Trojan.Dropper.BCMiner & Rootkit.0Access

[Cza102282]

Hello All,

I'm trying to clean out a friends laptop. After running MBAM four times, I'm still not able to successfully rid the topics mentioned in the post title. Searching these threads, I found someone who had a similar situation. I followed that post up to the point where the instructions were specific to the users machine. It involved running FRST64 from a command prompt. So anyways, attached are lots of logs that should do the heavy explaining! Let me know if I need to post more info...

Attach.txt

DDS.txt

FRST.txt

mbam-log-2012-08-08 (18-02-32).txt

mbam-log-2012-08-08 (19-05-36).txt

mbam-log-2012-08-08 (20-17-46).txt

mbam-log-2012-08-08 (20-23-10).txt

Search.txt

[MrCharlie]

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

[Cza102282]

OK. Great.

Here it is...

Fixlog.txt

[MrCharlie]

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[Cza102282]

OK. Here's ComboFix log.

log.txt

[MrCharlie]

Did you have AVG2012 at one time and uninstall it??

There's plenty of left over files/folders on the system.

There's an uninstaller to use:

http://www.avg.com/us-en/utilities

~~~~~~~~~~~~~~~~~~~~

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

[Cza102282]

I actually have AVG2012 on the system currently. It had no anti-virus when I got it, I believe I installed it after the 3rd MBAM scan.

Is there anything I need to clean up related to AVG?

BTW. MBAM came back clean!

[MrCharlie]

This is what is reported on the system:

AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

OK, Norton is disabled and out of date.

Just make sure AVG is providing you with realtime protection.

-------------------------------

If it's running OK and the logs are clean > you're good to go.

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

Please download OTL from one of the links below: (you may already have OTL on the system)

http://oldtimer.geekstogo.com/OTL.exe

http://oldtimer.geekstogo.com/OTL.com

http://www.itxassoci...T-Tools/OTL.exe

Save it to your desktop.

Run OTL and hit the CleanUp button. (This will cleanup the tools and logs used including itself)

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, etc....

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Cza102282]

Thanks for posting back with that piece of information and thanks for all your help so far. That actually provided some insight into the next problem I am facing. Windows was very outdated and now I am having some difficulties with Windows update.

First, I ran windows update and I believe there were 3 updates, one of which was SP1. I set them to install and the cpu restarted and SP1 seemed to install fine. I ran Windows update again and now I can't get any updates to download/install. I thought it may have been a botched SP1 install so I rolled back to a restore point before SP1 and tried some of the other updates that were available. One of which was a MS Office Validation Add-In. Nothing would download/install. SP1 will download and install but nothing else. See attached picture for error message...

So a quick google on that error code told me to check if I had two services running. I believe it was BITS and Windows Event Log. I did not see the BITS service (is this Vista specific?) Windows Event log was running. Some more google results lead me to an improper removal of Norton (which your previous post confirmed, was actually on the cpu). I ran a Norton removal tool and tried updating but still no luck.

I ran out of time last night to really look into this but does this still seem like some fallout from the virus? Or is this a unrelated problem? I'm not going to give it back until I am confident Windows updates will download and install automatically.

Chris

[MrCharlie]

Please remove any usb or external drives from the computer before you run these scan!

Please download Farbar Service Scanner and run it on the computer with the issue.

• Make sure the following options are checked:
  
  • Internet Services
    
  • Windows Firewall
    
  • System Restore
    
  • Security Center
    
  • Windows Update
    
  • Windows Defender
    

  [*]Press "Scan".

  [*]It will create a log (FSS.txt) in the same directory the tool is run.

  [*]Please copy and paste the log to your reply.

MrC

[Cza102282]

OK. I'll do it when I get home from work tonight.

Thanks much.

Chris

[Cza102282]

Here it is...

FSS.txt

[MrCharlie]

Download this file here to your desktop, then double click on it and allow it to merge into the registry.

Reboot and see how it is, MrC

[Cza102282]

It worked! All updates installed great! Thanks again.

One last question...

I did read the info from your link in your previous post that was mentioning that this kind of virus usually means a complete re-format and re-install.

Since you saw the logs first hand, would you personally recommend this? I don't believe there are any sensitive documents on it. I can tell you that this machine is used for logging onto websites to access personal info (bank, credit card, facebook, etc.) Would just suggesting to change all online passwords suffice?

I did read all of the information from the link but I would like your professional opinion if you don't mind.

Thanks,

Chris

[MrCharlie]

We have to give you that warning, I assume you saw it since you posted all the correct logs for me to work with.

I would change all the passwords and just keep an eye on the accounts for a while.

But I think you'll be OK, MrC

[Cza102282]

Ok. Great. Thanks again!

[Maurice Naggar]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!