Avast WEBforum
Other => Viruses and worms => Topic started by: Damian on August 17, 2012, 12:32:20 AM
-
One of my laptops has been infected with a virus/trojan and I have managed to get rid of the 6000 files that got pushed into system32 but there are some things still left behind. These ones are affecting my registry and I am struggling to remove them. Here is the details:
C:\Windows\System32\config\RegBack\SOFTWARE - Threat: Win32:Agent-AOYJ[Trj]
C:\Windows\System32\config\SOFTWARE - Threat: Win32:Agent-AOYJ[Trj]
I cannot move either of these files to chest for obvious reasons and I cannot clean them.
I am trying CCleaner but not sure what good it will do. I did at least 4 boot time scans but this doesnt seem to pick up the virus in the registry. Only time I find it is if I do a quick scan on the folders.
Any ideas what I can try?
-
6000 ? ...... Sound like a file infector
follow this guide and attach the logs
http://forum.avast.com/index.php?topic=53253.0
-
Ye definitely something like that. It kept creating more and more files all called random names like "addfrDAa.exe, eZXasE.exe" etc and all were 59kb each. These were infected with Win32:Kryptik-JJD. The files kept creating themselves even if the internet was disconnected.
I have managed to get the creating to stop but now Im left with this infected registry.
I'll start running those scans now.
-
Malwarebytes scanned and found nothing so dont think there is any point posting the log here. Running the OTL scan now.
-
Here are the logs for OTL and aswMBR.
There was no Extras.txt when I did the OTL scan.
-
Is it possible someone could analyze these logs today? I don't mean mean to sounds impatient and I'm grateful for any help provided.
-
hey a malware expert will help you as fast as possible but it might take few hours before one is on.
-
That's excellent. Thank you.
-
OK you missed a few, that is not surprising though
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
(https://dl.dropbox.com/u/73555776/OTL_Fix.GIF)
:OTL
SRV - [2012/08/16 19:19:39 | 000,000,000 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\kEjsfs.exe -- (kEjsfs)
O3 - HKU\S-1-5-21-3210811455-648955918-2352096976-1001\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
[2012/08/16 19:19:39 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\kEjsfs.exe
[2012/08/16 17:36:02 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\oQjZVB.exe
[2012/08/16 09:04:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\xoMuaq.exe
[2012/08/15 09:07:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\NqEDHs.exe
[2012/08/13 20:46:25 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\xRftTB.exe
[2012/08/13 08:51:22 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\JKDflK.exe
[2012/08/10 09:05:40 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\gjyKMd.exe
[2012/08/09 17:01:42 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\TEvauQ.exe
[2012/08/07 08:28:56 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\StPpgB.exe
[2012/07/24 15:54:34 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\lnixk.exe
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
THEN
Download and Install Combofix
Download ComboFix from one of the following locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here (http://forums.whatthetech.com/How_Disable_your_Security_Programs_t96260.html&pid=494216#entry494216)
- Double click on ComboFix.exe & follow the prompts.
- Accept the disclaimer and allow to update if it asks
(http://img.photobucket.com/albums/v706/ried7/NSIS_disclaimer_ENG.png)
(http://img.photobucket.com/albums/v706/ried7/NSIS_extraction.png)
- When finished, it shall produce a log for you.
- Please include the C:\ComboFix.txt in your next reply.[/b]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.
Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now
-
Thank you, I shall get on that in a moment. Just to check, do I run the OTL fix, then ComboFix and then post back both logs, or should I run OTL, then post the log and wait for it to be analysed before running ComboFix?
-
Nope you can run them straight one after the other and then post the logs .. Saves a lot of hassle ;D
-
Looks like I will have to do this over the weekend or maybe on Monday - wife has planned out the next 2.5 days for me so I won't have the time :P
Thank you for the help so far and I will post back the logs as soon as I can.
-
Not a problem .. Trust me I know what wives are like ;D
-
Finally had a chance
Here are the logs. Everything run through without any problems and the machine is running OK.
