[Can not turn on malware protection]

FYI: The problem has returned after first boot this morning: MB flagged 'Malwareware protection off'', but it cannot be enabled.

[Can not turn on malware protection]

Many thanks - adding the exclusions to VIPRE has remedied the problem.

Dave.

[Can not turn on malware protection]

I have the same problem (cannot enable malware protection), commenced this morning after initial boot (v 3.4.5.2467 & Win7 x64 Pro), mb-check-results.zip  attached.

Dave.

mb-check-results.zip

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Many thanks - completed (Thread can be closed).

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Is a final tidy-up is still needed - e.g., to remove FRST logs/quarantines & delete 'system restore' backups still holding virus content ?

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Looks OK (MAM threat scan found nothing).

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Apologies - for 'missing' read 'hidden', so Malwarebytes Anti-Malware is amongst the hidden icons (as expected).

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

After FRST re-boot, Malwarebytes Anti-Malware is back again amongst the 'Missing Icons' on the toolbar.

 

FRST Fixlog.txt attached.

 

Dave.

Fixlog.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

I've just noticed that Malwarebytes Anti-Malware is missing from the 'Missing Icons' on the toolbar (VIPRE is there)

 

FRST scan files attached.

 

Dave.

Addition.txt

FRST.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

1) Error message post-boot:

 

RegSvr32
The module "C:\ProgramData\GoluKfid\OatboSratl.fox" failed to load.
Make sure the binary is stored at the specified path or debug it to check for problems with the binary or dependent .DLL files.
The specified module could not be found.
 

2) Start-up includes:

 

Yes    HKCU:Run    GoluKfid    Microsoft Corporation    regsvr32.exe "C:\ProgramData\GoluKfid\OatboSratl.fox"

 

No trace of OatboSratl.fox apart from the two quarantine copies.

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Yes - deleting C:\ProgramData\GoluKfid\ also deletes C:\Users\All Users\GoluKfid\

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Superficially OK (nothing detected by Malwarebytes scan), but there are still two copies of OatboSratl.fox post-FRST fix at 15:58 (plus two in quarantine), see screenshot.

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

FRST Fixlog.txt attached, plus AdwCleaner[s0].txt

Dave.

AdwCleanerS0.txt

Fixlog.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

FRST Search.txt attached.

 

Dave.

Search.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

https://www.virustotal.com/en/file/8eb1d073516485ee9e0d079f7e33c17e7d63c68f2eadeb1c8b3138b1867fc21e/analysis/1423917074/

 

Dave

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

VirusTotal scan:

File name: OatboSratl.fox
Detection ratio: 20 / 57  
Analysis date: 2015-02-14 12:18:26 UTC ( 0 minutes ago )  
 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Malwarebytes Anti-Rootkit now runs without premature exit - files attached (mbar-log-2015-02-14 (11-13-34).txt & system-log.txt), plus subsequent FRST scan files (FRST.txt & Addition.txt).

 

The 3 copies of OatboSratl.fox (as per earlier screenshot, with same size, dates & paths) still remain.

 

Dave.

Addition.txt

FRST.txt

mbar-log-2015-02-14 (11-13-34).txt

system-log.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Malwarebytes Anti-Rootkit: "An error has occurred: Scan failed!" on two attempts (updated successfully) ...

 

1) Malwarebytes Anti-Rootkit - "Registry Value "AppInit_Dlls" has been found ... Press 'no' button if not sure [selected] ... if tool crashes ... restart and press "yes" ...'

"This version of Malwarebytes Anti-Rootkit requires ... to completely exit ... [OK selected] - "An error has occurred: Scan failed!" and exit

2) Launched mbar.exe - "Registry Value "AppInit_Dlls" has been found ... Press 'no' button if not sure ... if tool crashes ... restart and press "yes" [selected] ...'

"This version of Malwarebytes Anti-Rootkit requires ... to completely exit ..." [OK selected] - "An error has occurred: Scan failed!" and exit
 

So FRST scan not undertaken.

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Also, there are two start-up entries (the first is new, and disabled by me)

 

No    HKCU:Run    GoluKfid    Microsoft Corporation    regsvr32.exe "C:\ProgramData\GoluKfid\OatboSratl.fox"
No    HKCU:Run    GoluKfid    Microsoft Corporation    regsvr32.exe "C:\ProgramData\GoluKfid\OatboSratl.fox"
 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Thanks - Fixlog.txt attached.

 

FYI: Two newer versions of OatboSratl.fox have appeared - screenshot of the search for all .fox files attached (post-FRST fix 09:55 14 Sep 2015)

 

Dave.

Fixlog.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Rerun with Farbar Recovery Scan Tool - files attached.

Dave.

Addition.txt

FRST.txt

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Virustotal reports:

File name: OatboSratl.fox
Detection ratio: 5 / 57

Kaspersky - UDS:DangerousObject.Multi.Generic - 20150213  
Avira - TR/Crypt.ZPACK.Gen8 - 20150213  
AVG - Inject2.BOTR - 20150213  
Bkav - HW32.Packed.C45E - 20150213  
ESET-NOD32 - a variant of Win32/Kryptik.CYGW - 20150213  
 

https://www.virustotal.com/en/file/8eb1d073516485ee9e0d079f7e33c17e7d63c68f2eadeb1c8b3138b1867fc21e/analysis/1423861508/

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

And delete these ?:

 

C:\ProgramData\GoluKfid\OatboSratl.fox
C:\Users\All Users\GoluKfid\OatboSratl.fox
 

TIA.

 

Dave

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

Just a final note: the Laptop start-up procedure still contains this entry

 

Yes    HKCU:Run    GoluKfid    Microsoft Corporation    regsvr32.exe "C:\ProgramData\GoluKfid\OatboSratl.fox"

 

Which I've disabled - presumably it can be deleted ?

 

Dave.

[Ransomware - Trojan.Agent.ED, Trojan.Dorkbot.ED etc]

SvcRepair.log is attached.

 

I've just scanned the system with Malawarebytes & VIPRE and neither detected anything, and there's no unusual activity - so I guess that's it fixed ?

 

I'll send something shortly as a contribution to tonight's drinks ;-)

 

Dave.

SvcRepair.log