Avast WEBforum
Other => Viruses and worms => Topic started by: LornaC on April 06, 2012, 05:29:43 PM
-
Avast has found MBR Alureon-K (RTK) on my system. I am in the process of following your directions for tools and logs to speed up the process of getting clean. I ran SuperAntispyware Professional and it found Adware.IWin Games and BrowserHijacker.Favorites which have now been removed. I ran MBM Quick Scan and saved the log file to my desktop. I downloaded OTL to my desktop. When I attempted to run OTL, Avast found the file as suspicious and put it in Sandbox. Should I suspend my anti-virus softwares: Avast, SuperAntispyware and Threatfire while attempting to clean my system?
I'd like to get this right the first time.
Thank you.
-
No, when the autosandbox initially reacts have it 'Open Normally' and remember the answer for that program (OTL), see image example (click to expand).
-
Ok.
I ran the OTL scan and it saved Extras.Txt and OTL.Txt - Notepad to my desktop.
For the next step:
To attach : Within the post select:
Additional Options
Browse
Locate the OTL log
Select tthe OTL log
Where do I this? From My Computer? I have Windows XP.
Thanks.
-
see the box you type text in here......
just below the text i am typing now there is a "Attachment and other options"
see attached screenshot
-
Ok. I understand now.
I have attached 3 logs.
Will do next step and post when finished.
-
Next log being attached.
There are 2 logs in the file because I thought the scan was finished but it wasn't.
There is also an MBR.dat icon now on my desktop that wasn't there before. I did not click on it.
I don't know if I should download RogueKiller or not. If I have to do this, do I suspend my anti-viruses since it says Quite all programs?
Please advise.
Thanks.
-
Hi whilst I look at the logs lets see if this is not the variant that has aswMBR tagged
Copy aswMBR to your root drive i.e. C:\aswMBR.exe
Click Start > Run
Copy/paste the following command into the box and press enter
aswMBR.exe -ap 1
Once it has completed then reboot and re-run aswMBR and post the log here
Meanwhile I will look at the other logs
-
How do I copy aswmbr to my root drive?
Sorry but I've been at this for awhile and am not sure. I copied the aswmbr icon and it's now in my C:\
but I don't think that's correct. How do I know if awsmbr.exe is there or not?
-
Thats it, the icon is the programme ;D
-
Uh Oh.
Windows cannot find awsMBR.exe
Now what? :(
-
Should I be copying the .exe file to C:\Documents and Settings since that's where all my log files were put?
-
No problemo, there are many ways to skin this cat
Download the latest version of TDSSKiller from here (http://support.kaspersky.com/downloads/utils/tdsskiller.exe) and save it to your Desktop.
- Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
(http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_1.jpg)
- Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
(http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_2.jpg)
- Click the Start Scan button.
(http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_3.jpg)
- If a suspicious object is detected, the default action will be Skip, click on Continue.
(http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_4.jpg)
- If malicious objects are found, they will show in the Scan results and offer three (3) options.
- Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
(http://i466.photobucket.com/albums/rr21/JSntgRvr/tdss_5.jpg)
- Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste its contents on your next reply.
-
Here are the results:
The contents exceeded the limit so I'm sending it as an attachment.
When doing the scan Avast Quarantined 8 items and gave the option to Report a false positive.
-
Looking better, what files did Avast quarantine ?
On completion of this run can you let me know what problems remain
Re-run TDSSKiller and when you get the following item select delete
\Device\Harddisk0\DR0 ( TDSS File System )
Then
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
(http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg)
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
O3 - HKLM\..\Toolbar: (no name) - {0DCB56A9-C471-4FBE-BDAB-0FC547057806} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {92786807-8D75-49A3-B4D0-0B9395F63671} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-CEC4-75A487FD6484} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {EFA17369-CDC0-4927-9AFC-BAAD1F96B2AE} - No CLSID value found.
[2008/09/07 23:25:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2009/04/06 22:15:11 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Lorna\Application Data\.#
@Alternate Data Stream - 85 bytes -> C:\Documents and Settings\All Users\Desktop:$SS_DESCRIPTOR_PVX2VCGKMVF9F8NYTKBRVLNJCMLP9J5N8KGMJWMNNHCK98FGSH25VVVVVVVVVVVVV
:Files
ipconfig /flushdns /c
:Commands
[purity]
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
Win32-Alureon-PS
Win32-Rootkit-gen (RTK)
Win 32:Alureon-ANP (RTK)
C:\TDSSKiller_Quarantinetsk 0005.dta - Moved to chest
Win32 Malware-gen - Moved to chest
C:\Documents and Settings\Lorna\Desktop\tdsskiller.exe - threat detected and blocked
Avast icon is no longer in my system tray but is still on my desktop.
Do I disable MBAM before re-running TDSSKiller?
-
No TDSSKiller is OK it is just that OTL stops all process and MBAM gets very uppity about that
We will fix the tray icon in a bit... And Avast was snagging the files that TDSSKiller was moving
-
So I don't need to disable MBM?
Do I re-run TDSSKiller the same way as before? Changing parameters or just Start Scan?
-
Same method as before change parameters etc ;D
-
Re-ran TDSSKiller.
Threats found as shown in last section of attached file.
The only place I can see \Device\Harddisk0\DR0 is in Notepad.
Cannot delete it from there.
Hope you're staying up late tonight :)
-
Will wait for reply before re-running OTL.
-
OK run OTL and once done let me know of any problems that remain ;D
-
Do I copy and paste the same info as I did the first time I downloaded the program?
By the way, when I turned on my computer this morning I did not receive any warnings from Avast. Anti Superspyware wanted to do I scan but I didn't do it.
-
As it is on the other page I will repost it here ;D
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL
(http://i1224.photobucket.com/albums/ee362/Essexboy3/mbamstop.jpg)
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
:OTL
O3 - HKLM\..\Toolbar: (no name) - {0DCB56A9-C471-4FBE-BDAB-0FC547057806} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {92786807-8D75-49A3-B4D0-0B9395F63671} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-CEC4-75A487FD6484} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1606980848-1409082233-725345543-1004\..\Toolbar\WebBrowser: (no name) - {EFA17369-CDC0-4927-9AFC-BAAD1F96B2AE} - No CLSID value found.
[2008/09/07 23:25:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2009/04/06 22:15:11 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\Lorna\Application Data\.#
@Alternate Data Stream - 85 bytes -> C:\Documents and Settings\All Users\Desktop:$SS_DESCRIPTOR_PVX2VCGKMVF9F8NYTKBRVLNJCMLP9J5N8KGMJWMNNHCK98FGSH25VVVVVVVVVVVVV
:Files
ipconfig /flushdns /c
:Commands
[resethosts]
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
-
MBAM doesn't run at Start up so can I just go ahead and run OTL?
-
Ran OTL. Of course Threatfire said OTL.exe was high risk so I allowed the process twice.
Attached is the log file.
Have to run out for a bit. Will be back to see your next reply.
-
The big question now .... How is the computer behaving
-
It seems ok. My memory has increased by 10%. My hard drive is 97% full but that's probably because of the additional programs I downloaded yesterday. My avast icon in system try rotates a few times and stops and repeats this cycle. Pages are opening faster.
-
OK lets now remove my rubbish ;D
Subject to no further problems :)
I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems
Now the best part of the day ----- Your log now appears clean :thumbsup:
A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:
Run OTL- Under the Custom Scans/Fixes box at the bottom, paste in the following
:Commands
[resethosts]
[emptytemp]
[CLEARALLRESTOREPOINTS]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.
We will now confirm that your hidden files are set to that, as some of the tools I use will change that- Click Start.
- Open My Computer.
- Select the Tools menu and click Folder Options.
- Select the View Tab.
- Under the Hidden files and folders heading select Do not show hidden files and folders.
- Click Yes to confirm.
- Click OK.
(http://users.telenet.be/bluepatchy/miekiemoes/images/javaicon.gif) Your Java is out of date.
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version of Java components and upgrade the application.
Upgrading Java:- Go to this site (http://java.com/en/) and click Do I have Java
- It will check your current version and then offer to update to the latest version
Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:
(http://img233.imageshack.us/img233/7729/mbamicontw5.gif) Malwarebytes (http://www.malwarebytes.org/mbam-download.php).
Update and run weekly to keep your system clean
Download and install FileHippo update checker (http://www.filehippo.com/updatechecker/) and run it monthly it will show you which programmes on your system need updating and give a download link
It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit - Microsoft Windows Update (http://windowsupdate.microsoft.com)
To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ? (http://www.geekstogo.com/forum/topic/225044-preventing-malware-and-safe-computing/)Keep safe :wave:
-
<snip>
My hard drive is 97% full but that's probably because of the additional programs I downloaded yesterday.
<snip>
Even when you remove OTL, etc. that will still leave you very short on hard disk space.
At 97% full that is going to hamper your system performance, the system/hard disk is probably very fragmented and windows requires 15% free space in order for it to defrag the drive.
So you should take a hard look at what programs you have installed on your system and uninstall those that you don't use (MBAM is a keeper though as the space it takes up is less than its benefit).
Now that you are clean there are things that you can do to make some space:
- Temp File Cleaner by OldTimer
http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/ (http://www.geekstogo.com/forum/files/file/187-tfc-temp-file-cleaner-by-oldtimer/)
TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.
Get rid of old restore points:
Now you are clear of infection create a clean System Restore point:
1. Click Start, All Programs, Accessories, System tools, System Restore.
2. In the pop-up that appears fill in the radio button to Create a Restore Point
3. Click NEXT
4. Enter a useful name that you will remember if you need to find this again (Clean Restore Point)
5. Click CREATE
You now have a clean restore point, you should clear the old ones:
1. Click Start, All Programs, Accessories, System tools, Disk Clean Up
2. Click OK on the C: drive
3. Click the More Options tab
4. In the System Restore section click the Clean Up button
-
Ran OTL clicking only Run Fix.
Program told me to reboot and I did.
Ran OTL hitting cleanup button. It removed TDSS Killer icon and log files, OTL and log files, then when it was 'processing deleteitself, I was told to reboot PC. So I clicked OK.
My Shs.exe (Self Help Software ended and THEN i got a Warning: TFUN.exe -DLL Installation Failed because Windows is shutting down.
I have not checked my hidden files and folders yet.
I did not see your post below when I first got these instructions even though it was here.
Is there something we need to do before I check my Hidden Files & Folders because of the Warning message I received?
-
No it is just that threatfire picked a bad time to update
-
I followed all of your instructions. I uninstalled several programs I no longer require.
TFC did not put an icon on my desktop. Should there be one?
Should the aswmbr icon still be on my desktop? Should this be uninstalled? Do I need to get rid of the aswmbr.dat icon on desktop?
Everything appears to be ok. I will definitely come back over the next 24 hours if something seems faulty.
Thank you so much for your help and guidance. You have saved me many $$$$$! As they say in the UK, Brilliant!
-
No just delete aswMBR stuff ;D
TFC was probably removed by OTL as it does a good tidy up
Might be worth running a disc defragment now to tidy the whole disc up
-
Hi Essexboy
I deleted many many more programs and file folders that I no longer require and managed to free up 16% in order to do a disk defrag.
Everything appears to be ok.
Thanks again for you help.
-
My pleasure