Author Topic: win32:mbroot-j problem (Read 12483 times)

jeffce · « **Reply #15 on:** May 31, 2012, 02:02:27 PM »

Hi,

Ok let's work with another tool we have. Please do the following...

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
----------

nghi219 · « **Reply #16 on:** May 31, 2012, 03:00:18 PM »

thanx Jeff ..

.. please find attached log

nghi219 · « **Reply #17 on:** May 31, 2012, 03:28:10 PM »

Hi Jeff.

I looked up Dr.Web-LiveCD manual ..

.. I think I can handle the non-GUI advanced mode .

You tell me how I should do the scan (default settings or command line with actions parameters) and I will do it ..

jeffce · « **Reply #18 on:** May 31, 2012, 04:29:33 PM »

Hi,

Let's continue with ComboFix.

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code: [Select]

ClearJavaCache::

DDS::
uStart Page = hxxp://news.google.com.au/?pog=false
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;127.0.0.1:9421;<local>;*.local
uSearchAssistant = hxxp://www.searchqu.com/web?src=ieb&appid=172&systemid=406&sr=0&q={searchTerms}
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: &Download All using 4shared Desktop - c:\program files\4shared Desktop\down_all.htm

Firefox::
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\uy63jpps.default\
FF - user.js: extensions.BabylonToolbar_i.id - b0106d1f00000000000002004c4f4f50
FF - user.js: extensions.BabylonToolbar_i.hardId - b0106d1f00000000000002004c4f4f50
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15309
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1716:44
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babclient
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extensions.BabylonToolbar_i.babTrack -
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt -
FF - user.js: extensions.BabylonToolbar_i.instlRef - std

File::
c:\program files\IObit\Advanced SystemCare 5\ASCService.exe
c:\windows\system32\drivers\aq3ls.sys

Folder::
c:\windows\system32\config\systemprofile\Application Data\IObit
c:\documents and settings\Administrator\Application Data\IObit

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"5985:TCP"=-

RegLock::
[HKEY_USERS\S-1-5-21-1659004503-920026266-725345543-500\Software\Microsoft\Internet Explorer\User Preferences]

Driver::
AdvancedSystemCareService5
aq3ls.sys

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

nghi219 · « **Reply #19 on:** June 01, 2012, 01:47:30 AM »

thanks Jeff ..

..

1_ combofix updated itself then windows re-booted with the following warning

2_ the 2nd time, combofix ran fine and produced the attached log ..

jeffce · « **Reply #20 on:** June 01, 2012, 03:17:12 AM »

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code: [Select]

ClearJavaCache::

DDS::
uSearchAssistant = hxxp://www.searchqu.com/web?src=ieb&appid=172&systemid=406&sr=0&q={searchTerms}
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

nghi219 · « **Reply #21 on:** June 01, 2012, 04:33:30 AM »

thanks Jeff ..

.. please see attached log .

jeffce · « **Reply #22 on:** June 01, 2012, 02:49:45 PM »

Hi,

Looks like we have some entries that want to stick around.

Please run a new Quick Scan with OTL. Don't worry about selecting LOP or Purity this time and then attach the new log when complete.

nghi219 · « **Reply #23 on:** June 01, 2012, 04:32:57 PM »

Thanx Jeff ..

.. I repeated the otl scan as described as part of the 3 initial scans (mbam-otl-aswmbr)

Please find attached log .. somehow only otl.txt is produced (no extras.txt).

jeffce · « **Reply #24 on:** June 01, 2012, 05:27:26 PM »

Hi,

The Extras.txt is only produced on the first run of OTL. If we need another we can get one though.

----------

Please download and run ERUNT (Emergency Recovery Utility NT). This program allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed. **Remember if you are using Windows Vista as your operating system right-click the executable and Run as Administrator.
----------

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code: [Select]

:Services

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.msn.com/spbasic.htm
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {2381E4B7-5C04-459E-9D46-2F9AC1608B66}
IE - HKU\S-1-5-19\..\SearchScopes\{2381E4B7-5C04-459E-9D46-2F9AC1608B66}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=ysp
IE - HKU\S-1-5-21-1659004503-920026266-725345543-500\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchqu.com/web?src=ieb&appid=172&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
FF - prefs.js..browser.search.defaultthis.engineName: "ToggleEN Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=642886&ilc=12"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.startup.homepage: "http://news.google.com.au/?pog=false"
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.9.1.14019
FF - prefs.js..extensions.enabledItems: radiobar@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.0.0.10
FF - prefs.js..keyword.URL: "http://au.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=642886&p="
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&q="
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
[2011/12/01 15:44:11 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012/05/30 11:30:59 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/10/17 19:01:44 | 000,002,520 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
O3 - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\Toolbar\ShellBrowser: (no name) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - No CLSID value found.
O3 - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\Toolbar\ShellBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O3 - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O3 - HKU\S-1-5-21-1659004503-920026266-725345543-500\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
[2012/05/30 15:31:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Advanced SystemCare 5
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2012/05/31 16:22:53 | 000,188,416 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/30 15:31:43 | 000,000,874 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Advanced SystemCare 5.lnk
[2010/10/15 12:00:48 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/10/15 11:55:46 | 000,001,940 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2011/09/05 22:23:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2011/10/21 20:03:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\searchquband
[2011/08/07 16:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\WhiteSmoke
[2012/05/30 15:31:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit

:Files
ipconfig /flushdns /c

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered. There will be a log created when it completes that I will need in your next reply. Reboot when it is done.
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

nghi219 · « **Reply #25 on:** June 01, 2012, 11:06:50 PM »

Thanks Jeff ..

.. here is the otl log

nghi219 · « **Reply #26 on:** June 01, 2012, 11:21:18 PM »

Quote from: jeffce on June 01, 2012, 05:27:26 PM

Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

I missed this part ..

.. Please find the new scan log attached

jeffce · « **Reply #27 on:** June 02, 2012, 05:22:01 AM »

Hi,

Malwarebytes

I see that you have Malwarebytes already on your computer. Please open Malwarebytes, update it and then run a Quick Scan. Save the log that is created for your next reply.
----------

Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan[/i]

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats is NOT selected and the option Scan unwanted applications is selected.
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, you may close the window
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

----------

In your next reply please attach the logs made by Malwarebytes and ESET online scanner. :)

nghi219 · « **Reply #28 on:** June 02, 2012, 08:21:26 AM »

thanx Jeff ..

.. here are mbam & eset logs

jeffce · « **Reply #29 on:** June 02, 2012, 09:46:57 PM »

Hi,

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

Code: [Select]

:Services

:Files
C:\Documents and Settings\Administrator\My Documents\Downloads\fliptoast.exe	
C:\Documents and Settings\Administrator\My Documents\Downloads\gamebooster.exe	
C:\Documents and Settings\Administrator\My Documents\Downloads\reginout_setup.exe	
C:\Documents and Settings\Administrator\My Documents\Downloads\sd2-setup220.exe

:Commands
[purity]
[emptytemp]
[resethosts]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then run a new scan and post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

In your next reply please attach the new OTL log and let me know how your system is running. :)

Author Topic: win32:mbroot-j problem (Read 12483 times)

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem

nghi219

Re: win32:mbroot-j problem

jeffce

Re: win32:mbroot-j problem