Unable to remove virus from registry

[Damian]

Sorry mate, here is the info you asked for:

[essexboy]

Intriguing as that shows that they are in the registry hives...  Not the normal place for it, and definitely not a folder/file to delete.  These hives are backed up weekly by your system, and I would not like to mess with them

 Download the latest version of TDSSKiller from here and save it to your Desktop.
 
 

• Doubleclick on TDSSKiller.exe to run the application
  
  
  
• Then click on Change parameters.
   
  
   
  
• Check the boxes beside Verify Driver Digital Signature and Detect TDLFS file system, then click OK.
   
  
• Click the Start Scan button.
   
   
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
   
  
   
  
• If malicious objects are found, they will show in the Scan results and offer three (3) options.
• Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.
  
  
• Get the report by selecting Reports

 

• Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  

Please copy and paste its contents on your next reply.

[Damian]

Just run the scan and it found 2 items, but it didnt have a choice to Clean. It had Skip, Copy to quarantine and Delete. I chose skip as instructed and attached the report.

[essexboy]

Are you experiencing any problems at all ?

Does Avast detect this on a normal scan or a custom scan

[Damian]

I havent done a normal scan since we started doing these manual fixes. It picks it up obviously when I right click on that config folder and ask it to scan.

The PC seems fine, some programs seem to be buggered (i.e. won't start) but thats probably due to something we cleaned out. But a reinstall will fix it. The system32 folder is not increasing in size anymore like it did, so thats good.

You thinking this might be a false positive or something?

[essexboy]

It is not a false positive as such, as that is where the registry configuration files for the malware are
However the path files mean nothing if the actual file itself has gone.  I believe that the backups are done on either a weekly or monthly basis so they should drop off

What programmes are inoperative ?

[Damian]

Ye I thought as much - the registry is telling a program to start but it wont because its not there.

So far the only program that was problematic was KeePass (http://keepass.info/).

So just leave everything as it is?

[essexboy]

That would be my recommendation for now ..  As we have removed all the bad boy files

How is the computer behaving otherwise ?

[Damian]

Computer seems to be fine, nothing out of the ordinary. Thank you for all your help and time. I will leave things as they are and keep an eye on the system32 folder to see if anything starts popping up again.

[essexboy]

Subject to no further problems   

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :Commands
  [resethosts]
  [emptytemp]
  [Reboot]

• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done

Remove ComboFix

• Hold down the Windows key + R on your keyboard. This will display the Run dialogue box
  
• In the Run box, type in ComboFix /Uninstall (Notice the space between the "x" and "/") then click OK
  
  
  
  
• Follow the prompts on the screen
• A message should appear confirming that ComboFix was uninstalled

Run OTL and hit the cleanup button.  It will remove all the programmes we have used plus itself. 

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Go to control panel
• Select folder options (Appearance > Folder options in category view)
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
  
• Click Yes to confirm.
• Click OK.

SPRING CLEAN

To manually create a new Restore Point
 

• Go to Control Panel and select System
  
• Select System
  
• On the left select System Protection and accept the warning if you get one
  
• Select System Protection Tab
  
• Select Create at the bottom
  
• Type in a name i.e. Clean
• Select Create
  

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
  
• Right click Disc cleanup and select run as administrator
  
• Select Your main drive and accept the warning if you get one
  
• For a few moments the system will make some calculations
• Select the More Options tab
  
• In the System Restore and Shadow Backups select Clean up
  
• Select Delete on the pop up
  
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes.  Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated. To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide  How did I get infected in the first place ?

Keep safe  :wave: