Author Topic: Please help with a stubborn virus  (Read 5832 times)

0 Members and 1 Guest are viewing this topic.

Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Please help with a stubborn virus
« on: January 05, 2015, 04:43:21 PM »
Hello,

AVAST reports that the virus LNK:Jenxcus-M has infected my ntuser.dat.log files. When I select the fix option, it says that it will handle it on the next boot, but the problem doesn't go away. I don't think this is a false positive, because the machine runs more slowly than usual. The scan on Malwarebytes (free version) did not reveal a problem.

Any help would be greatly appreciated!

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36043
Re: Please help with a stubborn virus
« Reply #1 on: January 05, 2015, 04:49:10 PM »
see instructions here  https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and Farbar Recovery Scan Tool logs

have you used a USB stick/drive lately that have been inserted in another machine?



« Last Edit: January 05, 2015, 04:53:10 PM by Pondus »
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #2 on: January 05, 2015, 06:07:39 PM »
I used a USB flash drive to transfer some photos. I don't know if that was the culprit or not. The logs are attached. Thanks.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40632
  • Dragons by Sasha
    • Malware fixes
Re: Please help with a stubborn virus
« Reply #3 on: January 05, 2015, 06:29:50 PM »
Not a false positive, but real

Could you uninstall YAC (yet another cleaner ) please

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
HKU\S-1-5-21-4006700494-1004150182-100131720-1002\...\Run: [AdopeFlash] => C:\Google\AutoIt3.exe [750320 2003-10-25] (AutoIt Team)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4006700494-1004150182-100131720-1002 -> {C0220B26-F5DB-4F4F-9EA5-AC6C848590BA} URL =
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2015-01-05] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2015-01-05] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2015-01-05] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [42152 2015-01-05] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-01-05] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-01-03] (Elex do Brasil Participações Ltda)
2015-01-05 10:16 - 2015-01-05 10:16 - 00001926 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\YAC.lnk
2015-01-05 10:16 - 2015-01-05 10:16 - 00001920 _____ () C:\Users\Public\Desktop\YAC.lnk
2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\Users\Bruce\AppData\Roaming\Elex-tech
2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-01-05 10:16 - 2015-01-05 10:16 - 00000000 ____D () C:\Program Files (x86)\Elex-tech
2015-01-05 10:16 - 2015-01-05 09:16 - 00045224 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeKrnlBoot.sys
2015-01-05 10:16 - 2015-01-03 03:57 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeNetFilter.sys
2015-01-05 10:14 - 2015-01-05 10:14 - 00729256 _____ (Elex do Brasil Participações Ltda) C:\Users\Bruce\Downloads\yet_another_cleaner_sk_1054473.exe
2015-01-05 10:14 - 2015-01-05 10:14 - 00000000 ____D () C:\Users\Bruce\AppData\Roaming\eCyber
Task: {5AEDF8CE-06D6-449F-A7F2-8CEC8C72F932} - \Tempo Runner coz64host No Task File <==== ATTENTION
C:\Google
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
FINALLY TO CLEAN THE USB

Download MCShield to your desktop and install
It will initially run a scan and show the result as a toaster by the system clock
Then in the control centre select scanner and tick unhide items on flash drives

Plug in the drive and McShield will start a scan

Then get the log which will be located under the logs tab on the main page

And post that

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36043
Re: Please help with a stubborn virus
« Reply #4 on: January 05, 2015, 06:38:54 PM »
Quote
I used a USB flash drive to transfer some photos.
all machines that usb stick/drive has been plugged in to are most likely infected .... you may tell the owner

they may ask for cleaning help here   ;)

Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #5 on: January 05, 2015, 07:57:30 PM »
The fixlog.txt is attached. I was able to follow these instructions up to the adwcleaner scan. That program said it had run into problems and had to reboot the computer. It referenced IRQL_NOT_LESS_OR_EQUAL as the apparent reason that it could not continue. How should I proceed from here? Thanks.

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36043
Re: Please help with a stubborn virus
« Reply #6 on: January 05, 2015, 08:04:13 PM »
continue with next program ....
Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #7 on: January 05, 2015, 08:24:19 PM »
continue with next program ....

OK. Here's the other scan log.



MCShield ::Anti-Malware Tool:: http://www.mcshield.net/

>>> v 3.0.5.28 / DB: 2014.12.28.1 / Windows 8.1 <<<


1/5/2015 2:18:27 PM > Drive C: - scan started (OS ~452 GB, NTFS HDD )...



=> The drive is clean.


1/5/2015 2:18:28 PM > Drive E: - scan started (no label ~3887 MB, FAT32 flash drive )...



=> The drive is clean.



Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40632
  • Dragons by Sasha
    • Malware fixes
Re: Please help with a stubborn virus
« Reply #8 on: January 05, 2015, 08:28:49 PM »
We will replace the Adwcleaner programme with a similar one.  How is the computer behaving now ?

Please download Junkware Removal Tool to your desktop.
  • Right-mouse click JRT.exe and select "Run as Administrator" the tool will open and start scanning your system
  • please be patient as this can take a while to complete depending on your system's specifications
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • post the contents of JRT.txt into your next message.

Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #9 on: January 05, 2015, 11:40:25 PM »
I think that solved the problem! Computer seems to be okay now.

Here's the log.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 x64
Ran by Bruce on Mon 01/05/2015 at 14:59:22.34
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Chrome

Successfully deleted: [Folder] C:\Users\Bruce\appdata\local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 01/05/2015 at 15:07:16.61
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Thanks a ton. I would love to buy you a pint.

Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #10 on: January 06, 2015, 04:07:57 PM »
Hi Essexboy,

Pondus messaged me to check back with you today, so that you could remove the tools used in the cleaning process. Computer is working normally again. THANK YOU!

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40632
  • Dragons by Sasha
    • Malware fixes
Re: Please help with a stubborn virus
« Reply #11 on: January 06, 2015, 05:13:11 PM »
Subject to no further problems   :)

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems 

Now the best part of the day ----- Your log now appears clean  :thumbsup:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset  System Restore points:

Remove tools

Download and run Delfix




: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

If you do need to keep Java then download JavaRa
Run the programme and select  Remove Java Runtime.  Uninstall all versions of Java present
Once done then run it again and select Update Java runtime > Download and install Latest version



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware



Malwarebytes.

Update and run weekly to keep your system clean

Unchecky

Click on the link above to be taken to Unchecky.com
click the very large Download button.
click Save
Click Open folder
Right click on the Unchecky_setup and choose to Run as Administrator
Once open click the Install button.
Then click on Finish
Unchecky is now installed and will help you keep unwanted check boxes unchecked, this is a fire and forget programme  ;)

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide  Best security practices Keep safe  :wave:

Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #12 on: January 08, 2015, 02:03:38 PM »
I have followed all your advice, and everything looks good. Thanks again.  :)

One last question, What should I do with the infected files that Avast quarantined. Is it safe to delete them?

Offline Pondus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 36043
Re: Please help with a stubborn virus
« Reply #13 on: January 08, 2015, 03:48:12 PM »
Quote
One last question, What should I do with the infected files that Avast quarantined. Is it safe to delete them?
let them stay for a week or two, if no ill effect .... delete

Chief Wiggum: Uh, no, you got the wrong number. This is 9-1…2.


Offline HeelBacker

  • Newbie
  • *
  • Posts: 8
Re: Please help with a stubborn virus
« Reply #14 on: January 09, 2015, 03:12:34 AM »
OK. Thanks.