Consrv.dll, cant find the dropper

[BigmaccyD]

hey guys ive recently become infected with this evil virus, ive managed isolate it, but avast is blocking it every 10mins or so. which leads me to believe the dropper still exists..

thanks for future help

all the best from the uk

[oldman]

Hi  BigmaccyD, welcome to the forum.

To make cleaning this machine easier

• Please do not uninstall/install any programs unless asked to
  It is more difficult when files/programs are appearing in/disappearing from the logs.
  
• Please do not run any scans other than those requested
  
• Please follow all instructions in the order posted
• All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
• Do not attach any logs/reports, etc.. unless specifically requested to do so.
• If you have problems with or do not understand the instructions, Please ask before continuing.
  
• Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
  

You have combofix on your computer so we will use it  but will run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
  
• in the run box type notepad
  
• click ok
  
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE
  

Code: [Select]


File::
C:\Windows\SysNative\ca-messagequeuing.dll

Driver::
Si3132r5

NetSvc::
Si3132r5

In the notepad

• Click File, Save as..., and set the Save in to your usb device
  
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
  
• Click save
  

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close  all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**



Please post back with the combofix log.

[BigmaccyD]

here is the combofix

thanks for the assist oldman

[oldman]

Hi  BigmaccyD,

How's the computer? Is Avast still giving warnings?

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

The log shows multiple antivirus programs. There are also traces of AVG. This will not give you more protection but could actually results in less due to conflicts.

Please uninstall Lavasoft and AVG.

Next

• Double click on OTL.exe  to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output
  
• unCheck the boxes beside LOP Check and Purity Check.
  
• In the window under Custom Scans/Fixes copy and paste the following

netsvcs
/md5start
ca-messagequeuing.dll
consrv.dll
/md5stop

• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  

When the scan completes, it will a two notepad windows, OTL.Txt no Extras.Txt this time.

[BigmaccyD]

heya oldman, yeah the virus warnings have passed. although when i ran combofix to get the log i had to shut down the avast shields and combofix had to remove consrv.dll and sys64 folder. ?

i have uninstalled lavasoft at your request as for avg they must be remnants of a past install as i dont have it on my system.

hese is the otl.log.

thanks for all the help so far you guys are awesome

best wishes Marc

[oldman]

Hi BigmaccyD,

Your java is out of date. Click your start button > Control Panel

• Use the drop down menu beside view by and change it to small icons
  
• locate java (32bit) (looks like a coffee cup) in the list and click on it
  
• when the java console opens click the update tab
  
• Click update now
  

Next, Right click on OTL.exe and chose Run as Administrator to run it

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
• Do Not copy the word CODE
  
• please note the fix starts with the :
  

Code: [Select]

:Services

:OTL
O2:[b]64bit:[/b] - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
DRV:[b]64bit:[/b] - (SirefefRemover) -- C:\Windows\SysNative\drivers\SirefefRemover.sys (ESET spol. s r.o.)

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SirefefRemover]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

:Files
C:\Windows\SysNative\ca-messagequeuing.dll
C:\Windows\SysNative\dds_trash_log.cmd
C:\Windows\SysNative\drivers\SirefefRemover.sys
C:\Users\Marky\AppData\Roaming\AVG2012

:Commands
[resthosts]
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.
• Reboot your computer

Please post the  OTL fix log.

You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
  
• Click Check for Updates
  
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with

• OTL fix log
• MBAM log

Any problems?

[BigmaccyD]

hmm otl stops responding, at boot execute avg2012

normal or ?

edit, mbam finished without finding anything to remove still need the log ?

[oldman]

Hi

No need to post the MBAM log if it's clean.

Let's give the AVG Removal Tool a try. Download it from HERE and save it to your desktop.

double click it and follow the prompts.

Rerun the OTL fix, I removed the line OTL seems to be having problems with.

Code: [Select]

:Services

:OTL
O2:[b]64bit:[/b] - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll File not found
DRV:[b]64bit:[/b] - (SirefefRemover) -- C:\Windows\SysNative\drivers\SirefefRemover.sys (ESET spol. s r.o.)

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SirefefRemover]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

:Files
C:\Windows\SysNative\ca-messagequeuing.dll
C:\Windows\SysNative\dds_trash_log.cmd
C:\Windows\SysNative\drivers\SirefefRemover.sys
C:\Users\Marky\AppData\Roaming\AVG2012

:Commands
[resthosts]
[emptytemp]
[createrestorepoint]
Post back with the OTL fix log.
 

[BigmaccyD]

ran avg cleaner as requested and otl straight after it completed with no errors this time

also ive included the avg log so you can take a look at it

im not sure if this is the right otl as it saved it too otl moved files ? and not the desktop


best regards

marc

[oldman]

Hi BigmaccyD,

Everything looks pretty good.

One more scan to check for stragglers.


As a Vista/Win7 user you will need to right click your browser icon and select "Run as Administrator" in order to run this scan.

• Do not use this instance of your browser for anything besides doing this scan
• When the scan is complete and the results saved, close that instance of your browser
• Open a new one the usual way and post the results in this topic.

[color="#009900"]*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
[/color]

Go here to run an online scannner from
[color="#4169E1"]ESET[/color]

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activex control to install
  
• Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  
• Click Start
  
• Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is  Checked.
  
• Click Scan.
  
• Wait for the scan to finish.
• When the scan completes, click List of found threats
  
• click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
  
• Include the contents of this report in your next reply

Note - when ESET doesn't find any threats, no report will be created.

• Push the back button.
  
• Push Finish
  
• Re-enable your Antivirus software.
  

[BigmaccyD]

ran esnet online scan and it came back clean bill of health

[oldman]

Hi BigmaccyD,

One little fix to fix an error in the script I had you run.

Next, Right click on OTL.exe and chose Run as Administrator to run it

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
• Do Not copy the word CODE
  
• please note the fix starts with the :
  

Code: [Select]

:Services

:Commands
[resethosts]
[createrestorepoint]

Then click the Run Fix button at the top

• Let the program run unhindered
• Please save the resulting log to be posted in your next reply.

Please post the  OTL fix log

One more OTL log to see if anything is left. We'll clean up the tools and send you on your way after you post back.

Open OTL if it's not still open and click the Quick Scan button.

Please post back with both OTL logs.

Thanks

[BigmaccyD]

kicks out an error saying "cannot create file C:\windows\system32\drivers\etc\hosts"

and kicks out this file when closed, should i have left it to complete ? it seemed like it had hung and wasnt doing anything?

best wishes marc

[oldman]

Hi BigmaccyD,

Let's try it this way. Regardless of the outcome of the fix please obtain a new OTL scan log after you run the fix.

Code: [Select]

:Services

:OTL
O1 - Hosts: 109.163.226.208 www.google-analytics.com.
O1 - Hosts: 109.163.226.208 ad-emea.doubleclick.net.
O1 - Hosts: 109.163.226.208 www.statcounter.com.
O1 - Hosts: 67.215.245.19 www.google-analytics.com.
O1 - Hosts: 67.215.245.19 ad-emea.doubleclick.net.

:Commands
[createrestorepoint]
[reboot]
Post back with the OTL fix log and the new OTL.txt.

[BigmaccyD]

still coming up with the same error, but isnt giving any logs on close