Multiple infections detected but unable to be deleted another help please!

[andyingenuity]

Hi All

I have the same infection on my windows server 2008 r2 system as descibed in this post:

http://forum.avast.com/index.php?topic=82254.0

Would anyone be able to help me with removing the infection using OTS please?

Many Thanks

Andy

[essexboy]

Lets have a shufti then

 Download OTL  to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
  
• Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
CREATERESTOREPOINT

• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Post both logs

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.
 Double click the aswMBR.exe to run it  Click the "Scan" button to start scan 



On completion of the scan click save log, save it to your desktop and post in your next reply

[andyingenuity]

Thanks Essexboy, I will try this later tonight as its a Terminal Server and it has 10 people logged into it at the moment and dont want to disturb them too much unless you thinks its cool to grab the logs even if they are logged on?

[essexboy]

It may slow it down a bit as the programmes run, so the choice is yours - unless you think it may be on one of the consoles

[andyingenuity]

I took a chance and ran the software! I have the logs files although they are too big to post on the forum because of the character limits. Do you have an email address I could send these too please?

[essexboy]

Could you attach them ?

[andyingenuity]

hope this works

[essexboy]

Run this and let me know if the problem persists

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

If you have Malwarebytes 1.6 or better installed please disable it for the duration of this run
To disable MBAM
Open the scanner and select the protection tab
Remove the tick from "Start with Windows"
Reboot and then run OTL


Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  IE - HKLM\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012032807&ptnrS=YKxdm070YYgb&si=&n=77ed2f27&psa=&st=sb&searchfor={searchTerms}
  IE - HKU\S-1-5-21-2842197145-585572594-54396217-1149\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011806&ptnrS=YKxdm070YYgb&si=&n=77ecdd1e&psa=&st=sb&searchfor={searchTerms}
  IE - HKU\S-1-5-21-2842197145-585572594-54396217-1184\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011812&ptnrS=YKxdm070YYgb&si=&n=77ecdd24&psa=&st=sb&searchfor={searchTerms}
  IE - HKU\S-1-5-21-2842197145-585572594-54396217-1185\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011805&ptnrS=YKxdm070YYgb&si=&n=77ecdd1d&psa=&st=sb&searchfor={searchTerms}
  IE - HKU\S-1-5-21-2842197145-585572594-54396217-2088\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012011805&ptnrS=YKxdm070YYgb&si=&n=77ecdd1d&psa=&st=sb&searchfor={searchTerms}
  IE - HKU\S-1-5-21-2842197145-585572594-54396217-4130\..\SearchScopes\{9230cb90-79de-4945-88a4-762244a25bc8}: "URL" = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=YKxdm070YYgb&ptb=45616A18-FA2E-4AD9-87AE-B09BF4E501B8&ind=2012012304&ptnrS=YKxdm070YYgb&si=&n=77ecdf10&psa=&st=sb&searchfor={searchTerms}
  O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1149\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found
  O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1184\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found
  O3 - HKU\S-1-5-21-2842197145-585572594-54396217-1185\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found
  O3 - HKU\S-1-5-21-2842197145-585572594-54396217-4130\..\Toolbar\WebBrowser: (Recipe Hub) - {CF51DE5B-EB36-4114-BB69-84DF63FBADB4} - C:\Program Files (x86)\RecipeHub_2j\bar\1.bin\2jbar.dll File not found
  O4 - HKU\S-1-5-21-2842197145-585572594-54396217-4130..\Run: [NgoErbjm] C:\Users\alockwood\AppData\Local\fawrhxay\ngoerbjm.exe ()
  O4 - HKU\S-1-5-21-2842197145-585572594-54396217-4130..\Run: [Opxoneizu] C:\Users\alockwood\AppData\Roaming\Ohaput\imaxz.exe File not found
  O4 - Startup: C:\Users\alockwood\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ngoerbjm.exe ()
  [2012/04/18 10:42:25 | 000,000,000 | ---D | M] -- C:\Users\alockwood\AppData\Roaming\Evvyw
  [2012/04/18 11:42:09 | 000,000,000 | ---D | M] -- C:\Users\alockwood\AppData\Roaming\Ohaput
  
  :Files
  ipconfig /flushdns /c
  C:\Users\alockwood\AppData\Local\fawrhxay
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [CREATERESTOREPOINT]
  [Reboot]
• Then click the Run Fix button at the top
  
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[andyingenuity]

After scan fix, please see attached log. Thanks Essexboy

[essexboy]

How is it behaving now ?

[andyingenuity]

Same as before I'm afraid, the user still gets the annoying command processor want's to run when logging into his profile and I can see the virus exe trying to launch.....thanks for your help on this, really do appreciate it 

[essexboy]

In that case could you run OTL on the users system as opposed to the server

Use the same scan script