Cleaning up after Trojan.Ransom

[OCTurbine]

Howdy, y'all,

One of my neighbors has an HP laptop running Win 7 Pro SP1 x64. Somehow it became infected with the Trojan.Ransom virus that took control of the machine and demanded "200$" from the "FBI" because of "illegal" downloading, etc. I ran the Windows Defender Offline utility in full-scan mode from a bootable USB stick. WDO didn't seem to work the first time; I ran it again, followed by a full scan with MBAM with the latest signatures.

MBAM reported 0 objects detected. I then ran RogueKiller that detected ZeroAccess, but registry entries and folders and files only. Lastly, I ran Gmer that found Bluetooth registry entries only, but didn't actually name a virus.

Here's the output from RogueKiller:

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 13 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowControlPanel (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowHelp (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Windows\Installer\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND

[ZeroAccess][FILE] @ : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\@ --> FOUND

[ZeroAccess][FOLDER] U : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\U --> FOUND

[ZeroAccess][FOLDER] L : C:\Users\Lindy\AppData\Local\{f155b85a-2c95-0ef8-5a24-11478d872d34}\L --> FOUND

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

Gmer's output:

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@0007e034c3ea 0x69 0x10 0xBB 0x3A ...

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@001a45fe6925 0xD1 0x86 0xFD 0x6E ...

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001060ecefef@0007ab308052 0xE6 0xF9 0x4D 0xAE ...

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@0007e034c3ea 0x69 0x10 0xBB 0x3A ...

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@001a45fe6925 0xD1 0x86 0xFD 0x6E ...

Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001060ecefef@0007ab308052 0xE6 0xF9 0x4D 0xAE ...

---- EOF - GMER 1.0.15 ----

Can I manually delete everything that is reported here? Otherwise, the system is operating as expected.

I discovered an older Java JRE that's known to be vulnerable, so I uninstalled it. And I installed all of the pending Windows critical updates, including the latest Cumulative Update for IE8 discussed in Security Bulletin MS12-063.

Thanks for your suggestions.

[daledoc1]

Hi, OCTurbine:

Sorry to hear you might be infected - it appears that you have a nasty rootkit.

We cannot formally review scan logs or work on malware removal in this sub-section of the forum, so please read below for assistance with cleaning your system.

IMPORTANT: Please do NOT use any temporary file cleaners unless instructed to do so - they can cause data loss, making recovery difficult.

Also, it's not a good idea to run some of the powerful malware cleaning tools without expert help, as they can damage the system.

IF YOU WOULD LIKE EXPERT HELP WITH MALWARE REMOVAL, PLEASE CHOOSE ONE OF THE FOLLOWING 3 OPTIONS:

OPTION 1: Free, one-on-one, expert assistance in the Malware Removal Forum.

OPTION 2: For licensed users of MBAM PRO, there is free, one-on-one, expert assistance from the MBAM support helpdesk.

OPTION 3: Fee-based, one-on-one, expert assistance from Premium Support.

OPTION 1:

• Please print out, read and carefully follow the instructions in the "I'm Infected - What Do I Do Now?" sticky topic.
  
• -->If the infection has so crippled the computer that you cannot complete some or all of the steps, then just do the best you can and start a new topic as described below.
  
• Then please start a new post in the Malware Removal Forum.
  
• An authorized, trained malware expert will provide free, one-on-one assistance as soon as one becomes available.
  

• -->>When starting your new post, please note the following:<<--
  
• Please do NOT post in a topic started by someone else, even if their problem sounds similar.
  
• Please COPY/PASTE the requested logs directly into your post, rather than attaching them.
  
• Under options, please be sure to select "track this topic" and "immediate email notification", so you'll know when a helper responds.
  
• Please be patient - it may be 48 hours or more before a helper can assist you, especially when the forum is very busy.
  
• Please do NOT "bump" your topic or reply back to it for at least 48 hours.
  
• Doing so may cause your topic to be overlooked, as it will appear that you are already being helped.
  

OPTION 2:

If you are a paid user of MBAM PRO and would like support via the helpdesk, please contact them HERE.

OPTION 3:

If you prefer the Malwarebytes Premium Services (comprehensive solutions to all your computer support needs – from installation and set-up to troubleshooting and tune-ups), please go to the Premium Support site HERE.

Please be patient – someone will assist you as soon as possible.

Thank you very much,

daledoc1