licenz2kill Posted July 23, 2012 ID:574809 Share Posted July 23, 2012 Hello, hopefully someone can help me with this beast of a trojan. I've attached the required logs as everyone else has done. let me know if i need to attach more logs or info. Thanks for your time and help.DDS.txtAttach.txt Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574811 Share Posted July 23, 2012 forgot to add mbam log.mbam-log-2012-07-22 (18-13-46).txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:574816 Share Posted July 23, 2012 Welcome to the forum.Before we proceed further, please uninstall or disable uTorrent and any other peer-to-peer filesharing app. Continued use of filesharing or ill-advised downloads will surely re-infect your system.Risks of File-Sharing Technology.P2P file sharing: Know the risksIt's also against our policy:http://forums.malwarebytes.org/index.php?showtopic=97700MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574827 Share Posted July 23, 2012 It is disabled and thank you for the help. Ive also attached the scan log from frst64.exe as others have been advised to do.FRST.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:574829 Share Posted July 23, 2012 services.exe is infected and has to be replaced: C:\Windows\System32\services.exe A302BBFF2A7278C0E239EE5D471D86A9 ZeroAccess <==== ATTENTION!. In Vista or Windows 7: Boot to System Recovery Options and run FRST.Type the following in the edit box after "Search:".services.exeIt then should look like:Search: services.exeClick Search button and post the log (Search.txt) it makes to your reply.MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574833 Share Posted July 23, 2012 Here is the file requested. Search.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:574838 Share Posted July 23, 2012 OK, here you go......Please carefully carry out this procedure!!!!!!Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flashdrive as fixlist.txt C:\Windows\Installer\{ad76ea11-459e-ca83-fac0-3a39b0a2d64a}C:\Users\NK\AppData\Local\{ad76ea11-459e-ca83-fac0-3a39b0a2d64a}C:\Windows\assembly\GAC_32\Desktop.iniC:\Windows\assembly\GAC_64\Desktop.iniReplace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exeNOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options.Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.PS: Gone for tonight, be back tomorrow am, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574849 Share Posted July 23, 2012 Here is the fixlog.txt the program generated. Talk to you in the am, thanks.Fixlog.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:574854 Share Posted July 23, 2012 It didn't work, please use the attached fixlist.txt and try it again, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574861 Share Posted July 23, 2012 Here ya go.Fixlog.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:574865 Share Posted July 23, 2012 That worked! See you in the AM, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:574867 Share Posted July 23, 2012 looking forward to it. Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:575011 Share Posted July 23, 2012 Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingc...to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:575046 Share Posted July 23, 2012 Goodmorning, Here is the log file that was output by combofix after it ran.ComboFix.txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:575047 Share Posted July 23, 2012 Looks Good.....Please Update and run a Quick Scan with MBAM, post the report.Make sure that everything is checked, and click Remove Selected.Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:575052 Share Posted July 23, 2012 malware bytes says there are no threats detected.mbam-log-2012-07-23 (06-56-13).txt Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:575058 Share Posted July 23, 2012 How's it running??? MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 23, 2012 Author ID:575063 Share Posted July 23, 2012 I havent attempted to run anything outside of malware bytes yet as I am running a little late this morning and am currently on my way to work. I will run my web browser when i get home in about 8 hours to see if it redirects me to other websites and popups again. thanks again and sorry to make you wait. Link to post Share on other sites More sharing options...
MrCharlie Posted July 23, 2012 ID:575065 Share Posted July 23, 2012 No problem, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 24, 2012 Author ID:575429 Share Posted July 24, 2012 Okay, so im back from work and have had plenty of time to fiddle with everything and it all seems to be running smooth. Thank you for all your help, it means a great deal to have someone as knowledgable as you to help people in need. I was wondering if there was any info I could read up on to see exactly what frst64 and combofix actually do as im quite curious. Knowledge is gold these days. Link to post Share on other sites More sharing options...
MrCharlie Posted July 24, 2012 ID:575434 Share Posted July 24, 2012 I was wondering if there was any info I could read up on to see exactly what frst64 and combofix actually do as im quite curious. Knowledge is gold these days. Unfortunately that's all confidential info...sorry.There's schools that you can attend if you're interested (see my Preventive Maintenance)A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point---------------------------------Please download OTL from one of the links below: (you may already have OTL on the system)http://oldtimer.geekstogo.com/OTL.exehttp://oldtimer.geekstogo.com/OTL.comSave it to your desktop.Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)Any other programs or logs you can manually delete.IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 24, 2012 Author ID:575439 Share Posted July 24, 2012 I am getting an error saying "Windows cannot find 'ComboFix'. Make sure you typed the name correctly, and then try again" Link to post Share on other sites More sharing options...
MrCharlie Posted July 24, 2012 ID:575444 Share Posted July 24, 2012 Rename ComboFix to Uninstall.exe now double click on it.Let me know, MrC Link to post Share on other sites More sharing options...
licenz2kill Posted July 24, 2012 Author ID:575447 Share Posted July 24, 2012 It has uninstalled succesfully. Would you like me to move ahead and run OTL.exe now? Link to post Share on other sites More sharing options...
MrCharlie Posted July 24, 2012 ID:575460 Share Posted July 24, 2012 Yes go ahead and do it, MrC Link to post Share on other sites More sharing options...
Recommended Posts