Win32 MBRoot - J[Trj] detected

[Pondus]

Follow this guide from our expert malware remover Essexboy
http://forum.avast.com/index.php?topic=53253.0
( post the logs here in this topic and not in the guide )


To avoid using multiple post with copy and paste you have to attach the log`s
Lower left corner: Additional Options > Attach ( OTS log ) save OTS log as ANSI

Essexboy will look at the log when he arrive here later today...

[noridge]

thanks Pondus my ots log is attached

[essexboy]

What malware does the site think you have ?

I see you still have AVG 7.5 antispyware installed - I think updates for that finished a few years ago.. So I would recommend you uninstall it

[noridge]

hi essexboy

i asked the webhost about the malware. they replied saying that in the log they can only see the IP and HTTP request with a message in the security cluster showing Malware has been detected.

apparently they can enable further debugging, however it’s a global option which will log information about each HTTP request to all domains on the cloud, thus causing a lot of logs! i'll ask if they can do that.

i'll post a reply once i hear back from them again.

i have uninstalled AVG (this pc needs a little love as i havent used it in so long).

[Left123]

hi essexboy

i asked the webhost about the malware. they replied saying that in the log they can only see the IP and HTTP request with a message in the security cluster showing Malware has been detected.

apparently they can enable further debugging, however it’s a global option which will log information about each HTTP request to all domains on the cloud, thus causing a lot of logs! i'll ask if they can do that.

i'll post a reply once i hear back from them again.

i have uninstalled AVG (this pc needs a little love as i havent used it in so long).

Any other problems remain?

[noridge]

well apparently the webhost is still detecting malware when i access the site so i will post back once we have tried to debug it some more.

thanks 

[noridge]

actually there was another question.

should i delete the 2 original quarantined files from the virus chest?


original file name: 7fea1-934-0.dat
original folder: C:\Documents and Settings\All Users\Application Data\Avast Software\Avast\arpot
size of file: 1024
category: infected files
virus description: Win32:MBRoot-J [Trj]
file id: 1


original file name: 83b0e-d1c-0.dat
original folder: C:\Documents and Settings\All Users\Application Data\Avast Software\Avast\arpot
size of file: 1024
category: infected files
virus description: Win32:MBRoot-J [Trj]
file id: 2

[Left123]

actually there was another question.

should i delete the 2 original quarantined files from the virus chest?


original file name: 7fea1-934-0.dat
original folder: C:\Documents and Settings\All Users\Application Data\Avast Software\Avast\arpot
size of file: 1024
category: infected files
virus description: Win32:MBRoot-J [Trj]
file id: 1


original file name: 83b0e-d1c-0.dat
original folder: C:\Documents and Settings\All Users\Application Data\Avast Software\Avast\arpot
size of file: 1024
category: infected files
virus description: Win32:MBRoot-J [Trj]
file id: 2

I wouldn't delete them.Just let them in quarantine.

[noridge]

ok i'll leave those alone.

i have spoken to the webhost and we have arranged to debug this further on monday morning.

i will post anything that is discovered here.

thank you  

[essexboy]

Could you provide a fresh OTS log now please, as the removal of AVG may reveal something

[noridge]

here is my latest ots log

[essexboy]

Nothing at all showing there - are you experiencing any symptoms on your system ?

Download ComboFix from one of these locations:


Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• Double click on ComboFix.exe & follow the prompts.
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.  It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you.  Please include the C:\ComboFix.txt in your next reply.

[noridge]

hi essexboy

i've attached my combofix.txt

2 things. 1 it took ages to get combofix to launch and i had to try a number of times before it did. 2 after the reboot all of my antivirus software was restarted so i don't know if that affected any results.

also i've noticed that my bios doesn't seem to be being reset anymore (without having to replace the cmos battery as suggested by jacksticks), which is good, however my folder settings keep being reset now and mouse wheel has stopped working correctly. very minor things but thought it best to share recent behaviour changes in case they are in any way related.

thanks.

[essexboy]

There are a few ports to close as revealed by CF

By reset do you mean the folder settings are going back to default ?

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-

3. Then in the text file go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES

4. Save the above as CFScript.txt

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below.  This will start ComboFix again.




6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt .

[noridge]

By reset do you mean the folder settings are going back to default ?

i am not sure if all options are defaulted but i noticed that 'show hidden files and folders' and 'hide extensions for known file types' have been reset to being unchecked on the last 2 hard boots.

i will run the above script now.