTlbr.dll File not found
O4 - HKU\S-1-5-21-1490188616-2252042121-3073585456-1000..\Run: [58915] C:\Users\Fabiana\AppData\Roaming\4e8\58915.js ()
O4 - Startup: C:\Users\Fabiana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ed0.js ()
[2013/03/21 13:30:11 | 000,000,000 | -HSD | C] -- C:\Users\Fabiana\AppData\Roaming\4e8
[2013/03/21 23:18:03 | 000,046,282 | ---- | M] () -- C:\Users\Fabiana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ed0.js

:Files
C:\PROGRA~2\Funmoods

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Logged

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #7 on: March 23, 2013, 01:32:45 AM »
Ok! I did everything...
I'm posting the otl file you asked. I started the pc in the normal mode after all and it is opening the otl rightly now.
well, something is working! haha...
thanks!
Logged

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #8 on: March 23, 2013, 01:52:03 AM »
man, until now, in the normal mode, avast hasn't blocked any try to enter the sites... and that's no updates icont here too. I think the executable of the virus is blocked...
Now, what should I do with the usb infected? throw away? or there is any other alternative?
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove malware
« Reply #9 on: March 23, 2013, 02:11:05 PM »
OK lets clear up the remnants and clean the USB

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following


Code: [Select]
:OTL
[2013/03/21 00:11:12 | 000,000,000 | -HSD | C] -- C:\4f09
[2012/09/04 14:01:08 | 000,384,844 | ---- | C] () -- C:\Users\Fabiana\AppData\Local\funmoods-speeddial.crx

:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN

Download McShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives

Plug in the drive and allow McShield to scan it

Then get the log which will be here :

Start > all programs > MCShield > logs > all scans

And post that


Logged

t4r0_o

  • Guest
Re: Can't remove malware (I have the same problem)
« Reply #10 on: March 23, 2013, 06:32:57 PM »
just that, i got a malware that i can't remove. it's exactly the same problem, the process associated to this malware is "wscript.exe". any ideas?
Logged

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37527
  • Not a avast user
Re: Can't remove malware (I have the same problem)
« Reply #11 on: March 23, 2013, 06:39:43 PM »
Quote from: t4r0_o on March 23, 2013, 06:32:57 PM
just that, i got a malware that i can't remove. it's exactly the same problem, the process associated to this malware is "wscript.exe". any ideas?
start your own topic and you will get help
Logged

Online DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89029
  • No support PMs thanks
Re: Can't remove malware
« Reply #12 on: March 23, 2013, 07:06:11 PM »
Quote from: t4r0_o on March 23, 2013, 06:32:57 PM
just that, i got a malware that i can't remove. it's exactly the same problem, the process associated to this malware is "wscript.exe". any ideas?

Yes - Please create your own new topic, here http://forum.avast.com/index.php?board=4.0 in the viruses and worms forum (click the New topic button at the top of the page see image) and we will try and help you there.

Go to this topic http://forum.avast.com/index.php?topic=53253.0 for information on Logs to assist in cleaning malware. Use the information about getting and using the tools and start your own new topic and attach the logs there, not in the LOGS or this topic.

Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

fabriziopsico

  • Guest
Re: Can't remove malware
« Reply #13 on: March 24, 2013, 01:58:01 PM »
Perfect!
I've followed all the steps...
Here are the files...
Is everything ok?
Thank you!
Logged

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Can't remove malware
« Reply #14 on: March 24, 2013, 02:18:15 PM »
How is the computer running now ?
Logged
Pages: [1] 2   Go Up
« previous next »