I have attached the post fix OTL log (it came up after reboot), the Quick Scan OTL log and the ComboFix log.
I did a scan again on \System32\config and the registry is still infected with Win32:Agent-AOYJ...
-
Where in the registry is the infection and what is reporting it ?
-
Sorry mate, here is the info you asked for:
-
Intriguing as that shows that they are in the registry hives... Not the normal place for it, and definitely not a folder/file to delete. These hives are backed up weekly by your system, and I would not like to mess with them
Download the latest version of TDSSKiller from here (http://support.kaspersky.com/downloads/utils/tdsskiller.exe) and save it to your Desktop.
- Doubleclick on TDSSKiller.exe to run the application
(http://dl.dropbox.com/u/73555776/TDSSFront.JPG)
- Then click on Change parameters.
(http://dl.dropbox.com/u/73555776/TDSSConfig.JPG)
- Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
- Click the Start Scan button.
- If a suspicious object is detected, the default action will be Skip, click on Continue.
(http://dl.dropbox.com/u/73555776/TDSSFound.JPG)
- If malicious objects are found, they will show in the Scan results and offer three (3) options.
- Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
- Get the report by selecting Reports
(http://dl.dropbox.com/u/73555776/TDSSEnd.JPG)
- Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
Please copy and paste its contents on your next reply.
-
Just run the scan and it found 2 items, but it didnt have a choice to Clean. It had Skip, Copy to quarantine and Delete. I chose skip as instructed and attached the report.
-
Are you experiencing any problems at all ?
Does Avast detect this on a normal scan or a custom scan
-
I havent done a normal scan since we started doing these manual fixes. It picks it up obviously when I right click on that config folder and ask it to scan.
The PC seems fine, some programs seem to be buggered (i.e. won't start) but thats probably due to something we cleaned out. But a reinstall will fix it. The system32 folder is not increasing in size anymore like it did, so thats good.
You thinking this might be a false positive or something?
-
It is not a false positive as such, as that is where the registry configuration files for the malware are
However the path files mean nothing if the actual file itself has gone. I believe that the backups are done on either a weekly or monthly basis so they should drop off
What programmes are inoperative ?
-
Ye I thought as much - the registry is telling a program to start but it wont because its not there.
So far the only program that was problematic was KeePass (http://keepass.info/).
So just leave everything as it is?
-
That would be my recommendation for now .. As we have removed all the bad boy files
How is the computer behaving otherwise ?
-
Computer seems to be fine, nothing out of the ordinary. Thank you for all your help and time. I will leave things as they are and keep an eye on the system32 folder to see if anything starts popping up again.
-
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL- Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands
[resethosts]
[emptytemp]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
Remove ComboFix
- Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
- In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
(http://i1224.photobucket.com/albums/ee362/Essexboy3/Misc%20screen%20shots/CF_Uninstall-1.jpg)
- Follow the prompts on the screen
- A message should appear confirming that ComboFix was uninstalled
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that
- Go to control panel
- Select folder options (Appearance > Folder options in category view)
- Select the View Tab.
- Under the Hidden files and folders heading select Do not show hidden files and folders.
- Click Yes to confirm.
- Click OK.
SPRING CLEAN
To manually create a new Restore Point
- Go to Control Panel and select System
- Select System
- On the left select System Protection and accept the warning if you get one
- Select System Protection Tab
- Select Create at the bottom
- Type in a name i.e. Clean
- Select Create
Now we can purge the infected ones
- GoStart > All programs > Accessories > system tools
- Right click Disc cleanup and select run as administrator
- Select Your main drive and accept the warning if you get one
- For a few moments the system will make some calculations
- Select the More Options tab
- In the System Restore and Shadow Backups select Clean up
- Select Delete on the pop up
- Select OK
- Select Delete
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif)
Malwarebytes (http://www.malwarebytes.org/mbam-download.php). Update and run weekly to keep your system clean
Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit
- Microsoft Windows Update (http://windowsupdate.microsoft.com)
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)
Keep safe :wave: